Skip to content

fix: remove Scriban 6.2.0 NuGet audit suppressions - #403

Draft
dnyw4l3n13 wants to merge 2 commits into
mainfrom
fix/352-remove-scriban-audit-suppression
Draft

fix: remove Scriban 6.2.0 NuGet audit suppressions#403
dnyw4l3n13 wants to merge 2 commits into
mainfrom
fix/352-remove-scriban-audit-suppression

Conversation

@dnyw4l3n13

@dnyw4l3n13 dnyw4l3n13 commented Sep 3, 2026

Copy link
Copy Markdown
Collaborator

Description

Removes the NuGetAuditSuppress entries for Scriban 6.2.0 advisories in BuildBot/BuildBot.csproj and BuildBot.Discord/BuildBot.Discord.csproj. Mediator.SourceGenerator was bumped to 3.0.2 (already on main), whose nuspec no longer depends on Scriban, so the transitive dependency that triggered NU1902/NU1903 is gone.

Also includes a separate commit fixing 46 pre-existing FunFair.BuildCheck MustHaveIncludeAssetsOnPackageReference failures found while running the mandatory pre-work buildcheck (unrelated to Scriban, but blocking the commit gate).

Closes #352

How Has This Been Tested

  • All unit tests pass.
  • All integration tests pass.
  • Manual Testing: dotnet buildcheck -Solution BuildBot.slnx (no errors), dotnet build BuildBot.sln (0 warnings/errors), all 8 test projects run individually (242 tests passed, 0 failed). Note: dotnet test BuildBot.sln at the solution level reports "Zero tests ran" for every project on this repo - a pre-existing Microsoft.Testing.Platform/solution quirk confirmed identical on main, unrelated to this change.

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • Removed no-longer used code

Deployment Configuration Changes

  • Requires deployment configuration changes as specified below and in CHANGELOG.md

Checklist

  • I have added tests to cover my changes.
  • Unreleased section of CHANGELOG.md has been updated with details of this PR.
  • No user-controlled or step-output value is string-interpolated directly into a run:/script: body (workflow or composite action); pass it via step-level env: and reference $VAR (bash) or process.env.VAR (github-script) instead.

https://claude.ai/code/session_01MbBmudQ42gXgD9n3xVTYsJ

FunFair.BuildCheck's MustHaveIncludeAssetsOnPackageReference policy
requires every direct PackageReference to declare IncludeAssets.
Pre-existing on main; found while running the mandatory pre-work
buildcheck as part of #352.

Claude-Session: https://claude.ai/code/session_01MbBmudQ42gXgD9n3xVTYsJ
Mediator.SourceGenerator was bumped to 3.0.2, whose nuspec no longer
depends on Scriban, so the transitive dependency that triggered the
NU1902/NU1903 audit warnings is gone. Verified with a clean restore
and build: 0 warnings/errors, and Scriban does not appear in any
project's restored project.assets.json.

Closes #352

Claude-Session: https://claude.ai/code/session_01MbBmudQ42gXgD9n3xVTYsJ
@dnyw4l3n13 dnyw4l3n13 added the auto-pr Pull request created automatically label Sep 3, 2026
@credfeto

credfeto commented Sep 3, 2026

Copy link
Copy Markdown
Member

Roslyn analyzer findings

Source Rule Level File Line Suppressed Message
DotNet IL2026 error src/BuildBot/Helpers/Endpoints.CloudFormation.cs 26 yes Using member 'Microsoft.AspNetCore.Builder.EndpointRouteBuilderExtensions.MapPost(IEndpointRouteBuilder, String, Delegate)' which has 'RequiresUnreferencedCodeAttribute' can break functionality when trimming application code. This API may perform reflection on the supplied delegate and its parameters. These types may be trimmed if not directly referenced.
DotNet IL2026 error src/BuildBot/Helpers/Endpoints.Test.cs 22 yes Using member 'Microsoft.AspNetCore.Builder.EndpointRouteBuilderExtensions.MapGet(IEndpointRouteBuilder, String, Delegate)' which has 'RequiresUnreferencedCodeAttribute' can break functionality when trimming application code. This API may perform reflection on the supplied delegate and its parameters. These types may be trimmed if not directly referenced.
DotNet IL2026 error src/BuildBot/Helpers/Endpoints.Watchtower.cs 19 yes Using member 'Microsoft.AspNetCore.Builder.EndpointRouteBuilderExtensions.MapPost(IEndpointRouteBuilder, String, Delegate)' which has 'RequiresUnreferencedCodeAttribute' can break functionality when trimming application code. This API may perform reflection on the supplied delegate and its parameters. These types may be trimmed if not directly referenced.
DotNet IL2026 error src/BuildBot/Helpers/Endpoints.GitHub.cs 19 yes Using member 'Microsoft.AspNetCore.Builder.EndpointRouteBuilderExtensions.MapPost(IEndpointRouteBuilder, String, Delegate)' which has 'RequiresUnreferencedCodeAttribute' can break functionality when trimming application code. This API may perform reflection on the supplied delegate and its parameters. These types may be trimmed if not directly referenced.
DotNet IL2026 error src/BuildBot/Helpers/Endpoints.GitHub.cs 29 yes Using member 'Microsoft.AspNetCore.Builder.EndpointRouteBuilderExtensions.MapPost(IEndpointRouteBuilder, String, Delegate)' which has 'RequiresUnreferencedCodeAttribute' can break functionality when trimming application code. This API may perform reflection on the supplied delegate and its parameters. These types may be trimmed if not directly referenced.
DotNet IL2026 error src/BuildBot/Helpers/Endpoints.GitHub.cs 39 yes Using member 'Microsoft.AspNetCore.Builder.EndpointRouteBuilderExtensions.MapPost(IEndpointRouteBuilder, String, Delegate)' which has 'RequiresUnreferencedCodeAttribute' can break functionality when trimming application code. This API may perform reflection on the supplied delegate and its parameters. These types may be trimmed if not directly referenced.
DotNet CA2000 error src/BuildBot/Helpers/ServerStartup.cs 127 yes Call System.IDisposable.Dispose on object created by 'CreateLogger()' before all references to it are out of scope
DotNet IL2026 error src/BuildBot/obj/Release/net10.0/Microsoft.AspNetCore.Http.RequestDelegateGenerator/Microsoft.AspNetCore.Http.RequestDelegateGenerator.RequestDelegateGenerator/GeneratedRouteBuilderExtensions.g.cs 1014 yes Using member 'Microsoft.AspNetCore.Http.HttpResponseJsonExtensions.WriteAsJsonAsync(HttpResponse, TValue, JsonSerializerOptions, CancellationToken)' which has 'RequiresUnreferencedCodeAttribute' can break functionality when trimming application code. JSON serialization and deserialization might require types that cannot be statically analyzed. Use the overload that takes a JsonTypeInfo or JsonSerializerContext, or make sure all of the required types are preserved.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

auto-pr Pull request created automatically

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Security: Upgrade Scriban from 6.2.0 to address known vulnerabilities

2 participants