fix(deps): clear NCalcSync + SQLitePCLRaw vulnerability advisories (#8) #20

Merged
timothy merged 1 commits from renovate/nuget-ncalcsync-vulnerability into main 2026-06-27 02:07:49 +02:00
4 changed files with 83 additions and 24 deletions
+16 -12
View File
@@ -44,24 +44,24 @@
<PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="[9.0.12,10)" />
<PackageVersion Include="Microsoft.EntityFrameworkCore.Relational" Version="[9.0.12,10)" />
<PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="[9.0.12,10)" />
<PackageVersion Include="Microsoft.Extensions.ApiDescription.Server" Version="10.0.2" />
<PackageVersion Include="Microsoft.Extensions.Caching.Abstractions" Version="10.0.2" />
<PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="10.0.2" />
<PackageVersion Include="Microsoft.Extensions.Configuration" Version="10.0.2" />
<PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.2" />
<PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.2" />
<PackageVersion Include="Microsoft.Extensions.ApiDescription.Server" Version="10.0.7" />
<PackageVersion Include="Microsoft.Extensions.Caching.Abstractions" Version="10.0.7" />
<PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="10.0.7" />
<PackageVersion Include="Microsoft.Extensions.Configuration" Version="10.0.7" />
<PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.7" />
<PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.7" />
<PackageVersion Include="Microsoft.Extensions.DependencyModel" Version="[8.0.2]" />
<PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.2" />
<PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.2" />
<PackageVersion Include="Microsoft.Extensions.Logging" Version="10.0.2" />
<PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.2" />
<PackageVersion Include="Microsoft.Extensions.Logging.Debug" Version="10.0.2" />
<PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.7" />
<PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.7" />
<PackageVersion Include="Microsoft.Extensions.Logging" Version="10.0.7" />
<PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.7" />
<PackageVersion Include="Microsoft.Extensions.Logging.Debug" Version="10.0.7" />
<PackageVersion Include="Microsoft.IO.RecyclableMemoryStream" Version="3.0.1" />
<PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.0.1" />
<PackageVersion Include="Microsoft.VisualStudio.Threading.Analyzers" Version="17.14.15" />
<PackageVersion Include="MudBlazor" Version="8.15.0" />
<PackageVersion Include="NaturalSort.Extension" Version="4.4.1" />
<PackageVersion Include="NCalcSync" Version="5.11.0" />
<PackageVersion Include="NCalcSync" Version="6.3.2" />
<PackageVersion Include="Newtonsoft.Json" Version="13.0.4" />
<PackageVersion Include="Newtonsoft.Json.Schema" Version="4.0.1" />
<PackageVersion Include="NSubstitute" Version="5.3.0" />
@@ -90,6 +90,10 @@
<PackageVersion Include="SixLabors.ImageSharp" Version="3.1.12" />
<PackageVersion Include="SkiaSharp" Version="3.119.1" />
<PackageVersion Include="SkiaSharp.NativeAssets.Linux.NoDependencies" Version="3.119.1" />
<!-- Direct pin to override EF Core 9's transitive SQLitePCLRaw 2.1.10 (vulnerable
bundled SQLite, GHSA-2m69-gcr7-jv3q). The 3.x line ships the patched native
(lib.e_sqlite3 3.50.3); core 3.0.3 satisfies Microsoft.Data.Sqlite's `>= 2.1.10`. (#8) -->
<PackageVersion Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.3" />
<PackageVersion Include="System.CommandLine" Version="2.0.2" />
<PackageVersion Include="TagLibSharp" Version="2.3.0" />
<PackageVersion Include="Testably.Abstractions" Version="10.0.0" />
@@ -16,6 +16,9 @@
<PackageReference Include="EFCore.BulkExtensions.Sqlite" />
<PackageReference Include="Microsoft.EntityFrameworkCore.Relational" />
<PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" />
<!-- Override EF Core's transitive SQLitePCLRaw 2.1.10 (vulnerable SQLite,
GHSA-2m69-gcr7-jv3q) with the patched 3.x bundle. Version is central (#8). -->
<PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" />
</ItemGroup>
@@ -0,0 +1,52 @@
using ErsatzTV.Infrastructure.Streaming.Graphics;
using NCalc;
using NUnit.Framework;
using Shouldly;
namespace ErsatzTV.Infrastructure.Tests.Streaming.Graphics;
[TestFixture]
public class OpacityExpressionHelperTests
{
// Exercises the NCalc custom-function wiring (FunctionEventArgs / FunctionData under NCalc 6.x)
// exactly the way the graphics elements do: build an Expression, hook EvaluateFunction, evaluate.
