Repository navigation
build: Bump cyclonedx from 6.2.0 to 6.3.1 - #75
Closed
dependabot[bot] wants to merge 1 commit into
Closed
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
--- updated-dependencies: - dependency-name: cyclonedx dependency-version: 6.3.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
.NET
4 tasks done
codegiveness
added a commit
that referenced
this pull request
Oct 22, 2026
… (0.7.1) (#78) ## Problem Prepares **0.7.1**, a patch release requested by the maintainer after reviewing the October 2026 GitHub Actions supply-chain news (GhostAction waves of 2026-10-07..12, the re-enabled Mini Shai-Hulud `actions-cool` actions of 2026-09-16, and the TeamPCP/Trivy compromise of March 2026). - The shipped npm platform packages and self-contained archives bundle .NET runtime 10.0.12. Microsoft's 10.0.13 (2026-10-13) is a security release. - Six Dependabot PRs (#72–#77) each cover one piece. Two of them would fail locked restore on their own: #73 (SDK) and #76 (SourceLink) need regenerated lock files. Several other pins are also behind and are not tracked by Dependabot: NuGet packages, transitive pins, Trivy, npm/Node in the release job, and the PostgreSQL fixture images. ## Behavior change None for users. Tool names, parameters, environment variables, CLI flags, the targets-file format and database-access behavior are unchanged. Only these change: - The version moves to 0.7.1 in the csproj and in `npm/package.json` (main package plus five platform `optionalDependencies`). README, CONTRIBUTING and the bug template follow. - **Runtime:** SDK 10.0.401 → 10.0.402, so the bundled runtime moves 10.0.12 → **10.0.13**. The container `sdk:10.0`/`runtime:10.0` digests are re-pinned to the current MCR manifest lists. These are newer than #72/#74. - **NuGet:** - ModelContextProtocol 2.2.0 → 2.3.0 - Microsoft.Extensions.* 10.0.12 → 10.0.13 - Microsoft.Extensions.AI.Abstractions 10.10.1 → 10.11.0 - Microsoft.SourceLink.GitHub 10.0.401 → 10.0.402 - Verifier/fuzz only: FsCheck 3.4.0 → 3.6.0, plus new central transitive pins FSharp.Core 5.0.2 → 11.0.100 and dnlib 4.4.0 → 4.5.0 - CycloneDX tool 6.2.0 → 6.3.1 - All 28 lock files were checked. The changed ones were regenerated per CONTRIBUTING: portable, plus explicit `-p:RuntimeIdentifier`/`RuntimeIdentifiers` for each of the five RIDs. - **Workflows:** - `github/codeql-action` v4.38.3 → v4.39.1 (CodeQL bundle 2.27.3) - `ossf/scorecard-action` v2.4.4 → v2.5.0 - Trivy 0.75.0 → 0.76.1 - Release npm job: Node 24.21.0 → 24.22.1 (Node security release of 2026-10-20) and npm 12.2.1 (exact tarball + SHA-512 integrity) - The Trivy gate now uses `$RUNNER_TEMP` instead of `${{ runner.temp }}` inside `run:` (zizmor template-injection finding). - **Verifier fixtures:** PostgreSQL 14–18 digests are refreshed (same minors, rebuilt base). PostgreSQL 19 moves from `19beta4-bookworm` to `19rc1-bookworm`. HypoPG `1.4.3-1.pgdg12+2` is still published for 13–19. Supersedes #72, #73, #74, #75, #76 and #77. Dependabot closes them once `main` contains the updates. ## Compatibility and security impact - **Action pins.** Each new SHA was resolved from the upstream tag via the GitHub API, dereferencing annotated tags: - `github/codeql-action` v4.39.1 → `9b3254085494b55a0f7c4c2b3d2d52cc712ce370` - `ossf/scorecard-action` v2.5.0 → `fa7117db83c52d787ae5a89f350999701505d78e` (same as #77) - Every existing pin was re-resolved and still matches its tag. - **Permissions and triggers.** No permission, trigger, environment or secret usage changes. - **Downloaded tools.