Refs #8. Repurposes this Renovate-opened PR into the complete fix for both advisories (the original single-line NCalcSync → 6.1.1 bump would have failed CI — see below).
Added OpacityExpressionHelperTests — the migrated wiring had no coverage; the test drives the exact app path (new Expression → EvaluateFunction += → GetOpacity).
NCalc 6 transitively requires Microsoft.Extensions.Logging.Abstractions ≥ 10.0.7, so the centrally-pinned Microsoft.Extensions.* family is bumped 10.0.2 → 10.0.7 (otherwise restore fails NU1605; a .NET 10 servicing patch bump).
Deep-transitive via EF Core 9's Sqlite provider (…Sqlite 9.0.12 → bundle_e_sqlite3 2.1.10 → lib.e_sqlite3 2.1.10); Renovate's default config left it unaddressed.
Directly pin SQLitePCLRaw.bundle_e_sqlite3 3.0.3 in ErsatzTV.Infrastructure.Sqlite, overriding the transitive version with the patched native (lib.e_sqlite3 3.50.3). core 3.0.3 satisfies Microsoft.Data.Sqlite's ≥ 2.1.10, so it resolves cleanly under EF Core 9 (verified — see below).
Verification
dotnet list package --vulnerable --include-transitive → 0 vulnerable projects.
Restore + Release build clean (0/0).
Full test suite green in the CI environment (UTC). (2 pre-existing PlayoutModeSchedulerBase filler tests fail only under non-UTC local timezones — a DateTimeOffset boundary issue unrelated to these deps; verified they pass under TZ=UTC, matching main's green CI.)
SQLitePCLRaw 3.x runtime compat with EF Core 9 exercised by the Infrastructure/Core SQLite tests; the main image smoke test (app boots + opens its SQLite DB on linux-x64) is the final integration check on merge.
Supersedes the original Renovate proposal (NCalcSync → 6.1.1 only). After merge, Renovate sees NCalcSync satisfied. Related: dependency automation tracked in server-management#484.
Refs #8. Repurposes this Renovate-opened PR into the **complete** fix for both advisories (the original single-line `NCalcSync → 6.1.1` bump would have failed CI — see below).
## NCalcSync — GHSA-3w5p-95mh-gq75 / CVE-2026-55254 (factorial DoS, Medium)
- `NCalcSync 5.11.0 → 6.3.2` (clears `NCalc.Core` transitively too).
- NCalc 6 **split its assemblies and renamed the custom-function API**, so the bare bump doesn't compile. Ported `OpacityExpressionHelper`:
- `FunctionArgs` → `FunctionEventArgs`
- `args.Parameters[i].Evaluate()` → `args.Parameters.Evaluate(i)` (`FunctionData.Count` / `Evaluate(index)`)
- Added `OpacityExpressionHelperTests` — the migrated wiring had **no** coverage; the test drives the exact app path (`new Expression` → `EvaluateFunction +=` → `GetOpacity`).
- NCalc 6 transitively requires `Microsoft.Extensions.Logging.Abstractions ≥ 10.0.7`, so the centrally-pinned **`Microsoft.Extensions.*` family is bumped `10.0.2 → 10.0.7`** (otherwise restore fails **NU1605**; a .NET 10 servicing patch bump).
## SQLitePCLRaw — GHSA-2m69-gcr7-jv3q (outdated bundled SQLite, High)
- Deep-transitive via EF Core 9's Sqlite provider (`…Sqlite 9.0.12 → bundle_e_sqlite3 2.1.10 → lib.e_sqlite3 2.1.10`); Renovate's default config left it unaddressed.
- **Directly pin `SQLitePCLRaw.bundle_e_sqlite3 3.0.3`** in `ErsatzTV.Infrastructure.Sqlite`, overriding the transitive version with the patched native (`lib.e_sqlite3 3.50.3`). `core 3.0.3` satisfies `Microsoft.Data.Sqlite`'s `≥ 2.1.10`, so it resolves cleanly under EF Core 9 (verified — see below).
## Verification
- `dotnet list package --vulnerable --include-transitive` → **0 vulnerable projects**.
- Restore + Release build clean (0/0).
- Full test suite green **in the CI environment (UTC)**. (2 pre-existing `PlayoutModeSchedulerBase` filler tests fail only under non-UTC local timezones — a `DateTimeOffset` boundary issue unrelated to these deps; verified they pass under `TZ=UTC`, matching `main`'s green CI.)
- SQLitePCLRaw 3.x runtime compat with EF Core 9 exercised by the Infrastructure/Core SQLite tests; the `main` image smoke test (app boots + opens its SQLite DB on linux-x64) is the final integration check on merge.
---
<sub>Supersedes the original Renovate proposal (`NCalcSync → 6.1.1` only). After merge, Renovate sees NCalcSync satisfied. Related: dependency automation tracked in server-management#484.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Refs #8. Repurposes this Renovate-opened PR into the complete fix for both advisories (the original single-line
NCalcSync → 6.1.1bump would have failed CI — see below).NCalcSync — GHSA-3w5p-95mh-gq75 / CVE-2026-55254 (factorial DoS, Medium)
NCalcSync 5.11.0 → 6.3.2(clearsNCalc.Coretransitively too).OpacityExpressionHelper:FunctionArgs→FunctionEventArgsargs.Parameters[i].Evaluate()→args.Parameters.Evaluate(i)(FunctionData.Count/Evaluate(index))OpacityExpressionHelperTests— the migrated wiring had no coverage; the test drives the exact app path (new Expression→EvaluateFunction +=→GetOpacity).Microsoft.Extensions.Logging.Abstractions ≥ 10.0.7, so the centrally-pinnedMicrosoft.Extensions.*family is bumped10.0.2 → 10.0.7(otherwise restore fails NU1605; a .NET 10 servicing patch bump).SQLitePCLRaw — GHSA-2m69-gcr7-jv3q (outdated bundled SQLite, High)
…Sqlite 9.0.12 → bundle_e_sqlite3 2.1.10 → lib.e_sqlite3 2.1.10); Renovate's default config left it unaddressed.SQLitePCLRaw.bundle_e_sqlite3 3.0.3inErsatzTV.Infrastructure.Sqlite, overriding the transitive version with the patched native (lib.e_sqlite3 3.50.3).core 3.0.3satisfiesMicrosoft.Data.Sqlite's≥ 2.1.10, so it resolves cleanly under EF Core 9 (verified — see below).Verification
dotnet list package --vulnerable --include-transitive→ 0 vulnerable projects.PlayoutModeSchedulerBasefiller tests fail only under non-UTC local timezones — aDateTimeOffsetboundary issue unrelated to these deps; verified they pass underTZ=UTC, matchingmain's green CI.)mainimage smoke test (app boots + opens its SQLite DB on linux-x64) is the final integration check on merge.Supersedes the original Renovate proposal (
NCalcSync → 6.1.1only). After merge, Renovate sees NCalcSync satisfied. Related: dependency automation tracked in server-management#484.5d2cebacdato01647b6e50chore(deps): update dependency ncalcsync to v6 [security]to fix(deps): clear NCalcSync + SQLitePCLRaw vulnerability advisories (#8)