Upgrade SIL.ReleaseTasks and System.ServiceModel dependencies; replace net461 with net462 - #161
Conversation
imnasnainaec
left a comment
imnasnainaec
left a comment
There was a problem hiding this comment.
@imnasnainaec reviewed 15 files and all commit messages.
Reviewable status:complete! all files reviewed, all discussions resolved (waiting on tombogle).
imnasnainaec
left a comment
imnasnainaec
left a comment
There was a problem hiding this comment.
@imnasnainaec reviewed 8 files and all commit messages, and made 1 comment.
Reviewable status:
src/L10NSharp.Windows.Forms/Service References/BingTranslatorService/Reference.cs line 51 at r2 (raw file):
// exactly as it did before. If you regenerate this file, reapply this guard, or — better — // finish the replacement of BingTranslator/this proxy with a plain REST client (see // https://github.com/sillsdev/l10nsharp/issues/163), which removes this file entirely.
Oh, that's awkward.
…encies; replace net461 with net462 Upgrades SIL.ReleaseTasks (2.5.0 -> 3.2.1) and System.ServiceModel.Http/Primitives (6.2.0 -> 8.1.2) to remove vulnerable transitive dependencies. BREAKING CHANGE: The SIL.ReleaseTasks upgrade transitively raises the resolved version of System.Resources.Extensions, which no longer ships a net461-specific assembly, so net461 is no longer a supported or tested target framework. Replaced net461 with net462 across all projects. Also fixes API incompatibilities in the internal BingTranslator/generated WCF proxy surfaced by the System.ServiceModel upgrade. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…o a patched version Bumps GitVersion.MsBuild, Microsoft.SourceLink.GitHub, JetBrains.Annotations, SIL.ReleaseTasks (3.2.1 -> 3.3.0), and the NUnit/Test SDK packages. All of these are PrivateAssets="all" build/test-only dependencies with no effect on consumers. Also adds a direct System.Security.Cryptography.Xml 8.0.4 reference to L10NSharp.Windows.Forms: System.ServiceModel.Primitives 8.1.2 otherwise resolves a vulnerable 8.0.2 of that package transitively on net8.0-windows, and a direct PackageReference overrides it. No public API or supported-framework changes. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…asks CHANGELOG note Adds a comment to the generated BingTranslatorService/Reference.cs warning that its hand-added #if NETFRAMEWORK guard will be silently dropped if the WCF proxy is regenerated, reintroducing the net8.0-windows build break it fixes. Points to issue #163 as the real long-term fix (removing this generated proxy entirely). Also corrects the CHANGELOG's SIL.ReleaseTasks security note: 3.3.0 does not cleanly remove a vulnerable dependency as previously stated. It reintroduces a build-time-only, non-exploitable dependency on a vulnerable Newtonsoft.Json via a temporary SIL.Core revert (see sillsdev/SIL.BuildTasks#88). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
7236466 to
6d5ee69
Compare
imnasnainaec
left a comment
imnasnainaec
left a comment
There was a problem hiding this comment.
@imnasnainaec reviewed 1 file and all commit messages.
Reviewable status:
tombogle
left a comment
tombogle
left a comment
There was a problem hiding this comment.
@tombogle made 1 comment.
Reviewable status:
src/L10NSharp.Windows.Forms/Service References/BingTranslatorService/Reference.cs line 51 at r2 (raw file):
Previously, imnasnainaec (D. Ror.) wrote…
Oh, that's awkward.
True, but in a day or two this code should be gone.
2 participants
Summary
SIL.ReleaseTasks(2.5.0 → 3.2.1) andSystem.ServiceModel.Http/System.ServiceModel.Primitives(6.2.0 → 8.1.2) to remove vulnerable transitive dependencies.net461target framework withnet462across all projects. TheSIL.ReleaseTasksupgrade transitively raises the resolved version ofSystem.Resources.Extensions, which no longer ships anet461-specific assembly, sonet461is no longer a supported or tested target. Consumers who neednet461should stay on the last release built for it, or upgrade to at leastnet462.BingTranslator/generated WCF proxy code surfaced by theSystem.ServiceModelupgrade (removed properties no longer present in the modern package, and config-name-basedClientBaseconstructors now scoped toNETFRAMEWORKbuilds only).CHANGELOG.mdfor full details.Test plan
dotnet build L10NSharp.slnsucceeds with 0 errors/warnings related to these changes across all target frameworks (net462,net48,net8.0,net8.0-windows,netstandard2.0)SampleApp.exelaunches successfully fornet462,net48, andnet8.0-windows🤖 Generated with Claude Code
This change is