Security improvements - #1102
Merged
Merged
Conversation
There was a problem hiding this comment.
Pull request overview
This PR addresses reported security issues in YamlDotNet by preventing unbounded memory growth from (1) merge expansion in MergingParser and (2) unbounded string interning for anchors/tags/keys. It also updates a few projects’ target frameworks (including avoiding .NET Framework builds on Linux).
Changes:
- Stop interning YAML-derived anchor/tag/key strings by switching from
string.Interntostring.IsInterned(...) ?? value. - Add a configurable maximum parsing-event limit to
MergingParserand tests to cover merge-key “bomb” scenarios. - Adjust several project TFMs (net8 → net10 in samples; and conditional TFMs to avoid net47 on Linux).
Reviewed changes
Copilot reviewed 11 out of 11 changed files in this pull request and generated 9 comments.
Show a summary per file
| File | Description |
|---|---|
| YamlDotNet/Core/TagName.cs | Avoids interning tag names derived from input. |
| YamlDotNet/Core/AnchorName.cs | Avoids interning anchor names derived from input. |
| YamlDotNet/Core/Events/Scalar.cs | Avoids interning scalar keys derived from input. |
| YamlDotNet/Core/MergingParser.cs | Adds an event-count limit to mitigate merge expansion memory exhaustion. |
| YamlDotNet.Test/YamlDotNet.Test.csproj | Makes TFMs OS-conditional to avoid running .NET Framework on Linux. |
| YamlDotNet.Test/Serialization/MergingParserTests.cs | Adds tests for event-limit enforcement in merge scenarios. |
| YamlDotNet.Test/Core/StringInterningTests.cs | Adds tests asserting input strings are not force-interned. |
| YamlDotNet.Samples/YamlDotNet.Samples.csproj | Bumps samples to net10.0. |
| YamlDotNet.Samples.Fsharp/YamlDotNet.Samples.Fsharp.fsproj | Makes TFMs OS-conditional and adds net10.0. |
| YamlDotNet.Fsharp.Test/YamlDotNet.Fsharp.Test.fsproj | Makes TFMs OS-conditional and adds net10.0. |
| YamlDotNet.Core7AoTCompileTest/YamlDotNet.Core7AoTCompileTest.csproj | Bumps AoT compile test to net10.0. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
@EdwardCooke, thanks! Looking for official release. It will be happy to disclose both issues under https://github.com/aaubry/YamlDotNet/security. It will be easily discoverable by all NuGet users. FYI: @danfiedler-msft, as you reported first issue. |
This was referenced Apr 28, 2026
This was referenced Aug 17, 2026
This was referenced Aug 24, 2026
NZCypher819
pushed a commit
to u64a/developer-control-tower
that referenced
this pull request
Aug 27, 2026
Updated [coverlet.collector](https://github.com/coverlet-coverage/coverlet) from 6.0.4 to 10.0.1. <details> <summary>Release notes</summary> _Sourced from [coverlet.collector's releases](https://github.com/coverlet-coverage/coverlet/releases)._ ## 10.0.1 ### Improvements - Coverlet with MTP 2 doesn't show test coverage statistic in console [#1907](coverlet-coverage/coverlet#1907) - Avoid unnecessary testhost restarts [#1912](coverlet-coverage/coverlet#1912) by <https://github.com/mawosoft> ### Fixed - Fix inconsistent paths in cobertura reports [#1723](coverlet-coverage/coverlet#1723) - Fix when using "is" with "and" in pattern matching, branch coverage is lower than normal [#1313](coverlet-coverage/coverlet#1313) - Fix Coverlet flagging a branch for an async functions finally block where none exists [#1337](coverlet-coverage/coverlet#1337) - Fix Coverlet Tracker Missing CompilerGeneratedAttribute [#1828](coverlet-coverage/coverlet#1828) ### Maintenance - Add architecture docs and diagrams for all integrations [#1927](coverlet-coverage/coverlet#1927) - Update NuGet packages and .NET SDK versions [#1933](coverlet-coverage/coverlet#1933) [Diff between 10.0.0 and 10.0.1](coverlet-coverage/coverlet@v10.0.0...v10.0.1) ## 10.0.0 ## Improvements - Unique Report Filenames (coverlet.MTP and AzDO) [#1866](coverlet-coverage/coverlet#1866) - Add `--coverlet-file-prefix` option for unique report files [#1869](coverlet-coverage/coverlet#1869) - Introduce .NET 10 support [#1823](coverlet-coverage/coverlet#1823) ## Fixed - Fix [BUG] Wrong branch rate on IAsyncEnumerable for generic type [#1836](coverlet-coverage/coverlet#1836) - Fix [BUG] Missing Coverage after moving to MTP [#1843](coverlet-coverage/coverlet#1843) - Fix [BUG] No coverage reported when targeting .NET Framework with 8.0.1 [#1842](coverlet-coverage/coverlet#1842) - Fix [BUG] Behavior changes between MTP and Legacy (msbuild) [#1878](coverlet-coverage/coverlet#1878) - Fix [BUG] Coverlet.MTP - Unable to load coverlet.mtp.appsettings.json [#1880](coverlet-coverage/coverlet#1880) - Fix [BUG] Coverlet.Collector produces empty report when Mediator.SourceGenerator is referenced [#1718](coverlet-coverage/coverlet#1718) by <https://github.com/yusyd> - Fix [BUG] Crash during instrumentation (Methods