Repository navigation
Update .NET 10.0.13 and Foundatio 13.0.5 dependencies - #2663
Merged
Merged
Conversation
|
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
ejsmith
added a commit
that referenced
this pull request
Oct 15, 2026
Brings in the strict CSP for the Svelte frontend (#2363) and the .NET 10.0.13 and Foundatio 13.0.5 updates (#2663). `svelte.config.js` is gone on this branch, so its new `csp` block moves into the `sveltekit()` options in `vite.config.ts`. That file is type-checked, and SvelteKit's CSP types reject `'*'`, so `connect-src` lists `http:`, `https:`, and `ws:`, which allow the same origins on an HTTP(S) page. The Zod `jitless` setup runs after the `#` imports in `hooks.client.ts`. Kit 3's fallback page keeps the contract `update-config.sh` and the backend rely on: one inline bootstrap that imports `/_app/env.js`, hashed in the CSP meta tag. Running the script on a kit 3 build versions the import and refreshes the hash to match. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Update 13 .NET package references and all deployment runtime pins to 10.0.13, CI/container SDK pins to 10.0.402, and seven Foundatio hosting, provider, and test references to 13.0.5. Keep
Microsoft.OpenApiat 2.12.2 and retain the PKCS security override from #2662.Validation: Release build passes with zero warnings/errors; direct and transitive NuGet audit reports no known vulnerabilities; Linux AMD64/ARM64 container tags verified.
CI validation: Build 8502 passed for head
a64d69761a9ada914ac35d8f8d39231993577fb2on October 14, 2026. All four API test shards, six browser test shards, client checks, combined coverage gates, and API/job/app container builds succeeded. The all-in-one container build, image publishing, and deployment were skipped.Local validation limitation: Full local backend run: 1,681 passed and 1,655 failed during the shared Aspire fixture's one-minute DCP/Kubernetes startup timeout. This startup failure remains unexplained and was not reproduced in the successful CI run. Container builds were not run locally.
Verification and implementation details
AppWebHostFactory.StartSharedAppHostAsync/Aspire.Hosting.Dcp.KubernetesService.EnsureKubernetesAsync, before service assertions. No AppHost remained running after the test run. Whether this startup failure is caused by the upgrade has not been established.System.Security.Cryptography.Pkcs 10.0.0throughMailKit 4.18.1 -> MimeKit 4.18.1and failed restore with NU1902/NU1903 for GHSA-2fmv-rv2c-59x7 and GHSA-846f-f764-76mx. The final Foundatio 13.0.5 dependency graph retains the same MimeKit requirement and no other higher PKCS constraint, so Patch System.Security.Cryptography.Pkcs for .NET security advisories #2662 is still needed.Reproduce with SDK 10.0.402: