From 9353e0236525c588d4a3d7eb5cf0ff0bf2ab7df4 Mon Sep 17 00:00:00 2001 From: Brian Lehnen Date: Thu, 28 May 2026 10:14:16 -0500 Subject: [PATCH] chore(deps): refresh dependencies + fix OpenTelemetry CVE-2026-40894 (0.9.37) Bump OpenTelemetry 1.15.2 -> 1.15.3 to clear the transitive OpenTelemetry.Api advisory (CVE-2026-40894 / GHSA-g94r-2vxg-569j, NU1902 moderate: excessive memory allocation parsing propagation headers), then remove the now-dead NU1902 from Transport.SQLite.csproj. Broader dependency refresh across Directory.Packages.props: Microsoft.Data.SqlClient 7.0.1, Npgsql 10.0.3, SimpleInjector 5.5.2, StackExchange.Redis 2.13.17, MudBlazor 9.5.0, CronExpressionDescriptor 2.48.0, Cronos 0.13.0, SourceLink 10.0.300, the Microsoft.Extensions/System.* set -> 10.0.8; test tooling coverlet 10.0.1, MSTest 4.2.3, Test.Sdk 18.6.0, Retry 2.2.3, bunit 2.7.2, Playwright 1.60.0, TestHost(net10) 10.0.8. FluentAssertions held at 6.12.2 (last MIT release); Microsoft.AspNetCore.TestHost net8 target held on the 8.0.x line. Bump version 0.9.36 -> 0.9.37 + CHANGELOG. Co-Authored-By: Claude Opus 4.7 --- CHANGELOG.md | 8 ++++ Source/Directory.Build.props | 2 +- Source/Directory.Packages.props | 48 +++++++++---------- .../DotNetWorkQueue.Transport.SQLite.csproj | 3 -- 4 files changed, 33 insertions(+), 28 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ee48b50d..2225cfce 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,11 @@ +### 0.9.37 — 2026-05-28 +- CVE fix: `OpenTelemetry` 1.15.2 → 1.15.3 — clears the transitive `OpenTelemetry.Api` advisory CVE-2026-40894 / GHSA-g94r-2vxg-569j (NU1902, moderate: excessive memory allocation when parsing OpenTelemetry propagation headers) +- Removed the now-obsolete `NU1902` from `Transport.SQLite.csproj` (added in 0.9.36 / ISSUE-032 solely to keep that advisory visible without failing the Release build) +- Dependency refresh across `Directory.Packages.props` — shipping: `Microsoft.Data.SqlClient` 7.0.1, `Npgsql` 10.0.3, `SimpleInjector` 5.5.2, `StackExchange.Redis` 2.13.17, `MudBlazor` 9.5.0, `CronExpressionDescriptor` 2.48.0, `Cronos` 0.13.0, `Microsoft.SourceLink.GitHub` 10.0.300, and `Microsoft.Extensions.Caching.Memory` / `Microsoft.Extensions.Configuration.Binder` / `Microsoft.Extensions.Http` / `System.Diagnostics.DiagnosticSource` / `System.Security.Cryptography.Xml` → 10.0.8 +- Test tooling: `coverlet.collector` 8.0.1 → 10.0.1 (2-major), `MSTest.TestAdapter` / `MSTest.TestFramework` 4.2.3, `Microsoft.NET.Test.Sdk` 18.6.0, `Microsoft.Testing.Extensions.Retry` 2.2.3, `bunit` 2.7.2, `Microsoft.Playwright` / `Microsoft.Playwright.MSTest` 1.60.0, `Microsoft.AspNetCore.TestHost` (net10) 10.0.8 +- `FluentAssertions` intentionally held at 6.12.2 (last MIT-licensed release); `Microsoft.AspNetCore.TestHost` net8 target held on the 8.0.x line +- No API surface changes + ### 0.9.36 — 2026-05-16 - Feature: transactional outbox pattern on SqlServer and PostgreSQL transports via opt-in `IRelationalProducerQueue` capability cast; the caller supplies a `DbTransaction` and the queue INSERT joins the caller's business transaction (GitHub #138) - Memory, Redis, LiteDb, and SQLite are unchanged; callers that don't reach for the new interface see the same `IProducerQueue` they always have diff --git a/Source/Directory.Build.props b/Source/Directory.Build.props index 99654271..07960a10 100644 --- a/Source/Directory.Build.props +++ b/Source/Directory.Build.props @@ -1,7 +1,7 @@ true - 0.9.36 + 0.9.37 true true portable diff --git a/Source/Directory.Packages.props b/Source/Directory.Packages.props index c8655a31..b4b87ce4 100644 --- a/Source/Directory.Packages.props +++ b/Source/Directory.Packages.props @@ -5,60 +5,60 @@ - + - - - - - + + + + + - + - + - - + + - + - + - + - + - - + + - - - - - - + + + + + + - + @@ -68,6 +68,6 @@ - + diff --git a/Source/DotNetWorkQueue.Transport.SQLite/DotNetWorkQueue.Transport.SQLite.csproj b/Source/DotNetWorkQueue.Transport.SQLite/DotNetWorkQueue.Transport.SQLite.csproj index 7790f3fe..7d64501a 100644 --- a/Source/DotNetWorkQueue.Transport.SQLite/DotNetWorkQueue.Transport.SQLite.csproj +++ b/Source/DotNetWorkQueue.Transport.SQLite/DotNetWorkQueue.Transport.SQLite.csproj @@ -29,7 +29,6 @@ https://github.com/blehnen/DotNetWorkQueue/blob/master/CHANGELOG.md true true - NU1902 @@ -37,14 +36,12 @@ https://github.com/blehnen/DotNetWorkQueue/blob/master/CHANGELOG.md true true - NU1902 true true - NU1902