private static float Evaluate(string expressionString, TimeSpan timeOfDay)
{
var expression = new Expression(expressionString);
expression.EvaluateFunction += OpacityExpressionHelper.EvaluateFunction;
return OpacityExpressionHelper.GetOpacity(
expression,
timeOfDay,
TimeSpan.Zero,
TimeSpan.Zero,
TimeSpan.Zero);
}
// LinearFadePoints(time, start=0, peakStart=10, peakEnd=20, end=30)
[TestCase(5, 0.5)] // fade in: (5-0)/(10-0)
[TestCase(15, 1.0)] // solid
[TestCase(25, 0.5)] // fade out: (30-25)/(30-20)
[TestCase(35, 0.0)] // past end
public void LinearFadePoints_ReturnsExpectedOpacity(int timeOfDaySeconds, double expected)
{
float opacity = Evaluate(
"LinearFadePoints(time_of_day_seconds, 0, 10, 20, 30)",
TimeSpan.FromSeconds(timeOfDaySeconds));
opacity.ShouldBe((float)expected, 0.0001);
}
// LinearFadeDuration(time, start=0, fadeSeconds=10, peakSeconds=10)
// -> peakStart=10, peakEnd=20, end=30 (same curve as the LinearFadePoints case above)
[TestCase(5, 0.5)] // mid fade in
[TestCase(15, 1.0)] // solid
[TestCase(25, 0.5)] // mid fade out
public void LinearFadeDuration_ReturnsExpectedOpacity(int timeOfDaySeconds, double expected)
{
float opacity = Evaluate(
"LinearFadeDuration(time_of_day_seconds, 0, 10, 10)",
TimeSpan.FromSeconds(timeOfDaySeconds));
opacity.ShouldBe((float)expected, 0.0001);
}
}
@@ -6,37 +6,37 @@ namespace ErsatzTV.Infrastructure.Streaming.Graphics;
public static class OpacityExpressionHelper
{
public static void EvaluateFunction(string name, FunctionArgs args)
public static void EvaluateFunction(string name, FunctionEventArgs args)
{
switch (name)
{
case "LinearFadePoints":
{
if (args.Parameters.Length != 5)
if (args.Parameters.Count != 5)
{
throw new ArgumentException("LinearFadePoints() requires 5 arguments.");
}
var time = Convert.ToDouble(args.Parameters[0].Evaluate(), CultureInfo.CurrentCulture);
var start = Convert.ToDouble(args.Parameters[1].Evaluate(), CultureInfo.CurrentCulture);
var peakStart = Convert.ToDouble(args.Parameters[2].Evaluate(), CultureInfo.CurrentCulture);
var peakEnd = Convert.ToDouble(args.Parameters[3].Evaluate(), CultureInfo.CurrentCulture);
var end = Convert.ToDouble(args.Parameters[4].Evaluate(), CultureInfo.CurrentCulture);
var time = Convert.ToDouble(args.Parameters.Evaluate(0), CultureInfo.CurrentCulture);
var start = Convert.ToDouble(args.Parameters.Evaluate(1), CultureInfo.CurrentCulture);
var peakStart = Convert.ToDouble(args.Parameters.Evaluate(2), CultureInfo.CurrentCulture);
var peakEnd = Convert.ToDouble(args.Parameters.Evaluate(3), CultureInfo.CurrentCulture);
var end = Convert.ToDouble(args.Parameters.Evaluate(4), CultureInfo.CurrentCulture);
args.Result = LinearFadePoints(time, start, peakStart, peakEnd, end);
break;
}
case "LinearFadeDuration":
{
if (args.Parameters.Length != 4)
if (args.Parameters.Count != 4)
{
throw new ArgumentException("LinearFadeDuration() requires 4 arguments.");
}
var time = Convert.ToDouble(args.Parameters[0].Evaluate(), CultureInfo.CurrentCulture);
var start = Convert.ToDouble(args.Parameters[1].Evaluate(), CultureInfo.CurrentCulture);
var fadeSeconds = Convert.ToDouble(args.Parameters[2].Evaluate(), CultureInfo.CurrentCulture);
var peakSeconds = Convert.ToDouble(args.Parameters[3].Evaluate(), CultureInfo.CurrentCulture);
var time = Convert.ToDouble(args.Parameters.Evaluate(0), CultureInfo.CurrentCulture);
var start = Convert.ToDouble(args.Parameters.Evaluate(1), CultureInfo.CurrentCulture);
var fadeSeconds = Convert.ToDouble(args.Parameters.Evaluate(2), CultureInfo.CurrentCulture);
var peakSeconds = Convert.ToDouble(args.Parameters.Evaluate(3), CultureInfo.CurrentCulture);
args.Result = LinearFadeDuration(time, start, fadeSeconds, peakSeconds);
break;