timothyandClaude Opus 4.8
01647b6e50
Build ErsatzTV Image / Build & test (.NET) (pull_request) Successful in 2m17s
Build ErsatzTV Image / Build & push image (amd64) (pull_request) Has been skipped
Build ErsatzTV Image / Build & test (.NET) (push) Successful in 2m38s
Build ErsatzTV Image / Build & push image (amd64) (push) Successful in 5m41s
NCalcSync 5.11.0 -> 6.3.2 clears CVE-2026-55254 / GHSA-3w5p-95mh-gq75 (the factorial-DoS advisory on NCalc.Core/NCalcSync). NCalc 6 split its assemblies and renamed the custom-function API, so port OpacityExpressionHelper: FunctionArgs -> FunctionEventArgs, and args.Parameters[i].Evaluate() -> args.Parameters.Evaluate(i) (FunctionData.Count / Evaluate(index)). Add a regression test covering the migrated opacity wiring (the feature had no tests). NCalc 6 transitively requires Microsoft.Extensions.Logging.Abstractions >= 10.0.7, so bump the centrally-pinned Microsoft.Extensions.* family 10.0.2 -> 10.0.7 to avoid the NU1605 downgrade error (a .NET 10 servicing patch bump). SQLitePCLRaw: EF Core 9's Sqlite provider pulls the vulnerable bundle 2.1.10 (GHSA-2m69-gcr7-jv3q, outdated bundled SQLite). Directly pin SQLitePCLRaw.bundle_e_sqlite3 3.0.3 in Infrastructure.Sqlite to override the transitive version with the patched native (lib.e_sqlite3 3.50.3); core 3.0.3 satisfies Microsoft.Data.Sqlite's >= 2.1.10 requirement under EF Core 9. Verified: `dotnet list package --vulnerable --include-transitive` reports 0 vulnerable projects; restore + Release build clean; full test suite green under UTC. (2 pre-existing PlayoutModeSchedulerBase filler tests fail only under non-UTC local timezones, unrelated to these deps; they pass in CI.) Refs #8 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>