mcmuzzle/LittleTown
1
0
Fork 0
Code Issues 1 Pull Requests 11 Actions Packages Projects 1 Releases Wiki Activity

Update dependency AutoMapper to 16.3.0 #44

Open
renovateBot wants to merge 1 commits from renovate/automapper-16.x into main
pull from: renovate/automapper-16.x
merge into: mcmuzzle:main
Conversation 2 Commits 1 Files Changed 1 +1 -1
renovateBot commented 2026-09-18 08:16:01 +00:00
Collaborator
Copy Link

This PR contains the following updates:

Package Change Age Confidence
AutoMapper (source) 16.0.0 → 16.3.0 age confidence

Release Notes

LuckyPennySoftware/AutoMapper (AutoMapper)

v16.3.0

Security

This release fixes two denial-of-service vulnerabilities. In both, deeply nested input could bypass MaxDepth and exhaust the stack. The resulting StackOverflowException can't be caught, so it ends the process. Please upgrade if your application maps untrusted, deeply nested data.

  • GHSA-6vhm-j9h7-f9gh: MaxDepth wasn't enforced when mapping through constructor parameters, including positional records. Thanks to @​mcambria for the report.
  • GHSA-gpwp-5797-mjff: other recursion paths bypassed MaxDepth: derived maps, object and interface members, dictionary and dynamic sources, and recursive type converters.

CVE IDs have been requested and will be added here once they're assigned.

Behavior changes

  • Recursion that MaxDepth can't limit now throws a catchable InsufficientExecutionStackException instead of crashing the process.
  • Derived maps (Include / IncludeBase) now inherit MaxDepth and get the default limit of 64 for self-referential maps. If your polymorphic graphs legitimately go deeper, set MaxDepth explicitly.
  • Constructor mapping now stops at the same depth as property mapping.
  • Condition on ForAllMembers, or any condition whose member parameter is object or a base type, now receives the source member value instead of the value converted to the destination type, when those types differ. This matches the documented contract. A null in a nullable source member is now seen as null rather than 0 or false (#​4655).

Other highlights

  • Fixed Context.Items are only available... exceptions with MaxDepth, which depended on registration or warmup order (#​4651)

  • License keys get a 30-day renewal grace period, which logs a warning instead of an error (#​4667)

  • Clearer license validation messages for malformed keys, client platforms and IdentityModel version mismatches (#​4670)

  • Whitespace is stripped from license keys (#​4663), and license validation is isolated from the host app's CryptoProviderFactory (#​4674)

  • What's Changed

New Contributors

Full Changelog: https://github.com/LuckyPennySoftware/AutoMapper/compare/v16.2.0...v16.3.0

v16.2.0

What's Changed

New Contributors

Full Changelog: https://github.com/LuckyPennySoftware/AutoMapper/compare/v15.1.1...v16.2.0

v16.1.1

What's Changed

Security

Fixed an issue where certain cyclic or self-referential object graphs could trigger uncontrolled recursion during mapping, potentially resulting in stack exhaustion and denial of service.

Applications that process untrusted or attacker-controlled object graphs through affected mapping paths may be impacted.

Users should upgrade to this release.

Security advisory: GHSA-rvv3-g6hj-g44x

Thanks to @​skdishansachin for responsibly disclosing this issue.

Full Changelog: https://github.com/LuckyPennySoftware/AutoMapper/compare/v16.1.0...v16.1.1

v16.1.0

What's Changed

New Contributors

Full Changelog: https://github.com/LuckyPennySoftware/AutoMapper/compare/v16.0.0...v16.1.0

