timothy/ersatztv
1
0
Fork 0
Code Issues 57 Pull Requests 6 Actions Packages Projects Releases 9 Wiki Activity

Update vulnerable transitive dependencies (NuGet audit advisories) #8

New Issue
Closed
opened 2026-06-26 22:22:22 +02:00 by timothy · 1 comment
timothy commented 2026-06-26 22:22:22 +02:00
Owner
Copy Link
Copy Source

Background

.NET 10's NuGet audit (on by default, NuGetAuditMode=all) flags vulnerable packages during dotnet restore. Because the app projects set TreatWarningsAsErrors=true, these advisories were failing the build outright. To unblock CI/CD (#4/#3), Directory.Build.props now demotes low/moderate/high audit advisories (NU1901/NU1902/NU1903) to warnings; NU1904 (critical) still fails the build.

This issue tracks actually resolving the advisories rather than suppressing them.

Current advisories (from CI restore logs)

Package Version Severity Advisory
NCalcSync 5.11.0 Moderate GHSA-3w5p-95mh-gq75
SQLitePCLRaw.lib.e_sqlite3 2.1.10 High GHSA-2m69-gcr7-jv3q

Tasks

  • Identify whether each is a direct or transitive dependency (and via which package)
  • Bump to patched versions where available (may require updating the parent package, e.g. the EF Core SQLite provider for SQLitePCLRaw)
  • Re-run dotnet restore/build and confirm the advisories clear
  • Once clear, consider removing the NU1901-1903 exemption from Directory.Build.props (or tightening it) so future advisories surface again

Priority

Backlog — the exemption keeps builds green; criticals still block. Revisit after the CI/CD pipeline lands.

## Background .NET 10's NuGet audit (on by default, `NuGetAuditMode=all`) flags vulnerable packages during `dotnet restore`. Because the app projects set `TreatWarningsAsErrors=true`, these advisories were failing the build outright. To unblock CI/CD (#4/#3), `Directory.Build.props` now demotes low/moderate/high audit advisories (NU1901/NU1902/NU1903) to warnings; **NU1904 (critical) still fails the build**. This issue tracks actually resolving the advisories rather than suppressing them. ## Current advisories (from CI restore logs) | Package | Version | Severity | Advisory | |---|---|---|---| | `NCalcSync` | 5.11.0 | Moderate | GHSA-3w5p-95mh-gq75 | | `SQLitePCLRaw.lib.e_sqlite3` | 2.1.10 | High | GHSA-2m69-gcr7-jv3q | ## Tasks - [ ] Identify whether each is a direct or transitive dependency (and via which package) - [ ] Bump to patched versions where available (may require updating the parent package, e.g. the EF Core SQLite provider for SQLitePCLRaw) - [ ] Re-run `dotnet restore`/build and confirm the advisories clear - [ ] Once clear, consider removing the NU1901-1903 exemption from `Directory.Build.props` (or tightening it) so future advisories surface again ## Priority Backlog — the exemption keeps builds green; criticals still block. Revisit after the CI/CD pipeline lands.
timothy commented 2026-06-27 02:18:27 +02:00
Author
Owner
Copy Link
Copy Source

Done — closing

Both advisories cleared; dotnet list package --vulnerable --include-transitive reports 0 vulnerable projects. Landed via PR #20 (merged to main, full pipeline green incl. the image smoke test) + a docs follow-up.

What was done

  1. NCalcSync (GHSA-3w5p-95mh-gq75 / CVE-2026-55254, factorial DoS): direct dep of ErsatzTV.Core, bumped 5.11.0 → 6.3.2 (clears transitive NCalc.Core too). NCalc 6 split its assemblies and renamed the custom-function API, so I ported OpacityExpressionHelper (FunctionArgs→FunctionEventArgs; args.Parameters[i].Evaluate()→args.Parameters.Evaluate(i) via FunctionData.Count/Evaluate(index)) and added OpacityExpressionHelperTests — that custom-function path had no coverage.
  2. NCalc 6 transitive floor: it requires Microsoft.Extensions.Logging.Abstractions ≥ 10.0.7, so the centrally-pinned Microsoft.Extensions.* family was bumped 10.0.2 → 10.0.7 (otherwise restore fails NU1605; a .NET 10 servicing patch bump).
  3. SQLitePCLRaw (GHSA-2m69-gcr7-jv3q, outdated bundled SQLite, High): purely transitive via Microsoft.EntityFrameworkCore.Sqlite 9.0.12 → bundle_e_sqlite3 2.1.10. Patched only in the 3.x line (OSV: last_affected 2.1.11). Directly pinned SQLitePCLRaw.bundle_e_sqlite3 3.0.3 in ErsatzTV.Infrastructure.Sqlite to override the transitive version with the patched native (lib.e_sqlite3 3.50.3); core 3.0.3 satisfies Microsoft.Data.Sqlite's ≥ 2.1.10. Runtime compat with EF Core 9 confirmed by the SQLite tests and the main image smoke test (app boots + opens its SQLite DB on linux-x64).

Direct vs transitive (task 1): NCalcSync = direct (Core); NCalc.Core = transitive of NCalcSync; SQLitePCLRaw = transitive via the EF Core Sqlite provider.

NU1901-1903 exemption (task 4): considered removing/tightening — kept as-is by design. NU1904 (critical) still hard-blocks; demoting low/moderate/high keeps a new transitive advisory from breaking unrelated PRs, and they're now surfaced by the weekly dependency-scan.yml + Renovate security PRs (e.g. this issue's own Renovate PR). Documented in docs/ci-cd.md.