using LibraryImport/DllImport have no body) [#1762](coverlet-coverage/coverlet#1762) ## Maintenance - Add comprehensive async method tests and documentation for issue [#1864](coverlet-coverage/coverlet#1864) - Replace Tmds.ExecFunction Package in coverlet.core.coverage.tests [#1833](coverlet-coverage/coverlet#1833) - Add net9.0 and net10.0 targets [#1822](coverlet-coverage/coverlet#1822) [Diff between 8.0.1 and 10.0.0](coverlet-coverage/coverlet@v8.0.1...v10.0.0) ## 8.0.1 ### Fixed - Fix [BUG] TypeInitializationException when targeting .NET Framework [#1818](coverlet-coverage/coverlet#1818) - Fix [BUG] coverlet.MTP build fails with CS0400 due to developmentDependency=true [#1827](coverlet-coverage/coverlet#1827) ### Improvements - Additional improvements needed for .NET Framework instrumentation type import [#1825](coverlet-coverage/coverlet#1825) [Diff between 8.0.0 and 8.0.1](coverlet-coverage/coverlet@v8.0.0...v8.0.1) ## 8.0.0 **Special Thanks:** A huge thank you to [@Bertk](https://github.com/Bertk) for driving the majority of the work in this release! 🎉 ### Fixed - Fix System.CommandLine 2.0 release is available [#1776](coverlet-coverage/coverlet#1776) - Fix Excluding From Coverage bad defaults from given example [#1764](coverlet-coverage/coverlet#1764) - Fix branchpoint exclusion for sdk 8.0.407 [#1741](coverlet-coverage/coverlet#1741) - Fix missing copyright information in NuGet [#1794](coverlet-coverage/coverlet#1794) - Fix bad default values in documentation [#1764](coverlet-coverage/coverlet#1764) by <https://github.com/cboudereau> ### Improvements - Coverlet MTP extension feature [#1788](coverlet-coverage/coverlet#1788) - Generate SBOM for nuget packages [#1752](coverlet-coverage/coverlet#1752) - Use multi targets projects for coverlet.collector, coverlet.msbuild.tasks packages [#1742](coverlet-coverage/coverlet#1742) - Use .NET 8.0 target framework for coverlet.core and remove Newtonsoft.Json [#1733](coverlet-coverage/coverlet#1733) - Use latest System.CommandLine version [#1660](coverlet-coverage/coverlet#1660) - Upgraded minimum required .NET SDK and runtime to .NET 8.0 LTS (Long Term Support) (**Breaking Change**) - Use [xunit.v3](https://xunit.net/docs/getting-started/v3/whats-new) for tests and example code [Diff between 6.0.4 and 8.0.0](coverlet-coverage/coverlet@v6.0.4...v8.0.0) Commits viewable in [compare view](coverlet-coverage/coverlet@v6.0.4...v10.0.1). </details> Updated [Microsoft.NET.Test.Sdk](https://github.com/microsoft/vstest) from 17.14.1 to 18.9.0. <details> <summary>Release notes</summary> _Sourced from [Microsoft.NET.Test.Sdk's releases](https://github.com/microsoft/vstest/releases)._ ## 18.9.0 ## What's Changed * Fix tilde/exclamation characters corrupted in TerminalLogger test output by @nohwnd in microsoft/vstest#16046 * Make TranslationLayer Native AOT-compatible by @drewnoakes in microsoft/vstest#16045 * Guard GenerateProgramFile target against UseWinUI/UseUwpTools evaluation order by @nohwnd in microsoft/vstest#16072 * Add RequestingAssembly to AssemblyResolveEventArgs for binary compat by @nohwnd in microsoft/vstest#16076 * Remove stale Microsoft.Extensions.FileSystemGlobbing binding redirect from testhost.x86 and datacollector by @Evangelink in microsoft/vstest#16082 * Fix TRX attachment paths when LogFileName contains a subdirectory by @nohwnd in microsoft/vstest#15791 * Fix missing dumps for .NET Framework child processes in NetClientHangDumper by @nohwnd in microsoft/vstest#16098 * Fix data collection channels to use negotiated protocol version instead of V1 by @nohwnd in microsoft/vstest#16096 * Fix race condition in BlameCollector: skip hang dump when testhost hasn't launched yet by @nohwnd in microsoft/vstest#16065 * Replace TestSDKAutoGeneratedCode with ExcludeFromCodeCoverage in auto-generated Program files by @nohwnd in microsoft/vstest#16101 * Include testhost process path in crash error messages by @nohwnd in microsoft/vstest#16108 * Fix DataDriven test results being double-counted in TRX logger totals by @nohwnd in microsoft/vstest#15766 * Fix datacollector crash visibility: replace Assert with throwable exceptions by @nohwnd in microsoft/vstest#16048 * Add TreatErrorMessagesAsWarnings parameter to TRX logger by @nohwnd in microsoft/vstest#16106 * Wait for testhost stderr to drain before reading its crash output by @nohwnd in microsoft/vstest#16128 * Handle runtimeconfig.dev.json without additionalProbingPaths by @tmat in microsoft/vstest#16166 * Suggest Microsoft.NET.Test.Sdk when a managed test project brings no testhost by @nohwnd in microsoft/vstest#16169 * Fix x86 testhost loading mismatched x64 hostfxr (0x800700C1) when run via vstest.console.exe directly (#16151) by @azat-msft in microsoft/vstest#16156 * Preserve the real exception (type + stack trace) when a test