** Trivy's SHA-256 comes from `trivy_0.76.1_checksums.txt`. npm's SHA-512 equals the registry `dist.integrity`, and a local download matched it. - **Review against the news, with no compromise indicators found:** - Only the eight known workflow files (plus Dependabot) have ever run. Every run's actor is `codegiveness` or `dependabot[bot]`. - No `security-audit.yml`/`github_actions_security.yml` exists on any branch. - No `actions-cool` action is used. - No committed `.claude/`, `.vscode/` or other editor/agent hook files. - No deploy keys or webhooks. One collaborator. - No open Dependabot, secret-scanning or repository advisories. The open code-scanning alerts are the three Scorecard practice checks. - **Repository settings already match the published mitigations:** - Only GitHub-owned actions plus `ossf/scorecard-action` and `NuGet/login` are allowed. - Full-SHA pinning is required. - The default `GITHUB_TOKEN` is read-only. - Fork PRs need approval. - The `release` environment is limited to `main`. - **Not changed (maintainer chose no settings changes).** These remain recommendations: - The `release` environment still holds an unused `NPM_TOKEN` secret (npm publishing uses OIDC). Deleting it, and revoking the token on npmjs.com, removes the one long-lived registry credential a GhostAction-style harvester could name. - The environment has no required reviewer. ## Evidence Local run on Linux x64 with SDK 10.0.402 (checksum-verified from Microsoft's release metadata), Docker 29.1.3, on this branch: | Command | Result | |---|---| | `dotnet restore postgresql-sharp-mcp.slnx --locked-mode --force -p:NuGetAudit=true -p:NuGetAuditMode=all -p:NuGetAuditLevel=low -p:TreatWarningsAsErrors=true` | passed, no advisories | | Throwaway script: every package in each `project.assets.json` vs nuget.org flat-container latest stable | 42 packages, none outdated | | `dotnet build postgresql-sharp-mcp.slnx -c Release -p:RestoreLockedMode=true` | 0 warnings, 0 errors | | `dotnet format style --verify-no-changes --severity warn` | clean | | `Verify -- integration` (PostgreSQL 17, new digest) | `ALL MCP INTEGRATION SCENARIOS PASSED` | | `Build -- package` then `Verify -- packages` | passed: npm local/global/fresh-cache npx without .NET, platform selection, NuGet tool, MCP initialize/tools/shutdown | | `deps.json` in linux-x64, win32-x64, darwin-arm64 npm tarballs | `runtimepack.Microsoft.NETCore.App.Runtime.<rid>/10.0.13` | | `Fuzz -- campaign 30` (dnlib 4.5.0) | 217,281 runs, no crash | | `docker build` + `dotnet --list-runtimes` / `--version` | `Microsoft.NETCore.App 10.0.13`, `postgresql-sharp-mcp 0.7.1.0` | | Trivy 0.76.1 with the CI gate's flags against the built image | 0 HIGH/CRITICAL (OS and .NET), exit 0 | | New PostgreSQL images 13–19: `postgres --version` and `apt-cache madison postgresql-<M>-hypopg` | 13.23, 14.24, 15.19, 16.15, 17.11, 18.6, 19rc1; `1.4.3-1.pgdg12+2` available for all | | actionlint 1.7.12 (`actionlint-py`), zizmor 1.31.1 `--offline --min-severity=low` | no findings | Not verified locally: - integration on 13–16, 18 and 19rc1 (CI matrix) - arm64 HypoPG availability - Windows/macOS native installation (CI) - CodeQL and Scorecard runs with the new pins - hosted release and registry publication ## Authorship Written by an AI coding agent (Claude Code) under the maintainer's authorization for this task: dependency refresh, PR, merge, `v0.7.1` tag and `release.yml` dispatch with target `all` (npm stays staged for Windows 2FA approval). ## Checklist - [x] Title follows the commit format in [docs/git-workflow.md](https://github.com/codegiveness/postgresql-sharp-mcp/blob/main/docs/git-workflow.md#commits) - [x] Affected docs, help and `CHANGELOG.md` updated - [x] No credentials, real connection strings, customer SQL or database results anywhere in the change or this description - [x] Workflow changes (if any) pin actions to full commit SHAs and keep least-privilege permissions
Contributor
Author
|
Looks like cyclonedx is no longer updatable, so this is no longer needed. |
dependabot
Bot
deleted the
dependabot/nuget/dot-config/cyclonedx-6.3.1
branch
October 22, 2026 06:59
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updated cyclonedx from 6.2.0 to 6.3.1.