Files changed: Directory.Packages.props, ErsatzTV.Infrastructure.Sqlite.csproj, ErsatzTV.Infrastructure/Streaming/Graphics/OpacityExpressionHelper.cs, ErsatzTV.Infrastructure.Tests/Streaming/Graphics/OpacityExpressionHelperTests.cs (new), docs/ci-cd.md.

Note on the Renovate PR: #20 was originally a bare NCalcSync → 6.1.1 bump — it failed CI (run #140) on both the NU1605 downgrade and the NCalc 6 API compile errors, and didn't touch SQLitePCLRaw. I repurposed #20 with the complete fix rather than open a duplicate.

Test note: 2 PlayoutModeSchedulerBase filler tests fail only under non-UTC local timezones (a pre-existing DateTimeOffset boundary issue, unrelated to these deps — they pass under TZ=UTC, matching CI). Not introduced here; could be hardened separately if worth a follow-up.

## Done — closing Both advisories cleared; `dotnet list package --vulnerable --include-transitive` reports **0 vulnerable projects**. Landed via PR #20 (merged to `main`, full pipeline green incl. the image smoke test) + a docs follow-up. **What was done** 1. **NCalcSync** (GHSA-3w5p-95mh-gq75 / CVE-2026-55254, factorial DoS): direct dep of `ErsatzTV.Core`, bumped `5.11.0 → 6.3.2` (clears transitive `NCalc.Core` too). NCalc 6 split its assemblies and renamed the custom-function API, so I ported `OpacityExpressionHelper` (`FunctionArgs`→`FunctionEventArgs`; `args.Parameters[i].Evaluate()`→`args.Parameters.Evaluate(i)` via `FunctionData.Count`/`Evaluate(index)`) and **added `OpacityExpressionHelperTests`** — that custom-function path had no coverage. 2. **NCalc 6 transitive floor**: it requires `Microsoft.Extensions.Logging.Abstractions ≥ 10.0.7`, so the centrally-pinned `Microsoft.Extensions.*` family was bumped `10.0.2 → 10.0.7` (otherwise restore fails `NU1605`; a .NET 10 servicing patch bump). 3. **SQLitePCLRaw** (GHSA-2m69-gcr7-jv3q, outdated bundled SQLite, High): purely transitive via `Microsoft.EntityFrameworkCore.Sqlite 9.0.12 → bundle_e_sqlite3 2.1.10`. Patched only in the 3.x line (OSV: `last_affected 2.1.11`). **Directly pinned `SQLitePCLRaw.bundle_e_sqlite3 3.0.3`** in `ErsatzTV.Infrastructure.Sqlite` to override the transitive version with the patched native (`lib.e_sqlite3 3.50.3`); `core 3.0.3` satisfies `Microsoft.Data.Sqlite`'s `≥ 2.1.10`. Runtime compat with EF Core 9 confirmed by the SQLite tests **and the `main` image smoke test** (app boots + opens its SQLite DB on linux-x64). **Direct vs transitive (task 1):** NCalcSync = direct (Core); NCalc.Core = transitive of NCalcSync; SQLitePCLRaw = transitive via the EF Core Sqlite provider. **NU1901-1903 exemption (task 4):** considered removing/tightening — **kept as-is by design.** NU1904 (critical) still hard-blocks; demoting low/moderate/high keeps a new transitive advisory from breaking unrelated PRs, and they're now surfaced by the weekly `dependency-scan.yml` + Renovate security PRs (e.g. this issue's own Renovate PR). Documented in `docs/ci-cd.md`. **Files changed:** `Directory.Packages.props`, `ErsatzTV.Infrastructure.Sqlite.csproj`, `ErsatzTV.Infrastructure/Streaming/Graphics/OpacityExpressionHelper.cs`, `ErsatzTV.Infrastructure.Tests/Streaming/Graphics/OpacityExpressionHelperTests.cs` (new), `docs/ci-cd.md`. **Note on the Renovate PR:** #20 was originally a bare `NCalcSync → 6.1.1` bump — it **failed CI** (run #140) on both the NU1605 downgrade and the NCalc 6 API compile errors, and didn't touch SQLitePCLRaw. I repurposed #20 with the complete fix rather than open a duplicate. **Test note:** 2 `PlayoutModeSchedulerBase` filler tests fail only under non-UTC local timezones (a pre-existing `DateTimeOffset` boundary issue, unrelated to these deps — they pass under `TZ=UTC`, matching CI). Not introduced here; could be hardened separately if worth a follow-up.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
ad-hoc
One-off / ad-hoc work not tracked by a dedicated issue
 api
REST API / HTTP endpoints
 bug
Something isn't working
 ci-cd
Build, test, deploy pipeline
 content
Channel content / schedules / playlists
 dependencies
Dependency updates (Renovate)
 enhancement
New feature or improvement
 frontend
ChicoryTV React SPA frontend
 in-progress
Claimed by an active session — do not pick up
 jellyfin
Jellyfin tuner / IPTV integration
 parked
Excluded from automatic queue pickup; work only when explicitly selected
 priority: high
priority: low
priority: medium
review
Adversarial review finding
 security
Security / vulnerability fix
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
renovate timothy (Timothy)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: timothy/ersatztv#8