run aborts in BaseRunTests by @nohwnd in microsoft/vstest#16167 ## New Contributors * @drewnoakes made their first contribution in microsoft/vstest#16045 **Full Changelog**: microsoft/vstest@v18.8.0...v18.9.0 ## 18.8.1 ## What's Changed * Fix protocol negotiation timeout when STJ reflection is disabled (18.8.1) by @nohwnd in microsoft/vstest#16281 **Full Changelog**: microsoft/vstest@v18.8.0...v18.8.1 ## 18.8.0 ## What's Changed * Migrate from Newtonsoft.Json to System.Text.Json / Jsonite (merge to main) by @nohwnd in microsoft/vstest#15687 - For more detail refer to https://devblogs.microsoft.com/dotnet/vs-test-is-removing-its-newtonsoft-json-dependency/ * Create source-only filter package by @Youssef1313 in microsoft/vstest#15638 * Add ARM64 msdia140.dll support to test platform packages by @nohwnd in microsoft/vstest#15692 * Fix mutex cleanup crash on macOS/Linux by @nohwnd in microsoft/vstest#15684 * Restrict artifact temp directory permissions on Unix by @nohwnd in microsoft/vstest#15729 * Add support for filtering uncategorized tests with TestCategory=None by @Evangelink in microsoft/vstest#15727 * Fix SCI binding failure in DTA hosts (main) by @nohwnd in microsoft/vstest#15724 * Fix HTML logger parallel file collision by @nohwnd in microsoft/vstest#15435 * Improve error message when testhost cannot be found by @nohwnd in microsoft/vstest#16053 * Fix HTML logger exception on invalid XML chars in test display names by @nohwnd in microsoft/vstest#16051 **Full Changelog**: microsoft/vstest@v18.7.0...v18.8.0 ## 18.7.0 ## What's Changed * Add ARM64 msdia140.dll support to test platform packages by @jamesmcroft in microsoft/vstest#15689 * Update System.Memory from 4.5.5 to 4.6.3 by @nohwnd in microsoft/vstest#15706 ## New Contributors * @jamesmcroft made their first contribution in microsoft/vstest#15689 **Full Changelog**: microsoft/vstest@v18.6.0...v18.7.0 ## 18.6.0 ## What's Changed * Revert removal of Video Recorder by @nohwnd in microsoft/vstest#15336 * Speed up blame by filtering non-.NET processes from dump collection by @nohwnd in microsoft/vstest#15518 * Add README.md to NuGet packages by @nohwnd in microsoft/vstest#15550 * Report child process info on connection timeout by @nohwnd in microsoft/vstest#15603 ### Changes to tests and infra * Brand as 18.6 by @nohwnd in microsoft/vstest#15423 * Upgrading code coverage version to 18.5.1, by @fhnaseer in microsoft/vstest#15422 * Updating System.Collections.Immutable to 9.0.11 by @MSLukeWest in microsoft/vstest#15425 * Fix attachVS when used for debugging integration tests by @nohwnd in microsoft/vstest#15451 * Replace dotnet.config, with global.json by @nohwnd in microsoft/vstest#15449 * Document debugging integration tests with AttachVS by @Copilot in microsoft/vstest#15452 * Fix stack overflow tests by @nohwnd in microsoft/vstest#15461 * Make TestAssets.sln buildable locally by @Youssef1313 in microsoft/vstest#15466 * Try filtering out tests by @nohwnd in microsoft/vstest#15463 * Build just once when tfms run in parallel by @nohwnd in microsoft/vstest#15465 * Review simplify compatibility sources, deduplicate tests by @nohwnd in microsoft/vstest#15472 * Cleanup dead TRX code by @Youssef1313 in microsoft/vstest#15474 * Update .NET runtimes to 8.0.25, 9.0.14, and 10.0.4 by @nohwnd in microsoft/vstest#15481 * Compat matrix checker by @nohwnd in microsoft/vstest#15480 * Add trx analysis skill by @nohwnd in microsoft/vstest#15486 * Split integration tests to single tfm and multi tfm project by @nohwnd in microsoft/vstest#15484 * Update matrix by @nohwnd in microsoft/vstest#15477 * Break infinite restore loop in VS by @nohwnd in microsoft/vstest#15503 * Use global package cache for build, and local for running integration tests by @nohwnd in microsoft/vstest#15500 * Update contributing by @nohwnd in microsoft/vstest#15505 * Reduce test wall-clock time by increasing minThreads by @drognanar in microsoft/vstest#15502 * Indicator flakiness by @nohwnd in microsoft/vstest#15513 * Fix ci build by @nohwnd in microsoft/vstest#15515 * Fix thread safety issues by @Evangelink in microsoft/vstest#15512 * Optimize DotnetSDKSimulation_PostProcessing test (163s → 61s) by @nohwnd in microsoft/vstest#15516 * Build isolated test assets for single TFM instead of 7 by @nohwnd in microsoft/vstest#15517 * Remove unused dependencies from Library.IntegrationTests by @nohwnd in microsoft/vstest#15527 * Remove printing _attachments content to console by @nohwnd in microsoft/vstest#15520 * Add Linux/macOS test filtering guide to CONTRIBUTING.md by @nohwnd in microsoft/vstest#15521 * Change integration test parallelization from ClassLevel to MethodLevel by @nohwnd in microsoft/vstest#15526 * Unify target framework checks with IsNetFrameworkTarget/IsNetTarget by @nohwnd in microsoft/vstest#15523 * Add unattended work instructions to copilot-instructions.md by @nohwnd in microsoft/vstest#15531 * Reduce code style rule severity from warning to suggestion by @nohwnd in microsoft/vstest#15522 * Remove Debug/Release line number branching from tests by @nohwnd in microsoft/vstest#15519 * Revise unattended work instructions in copilot-instructions.md by @nohwnd in microsoft/vstest#15532 * Improve CompatibilityRowsBuilder error message with diagnostic details by @nohwnd in microsoft/vstest#15529 * docs: add git worktree and upstream sync workflow to copilot-instructions.md by @nohwnd in microsoft/vstest#15538 * Add VSIX runner to smoke tests by @nohwnd in microsoft/vstest#15541 * Remove deprecated WebTest and TMI test methods by @nohwnd in microsoft/vstest#15525 * Fix compatibility test failures for legacy vstest.console and MSTest adapter by @nohwnd in microsoft/vstest#15534 * Convert TestPlatform.sln to slnx format by @nohwnd in microsoft/vstest#15551 * Convert test/TestAssets .sln files to .slnx format by @nohwnd in microsoft/vstest#15557 ... (truncated) ## 18.5.1 ## What's Changed * Fix System.Collections.Immutable binding mismatch in Common.dll (rel/18.5) by @nohwnd in microsoft/vstest#15720 * Port verify-binding-redirects.ps1 to rel/18.5 by @nohwnd in microsoft/vstest#15719 * Bump to 18.5.1 by @nohwnd in microsoft/vstest#15721 **Full Changelog**: microsoft/vstest@v18.5.0...v18.5.1 ## 18.5.0⚠️ Unlisted on Nuget, because of #15718 ## What's Changed * Add runtime configs by @nohwnd in microsoft/vstest#15377 * Add net8.0 target for TranslationLayer by @nohwnd in microsoft/vstest#15375 * Determine architecture of remote process on windows by @nohwnd in microsoft/vstest#15396 * Updating System.Collections.Immutable package reference to version 9.0.0 by @MSLukeWest in microsoft/vstest#15392 * Dump via netcore tool on windows by @nohwnd in microsoft/vstest#15397 * Fix answer file splitting by @nohwnd in microsoft/vstest#15381 * Run tests against vsix runner by @nohwnd in microsoft/vstest#15419 **Full Changelog**: microsoft/vstest@v18.4.0...v18.5.0 ## 18.4.0 ## What's Changed * Add LoongArch64 support by @stdmnpkg in microsoft/vstest#15359 * Refactor Condition evaluation by @Youssef1313 in microsoft/vstest#15357 * Adding info on extensions points part 1 by @nohwnd in microsoft/vstest#15360 * Add option to ask for uploading code QL before the standard window ends by @nohwnd in microsoft/vstest#15373 * Update runtime versions by @nohwnd in microsoft/vstest#15372 * Fix .NET 10 regression for traits by @Youssef1313 in microsoft/vstest#15370 * Update target frameworks to net10.0 and net11.0 by @dotnet-maestro[bot] in microsoft/vstest#15349 * Fix names in pipeline matrix so we don't have to align them by @nohwnd in microsoft/vstest#15365 * Update SECURITY.md by @Youssef1313 in microsoft/vstest#15342 ## New Contributors * @stdmnpkg made their first contribution in microsoft/vstest#15359 **Full Changelog**: microsoft/vstest@v18.3.0...v18.4.0 ## 18.3.0 ## What's Changed * Fix answer file splitting by @nohwnd in microsoft/vstest#15306 ## Internal fixes and updates * Bump branding to 18.1 by @nohwnd in microsoft/vstest#15286 * Remove stale copy of S.ComponentModel.Composition from testplatform packages by @ViktorHofer in microsoft/vstest#15287 * Update codeflow metadata to fix backflow by @premun in microsoft/vstest#15291 * [main] Update dependencies from devdiv/DevDiv/vs-code-coverage by @dotnet-maestro[bot] in microsoft/vstest#15283 * Update Microsoft.Build.Utilities.Core by @Youssef1313 in microsoft/vstest#15300 * Disable DynamicNative instrumentation by default by @nohwnd in microsoft/vstest#15299 * [main] Source code updates from dotnet/dotnet by @dotnet-maestro[bot] in microsoft/vstest#15293 * [main] Source code updates from dotnet/dotnet by @dotnet-maestro[bot] in microsoft/vstest#15302 * [main] Source code updates from dotnet/dotnet by @dotnet-maestro[bot] in microsoft/vstest#15314 * Delete sha1 custom implementation we are not using for a long time by @nohwnd in microsoft/vstest#15313 * [main] Source code updates from dotnet/dotnet by @dotnet-maestro[bot] in microsoft/vstest#15315 * Update branding to 18.3.0 by @nohwnd in microsoft/vstest#15321 * [main] Update dependencies from devdiv/DevDiv/vs-code-coverage by @dotnet-maestro[bot] in microsoft/vstest#15325 * [main] Update dependencies from dotnet/arcade by @dotnet-maestro[bot] in microsoft/vstest#15264 * Revert adding dotnet_host_path workaround by @nohwnd in microsoft/vstest#15328 * [main] Update dependencies from dotnet/arcade by @dotnet-maestro[bot] in microsoft/vstest#15338 * [main] Source code updates from dotnet/dotnet by @dotnet-maestro[bot] in microsoft/vstest#15322 * [main] Update dependencies from dotnet/arcade by @dotnet-maestro[bot] in microsoft/vstest#15343 * Change