Release notes
Sourced from cyclonedx's releases.
6.3.1
Fixed
Fixes a regression in 6.3.0 where
Microsoft.ML.OnnxRuntime.Gpuand its managed/native dependencies were classified as development-only and removed by--exclude-dev(#1139, #1140).Build-only runtime aggregation wrappers are now retained as
Requiredwhen their restored dependency closure provides positive evidence in an allowed runtime-capable category. The refinement is target-local and preserves explicit development-only asset selections, standalone build-only/analyzer/tool filtering, test-only exclusion, and production runtime sharing.Intentional limitation
Restored dependency graphs cannot distinguish every runtime wrapper from a build-tool wrapper with the same observable assets. Conservative retention may therefore also retain ambiguous build-tool closures.
PrivateAssetscontrols propagation, not development intent, and alone does not guarantee exclusion. This is not an exact publish-output scanner.Validation
Cross-platform .NET CI and Docker E2E tests pass. A real consumer referencing only
Microsoft.ML.OnnxRuntime.Gpu1.25.1 was also restored and published forlinux-x64; native runtime loading and XML/JSON SBOM closure retention with--exclude-devwere verified. GPU inference was not tested.Thanks
Thank you @wahyuen (Wah Yuen) for reporting the regression and providing the reproduction details!
Update
Docker image:
cyclonedx/cyclonedx-dotnet:6.3.1(also published aslatest).6.3.0
Added
--set-nuget-purlwith--include-project-referencesgenerates missing project purls. Existing purls and custom BOM references are preserved, and dependency edges use the final references.Changed
scope="excluded". Packages shared with production runtime use remainrequired.--exclude-devis deprecated but continues to filter: it omits development-only and test-project-only packages while retaining packages shared with production runtime use.Fixed
$(RootNamespace)in assembly names, including nested$(MSBuildProjectName)tokens. Missing, empty, or circular$(AssemblyName)-referencing namespaces fall back to the project filename. This is best-effort substitution, not full MSBuild evaluation.--exclude-filterremoves only packages it newly orphans; pre-existing orphans are retained.net48,netstandard2.0,Net8.0, and Windows-qualified TFMs. The underlying NuGet.ProjectModel 7.6.0 fix was already included in 6.2.1.Contributors
Thanks to everyone who contributed code, tests, and issue reports to this release:
🎉 New Contributors
A warm welcome and a big thank you to our first-time contributors:
Full changelog: CycloneDX/cyclonedx-dotnet@v6.2.1...v6.3.0
6.2.1
CycloneDX for .NET 6.2.1
This patch release fixes dependency resolution in multi-project solutions and hash computation for uncached NuGet packages.
Fixed
Sequence contains more than one matching elementwhen multiple merged package versions satisfy an unresolved NuGet dependency range. The BOM now retains a dependency edge to every matching component..nupkg.Changed
Documentation
Contributors
Thanks to everyone who contributed to this release:
Full changelog: CycloneDX/cyclonedx-dotnet@v6.2.0...v6.2.1
Commits viewable in compare view.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)