PreReleaseVersionLabel from 'preview' to 'release' by @nohwnd in microsoft/vstest#15352 * [rel/18.3] Update dependencies from devdiv/DevDiv/vs-code-coverage by @dotnet-maestro[bot] in microsoft/vstest#15354 * [rel/18.3] Update dependencies from dotnet/arcade by @dotnet-maestro[bot] in microsoft/vstest#15389 * [rel/18.3] Update dependencies from dotnet/arcade by @dotnet-maestro[bot] in microsoft/vstest#15400 * Update build tools to 17.11.48 to be source buildable by @nohwnd in microsoft/vstest#15310 * Disable publishing on RTM by @nohwnd in microsoft/vstest#15296 * Don't access nuget.org for package feeds by @nohwnd in microsoft/vstest#15316 * No nuget access fix tests by @nohwnd in microsoft/vstest#15317 * Disable Dependabot updates in dependabot.yml by @mmitche in microsoft/vstest#15324 ## New Contributors * @premun made their first contribution in microsoft/vstest#15291 ## 18.0.1 ## What's Changed Fixing an issue with loading covrun64.dll on systems that have .NET 10 SDK installed: https://learn.microsoft.com/en-us/dotnet/core/compatibility/sdk/10.0/code-coverage-dynamic-native-instrumentation * Disable DynamicNative instrumentation by default by @nohwnd in microsoft/vstest#15298 * Update MicrosoftInternalCodeCoveragePackageVersion to 18.0.6 by @nohwnd in microsoft/vstest#15312 ### Internal changes * Update VersionPrefix to 18.0.1 by @nohwnd in microsoft/vstest#15301 * Update build tools to 17.8.43 by @nohwnd in microsoft/vstest#15305 **Full Changelog**: microsoft/vstest@v18.0.0...v18.0.1 ## 18.0.0 ## What's Changed * Update reporting formatting by @martincostello in microsoft/vstest#15082 * Fix stack trace for Trace.Fail and Debug.Fail by @nohwnd in microsoft/vstest#15103 * Add documentation of environment variables by @Copilot in microsoft/vstest#15095 * IFrameworkHandle.LaunchProcessWithDebuggerAttached allows null for workingDirectory in signature but throws by @Copilot in microsoft/vstest#15091 * Add Dependabot configuration for .NET SDK updates by @JamieMagee in microsoft/vstest#15114 * Handle dotnet_root in testhost version aware way by @nohwnd in microsoft/vstest#15184 * Add magic bytes validation for Mach-O binaries in DotnetHostHelper by @Copilot in microsoft/vstest#15230 * using globbing pattern doesn't work on windows with forward slashes by @Copilot in microsoft/vstest#15088 * Remove tpv0 by @nohwnd in microsoft/vstest#15247 * Cache AssemblyName in ManagedNameHelper by @Youssef1313 in microsoft/vstest#15259 * Add ARM64 support to GetArchitectureForSource methods by @Copilot in microsoft/vstest#15278 ### Internal fixes and updates * Fix formatting in two files by @ViktorHofer in microsoft/vstest#15047 * Build TestPlatform packages in VMR by @ViktorHofer in microsoft/vstest#15055 * Condition property on .NET FX MSBuild by @jaredpar in microsoft/vstest#15054 * Migrate to awesome assertions by @nohwnd in microsoft/vstest#15056 * Revert "Build TestPlatform packages in VMR" by @ViktorHofer in microsoft/vstest#15057 * Update package Category by @ViktorHofer in microsoft/vstest#15058 * Revert "Write props of tests into trx" by @nohwnd in microsoft/vstest#15080 * Error on unsupported tfms (#15072) by @nohwnd in microsoft/vstest#15073 * Use policies from testfx to align by @nohwnd in microsoft/vstest#15085 * Update enable-auto-merge.yml by @nohwnd in microsoft/vstest#15102 * Revert ignoring environment test by @Copilot in microsoft/vstest#15094 * unignore tests by @Copilot in microsoft/vstest#15093 * Update MSTest by @Youssef1313 in microsoft/vstest#15108 * Bump dotnet-sdk from 9.0.106 to 9.0.301 by @dependabot[bot] in microsoft/vstest#15179 * Use Assert.Equals by @nohwnd in microsoft/vstest#15181 * Run VSTest tests with MTP by @Youssef1313 in microsoft/vstest#15079 * Use the standard sdk for architecture switch test by @nohwnd in microsoft/vstest#15188 * Remove CUIT (Coded UI Test) from NuGet packages and test projects by @Copilot in microsoft/vstest#15177 * dump-logs? by @nohwnd in microsoft/vstest#15187 * Moving to version 18 by @nohwnd in microsoft/vstest#15209 * Update fakes version by @drognanar in microsoft/vstest#15227 * Microsoft.Intellitrace.Core should be taken from nuget by @nohwnd in microsoft/vstest#15229 * Remove MSTest.Assert.Extensions by @Youssef1313 in microsoft/vstest#15178 * Sourcebuild fix by @nohwnd in microsoft/vstest#15239 * Set dotnet_root_<arch> only when the architecture of dotnet in the path is the same by @nohwnd in microsoft/vstest#15250 * Remove fakes v1 from FakesUtilities by @drognanar in microsoft/vstest#15251 * Update fakes dependencies by @drognanar in microsoft/vstest#15254 * Do half the work in GetManagedName by @Youssef1313 in microsoft/vstest#15255 * check Vsix only when produced by @nohwnd in microsoft/vstest#15261 * Set dotnet_root_<arch> always by @nohwnd in microsoft/vstest#15266 * Don't hardcode old vswhere version in global.json by @akoeplinger in microsoft/vstest#15267 * Revert dowgrade of fakes by @nohwnd in microsoft/vstest#15263 * Update VSSDK to version with code flow guard by @nohwnd in microsoft/vstest#15279 * Update Fakes to version with code flow guard by @nohwnd in microsoft/vstest#15273 ... (truncated) Commits viewable in [compare view](microsoft/vstest@v17.14.1...v18.9.0). </details> Updated [xunit.runner.visualstudio](https://github.com/xunit/visualstudio.xunit) from 2.8.2 to 4.0.0. <details> <summary>Release notes</summary> _Sourced from [xunit.runner.visualstudio's releases](https://github.com/xunit/visualstudio.xunit/releases)._ ## 4.0.0 Release notes: https://xunit.net/releases/visualstudio/4.0.0 ## 4.0.0-pre.5 Release notes: https://xunit.net/releases/visualstudio/4.0.0-pre.5 ## 4.0.0-pre.4 Release notes: https://xunit.net/releases/visualstudio/4.0.0-pre.4 ## 4.0.0-pre.3 Release notes: https://xunit.net/releases/visualstudio/4.0.0-pre.3 ## 3.1.5 Release notes: https://xunit.net/releases/visualstudio/3.1.5 Commits viewable in [compare view](https://github.com/xunit/visualstudio.xunit/commits/4.0.0). </details> Pinned [YamlDotNet](https://github.com/aaubry/YamlDotNet) at 18.1.0. <details> <summary>Release notes</summary> _Sourced from [YamlDotNet's releases](https://github.com/aaubry/YamlDotNet/releases)._ ## 18.1.0 ## What's Changed * Use NET 10 with benchmarks by @mcraiha in aaubry/YamlDotNet#1099 * Revert package upgrades by @EdwardCooke in aaubry/YamlDotNet#1104 * Added default maximum recursion level of 130 (max when using defaults on Windows/.net8) by @EdwardCooke in aaubry/YamlDotNet#1110 * Static deserializer builder needed the default maximum recursion by @EdwardCooke in aaubry/YamlDotNet#1111 ## New Contributors * @mcraiha made their first contribution in aaubry/YamlDotNet#1099 **Full Changelog**: aaubry/YamlDotNet@v18.0.0...v18.1.0 ## Breaking * Maximum depth of yaml files is now 130 by default. If you need higher you will need to adjust the maximum yaml depth. Going above 130 runs the risk of stack overflow exceptions when any exception happens inside of the deserialization ## 18.0.0 ## What's Changed * Add a parse method wrapper and caching to fix AoT compilation by @EdwardCooke in aaubry/YamlDotNet#1103 **BREAKING CHANGE** This is a breaking change in the `TypeInspectorSkeleton` class and the `ITypeInspector` interface by adding 2 methods . Quick fix to resolve those breaking changes in your own custom TypeInspector is to return false on the HasParseMethod method and return null or throw an exception on the Parse method. **Full Changelog**: aaubry/YamlDotNet@v17.1.0...v18.0.0 ## 17.1.0 ## What's Changed * Security improvements by @EdwardCooke in aaubry/YamlDotNet#1102 There was a potential breaking change for large yaml files in the MergingParser. You may need to specify the optional parameter for maximum events to be processed. It default to 100k events which is a very large yaml file. **Full Changelog**: aaubry/YamlDotNet@v17.0.0...v17.1.0 ## 17.0.0 ## What's Changed * Clean-up the "IsKey" logic by @aaubry in aaubry/YamlDotNet#1073 * Fix for gitversion and pinning it so it doesnt break...again. by @EdwardCooke in aaubry/YamlDotNet#1074 * Add max depth handling to StaticDeserializerBuilder (builds on #1072) by @skdishansachin in aaubry/YamlDotNet#1082 * Allow specifying a maximum recursion for the deserializer by @aaubry in aaubry/YamlDotNet#1072 * Fix NullReferenceException when serializing null System.Type properties by @fdcastel in aaubry/YamlDotNet#1091 * Reduce code duplication in converters and event emitters by @fdcastel in aaubry/YamlDotNet#1090 * Use pre-compiled static Regex instances in ScalarNodeDeserializer by @fdcastel in aaubry/YamlDotNet#1088 * Fix infinite loop in source generator exception handler by @fdcastel in aaubry/YamlDotNet#1087 * Fix TODOs, typos, and add missing tests by @fdcastel in aaubry/YamlDotNet#1086 * Fix YamlException.ToString() to include stack trace by @skdishansachin in aaubry/YamlDotNet#1084 * Fix remaining spec cases during parsing: L383, C2SP by @am11 in aaubry/YamlDotNet#1081 * Improve type fidelity in UnquotedStringTypeDeserialization test by @jhgbrt in aaubry/YamlDotNet#1076 * CodeQL Advanced Workflow by @aluty in aaubry/YamlDotNet#1067 * Nullable fixes in non-public code by @Kielek in aaubry/YamlDotNet#1064 * Use string interning by @simonthum in aaubry/YamlDotNet#1055 * Fix grammar in comments in DefaultValuesHandling.cs by @209jkjkjk in aaubry/YamlDotNet#1041 * fix #1031 by @dogdie233 in aaubry/YamlDotNet#1033 * Improve Native AOT Support (Closes #1085) by @fdcastel in aaubry/YamlDotNet#1092 ## New Contributors * @skdishansachin made their first contribution in aaubry/YamlDotNet#1082 * @fdcastel made their first contribution in aaubry/YamlDotNet#1091 * @jhgbrt made their first contribution in aaubry/YamlDotNet#1076 * @aluty made their first contribution in aaubry/YamlDotNet#1067 * @Kielek made their first contribution in aaubry/YamlDotNet#1064 * @simonthum made their first contribution in aaubry/YamlDotNet#1055 * @209jkjkjk made their first contribution in aaubry/YamlDotNet#1041 * @dogdie233 made their first contribution in aaubry/YamlDotNet#1033 **Full Changelog**: aaubry/YamlDotNet@v16.3.0...v17.0.0 Commits viewable in [compare view](aaubry/YamlDotNet@v16.3.0...v18.1.0). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
tom-wolfe
pushed a commit
to ritten-org/Ritten
that referenced
this pull request
Aug 27, 2026
[//]: # (dependabot-start)⚠️ **Dependabot is rebasing this PR**⚠️ Rebasing might not happen immediately, so don't worry if this takes some time. Note: if you make any changes to this PR yourself, they will take precedence over the rebase. --- [//]: # (dependabot-end) Updated [ritten](https://github.com/ritten-org/Ritten) from 0.8.0 to 0.10.0. <details> <summary>Release notes</summary> _Sourced from [ritten's releases](https://github.com/ritten-org/Ritten/releases)._ ## 0.10.0 ### Added - **The tool client works the way the SDK does.** `IDotNet`'s tool methods are one per `dotnet tool` verb — `ToolInstall`, `ToolUpdate`, `ToolUninstall`, and `InstalledToolVersion` for `list`. - **The engine reads and writes project files.** `IProjectFiles` and `ProjectFile` load a `ritten.json` as a document, set values by key path, and write it back with everything else intact. - **`Ritten.GitHub` maintains GitHub Actions workflows.** `IActionsWorkflows` and `ActionsWorkflow` read a workflow file, find its jobs by what they run, and write a job or a trigger back into it without disturbing a line of the rest. - **`Ritten.DotNet` manages the tool manifest.** `IDotNet` gains `ToolUpdate` and `CreateToolManifest`, and `DotNetProjects` reads what a repository holds. - **Jobs can declare that they run without a project.** `IJob.RequiresProject` is what lets a job create the project file. - **Workflows can check compatibility.** `IWorkflow.IsCompatible` answers whether a directory looks like its kind, and `WorkflowRegistry.IsCompatible` asks each in registration order. - **A file knows its directory, and a directory can place one.** `IFile.Directory` returns the directory a file is in, so anything writing a nested file can create the path first, and `IDirectory.RelativePath(file)`/`RelativePath(directory)` write a path the way a project file spells one. ### Changed - **`ritten init` is now a job instead of a command.** It runs like every other job, with `--dry-run`, `--verbose` and the rest, and each workflow declares its own. A repository with no `ritten.json` yet has its workflow detected by what's in it, or `--workflow` sets one explicitly. - **Resolving a repository is its own step.** `WorkflowApplication.SelectWorkflow` detects the workflow for a given directory. - **Workflows can run without a project file.** `RittenProject.Resolve` answers with a synthetic project when nothing has been written yet. - **Init ensures rather than scaffolds.** Every file it touches is loaded as a document, given whatever it's missing, and written back, so a changelog keeps its entries, a `ritten.json` keeps all its keys, a tool manifest keeps the other tools it pins, and an Actions workflow keeps its other jobs, triggers, and comments. - **The Actions workflow is named for the project, and found by what it runs.** Ritten owns the jobs it wrote, not the file they live in: a renamed workflow file is updated in place rather than duplicated. ## 0.9.0 ### Added - **The report is written to a file.** Every run now leaves its report at `artifacts/report.md`, so the best thing a run produces is no longer readable only on GitHub Actions. - **`ritten init` sets a repository up.** It writes the four files a repository needs — `ritten.json`, `CHANGELOG.md`, the tool manifest, and the GitHub Actions workflow. `--check` reports what's missing or has drifted, `--verbose` shows what a drifted file should say, and `--force` rewrites the files Ritten generates. - **Jobs declare what they're for.** `JobKind` classifies a job the way `StepKind` classifies a step — `Work`, `Check`, or `Deploy`. - **`PhysicalFile` and `PhysicalDirectory` are public.** `IFile` and `IDirectory` were public with no way for anything outside the engine to produce one, so a module holding a real path had nothing to hand back. - **Steps can reach the repository root.** `IGit.RepositoryRoot()` returns the root of the repository the workflow is running in, which isn't always the project root. ### Fixed - **The pending comment links to the run logs.** Just the same as the completed report comment. - **Output lines up outside a run.** A step's body is indented under its heading, which left a command that runs no steps reporting at two different levels for no reason. Commits viewable in [compare view](v0.8.0...v0.10.0). </details> Updated [YamlDotNet](https://github.com/aaubry/YamlDotNet) from 16.3.0 to 18.1.0. <details> <summary>Release notes</summary> _Sourced from [YamlDotNet's releases](https://github.com/aaubry/YamlDotNet/releases)._ ## 18.1.0 ## What's Changed * Use NET 10 with benchmarks by @mcraiha in aaubry/YamlDotNet#1099 * Revert package upgrades by @EdwardCooke in aaubry/YamlDotNet#1104 * Added default maximum recursion level of 130 (max when using defaults on Windows/.net8) by @EdwardCooke in aaubry/YamlDotNet#1110 * Static deserializer builder needed the default maximum recursion by @EdwardCooke in aaubry/YamlDotNet#1111 ## New Contributors * @mcraiha made their first contribution in aaubry/YamlDotNet#1099 **Full Changelog**: aaubry/YamlDotNet@v18.0.0...v18.1.0 ## Breaking * Maximum depth of yaml files is now 130 by default. If you need higher you will need to adjust the maximum yaml depth. Going above 130 runs the risk of stack overflow exceptions when any exception happens inside of the deserialization ## 18.0.0 ## What's Changed * Add a parse method wrapper and caching to fix AoT compilation by @EdwardCooke in aaubry/YamlDotNet#1103 **BREAKING CHANGE** This is a breaking change in the `TypeInspectorSkeleton` class and the `ITypeInspector` interface by adding 2 methods . Quick fix to resolve those breaking changes in your own custom TypeInspector is to return false on the HasParseMethod method and return null or throw an exception on the Parse method. **Full Changelog**: aaubry/YamlDotNet@v17.1.0...v18.0.0 ## 17.1.0 ## What's Changed * Security improvements by @EdwardCooke in aaubry/YamlDotNet#1102 There was a potential breaking change for large yaml files in the MergingParser. You may need to specify the optional parameter for maximum events to be processed. It default to 100k events which is a very large yaml file. **Full Changelog**: aaubry/YamlDotNet@v17.0.0...v17.1.0 ## 17.0.0 ## What's Changed * Clean-up the "IsKey" logic by @aaubry in aaubry/YamlDotNet#1073 * Fix for gitversion and pinning it so it doesnt break...again. by @EdwardCooke in aaubry/YamlDotNet#1074 * Add max depth handling to StaticDeserializerBuilder (builds on #1072) by @skdishansachin in aaubry/YamlDotNet#1082 * Allow specifying a maximum recursion for the deserializer by @aaubry in aaubry/YamlDotNet#1072 * Fix NullReferenceException when serializing null System.Type properties by @fdcastel in aaubry/YamlDotNet#1091 * Reduce code duplication in converters and event emitters by @fdcastel in aaubry/YamlDotNet#1090 * Use pre-compiled static Regex instances in ScalarNodeDeserializer by @fdcastel in aaubry/YamlDotNet#1088 * Fix infinite loop in source generator exception handler by @fdcastel in aaubry/YamlDotNet#1087 * Fix TODOs, typos, and add missing tests by @fdcastel in aaubry/YamlDotNet#1086 * Fix YamlException.ToString() to include stack trace by @skdishansachin in aaubry/YamlDotNet#1084 * Fix remaining spec cases during parsing: L383, C2SP by @am11 in aaubry/YamlDotNet#1081 * Improve type fidelity in UnquotedStringTypeDeserialization test by @jhgbrt in aaubry/YamlDotNet#1076 * CodeQL Advanced Workflow by @aluty in aaubry/YamlDotNet#1067 * Nullable fixes in non-public code by @Kielek in aaubry/YamlDotNet#1064 * Use string interning by @simonthum in aaubry/YamlDotNet#1055 * Fix grammar in comments in DefaultValuesHandling.cs by @209jkjkjk in aaubry/YamlDotNet#1041 * fix #1031 by @dogdie233 in aaubry/YamlDotNet#1033 * Improve Native AOT Support (Closes #1085) by @fdcastel in aaubry/YamlDotNet#1092 ## New Contributors * @skdishansachin made their first contribution in aaubry/YamlDotNet#1082 * @fdcastel made their first contribution in aaubry/YamlDotNet#1091 * @jhgbrt made their first contribution in aaubry/YamlDotNet#1076 * @aluty made their first contribution in aaubry/YamlDotNet#1067 * @Kielek made their first contribution in aaubry/YamlDotNet#1064 * @simonthum made their first contribution in aaubry/YamlDotNet#1055 * @209jkjkjk made their first contribution in aaubry/YamlDotNet#1041 * @dogdie233 made their first contribution in aaubry/YamlDotNet#1033 **Full Changelog**: aaubry/YamlDotNet@v16.3.0...v17.0.0 Commits viewable in [compare view](aaubry/YamlDotNet@v16.3.0...v18.1.0). </details> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This was referenced Aug 28, 2026
This was referenced Sep 4, 2026
This was referenced Sep 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A couple of vulnerabilities were received.
Piotr Kiełkowicz - Cisco
Also bumps net8 to net10 on a couple of projects and makes it so net47 isn't ran on Linux environments.