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [AutoMapper](https://automapper.io/) ([source](https://github.com/LuckyPennySoftware/AutoMapper)) | `16.0.0` → `16.3.0` | ![age](https://developer.mend.io/api/mc/badges/age/nuget/AutoMapper/16.3.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/nuget/AutoMapper/16.0.0/16.3.0?slim=true) | --- ### Release Notes <details> <summary>LuckyPennySoftware/AutoMapper (AutoMapper)</summary> ### [`v16.3.0`](https://github.com/LuckyPennySoftware/AutoMapper/releases/tag/v16.3.0) #### Security This release fixes two denial-of-service vulnerabilities. In both, deeply nested input could bypass `MaxDepth` and exhaust the stack. The resulting `StackOverflowException` can't be caught, so it ends the process. Please upgrade if your application maps untrusted, deeply nested data. - [GHSA-6vhm-j9h7-f9gh](https://github.com/LuckyPennySoftware/AutoMapper/security/advisories/GHSA-6vhm-j9h7-f9gh): `MaxDepth` wasn't enforced when mapping through constructor parameters, including positional records. Thanks to [@&#8203;mcambria](https://github.com/mcambria) for the report. - [GHSA-gpwp-5797-mjff](https://github.com/LuckyPennySoftware/AutoMapper/security/advisories/GHSA-gpwp-5797-mjff): other recursion paths bypassed `MaxDepth`: derived maps, `object` and interface members, dictionary and dynamic sources, and recursive type converters. CVE IDs have been requested and will be added here once they're assigned. #### Behavior changes - Recursion that `MaxDepth` can't limit now throws a catchable `InsufficientExecutionStackException` instead of crashing the process. - Derived maps (`Include` / `IncludeBase`) now inherit `MaxDepth` and get the default limit of 64 for self-referential maps. If your polymorphic graphs legitimately go deeper, set `MaxDepth` explicitly. - Constructor mapping now stops at the same depth as property mapping. - `Condition` on `ForAllMembers`, or any condition whose member parameter is `object` or a base type, now receives the source member value instead of the value converted to the destination type, when those types differ. This matches the documented contract. A `null` in a nullable source member is now seen as `null` rather than `0` or `false` ([#&#8203;4655](https://github.com/LuckyPennySoftware/AutoMapper/issues/4655)). #### Other highlights - Fixed `Context.Items are only available...` exceptions with `MaxDepth`, which depended on registration or warmup order ([#&#8203;4651](https://github.com/LuckyPennySoftware/AutoMapper/issues/4651)) - License keys get a 30-day renewal grace period, which logs a warning instead of an error ([#&#8203;4667](https://github.com/LuckyPennySoftware/AutoMapper/issues/4667)) - Clearer license validation messages for malformed keys, client platforms and IdentityModel version mismatches ([#&#8203;4670](https://github.com/LuckyPennySoftware/AutoMapper/issues/4670)) - Whitespace is stripped from license keys ([#&#8203;4663](https://github.com/LuckyPennySoftware/AutoMapper/issues/4663)), and license validation is isolated from the host app's `CryptoProviderFactory` ([#&#8203;4674](https://github.com/LuckyPennySoftware/AutoMapper/issues/4674)) - ## What's Changed * Bump Testcontainers.MsSql to 4.14.0 to clear NU1903 by [@&#8203;jbogard](https://github.com/jbogard) in [#&#8203;4652](https://github.com/LuckyPennySoftware/AutoMapper/pull/4652) * docs: replace dead MyGet build link with CI feed link by [@&#8203;JiuYue0820](https://github.com/JiuYue0820) in [#&#8203;4648](https://github.com/LuckyPennySoftware/AutoMapper/pull/4648) * Emit the context check for the containing type map in CollectionMapper (fixes [#&#8203;4650](https://github.com/LuckyPennySoftware/AutoMapper/issues/4650)) by [@&#8203;jbogard](https://github.com/jbogard) in [#&#8203;4651](https://github.com/LuckyPennySoftware/AutoMapper/pull/4651) * Pass the source member value to Condition by [@&#8203;jbogard](https://github.com/jbogard) in [#&#8203;4655](https://github.com/LuckyPennySoftware/AutoMapper/pull/4655) * Fix licensing page structure in docs ToC by [@&#8203;jbogard](https://github.com/jbogard) in [#&#8203;4664](https://github.com/LuckyPennySoftware/AutoMapper/pull/4664) * Fix BuildDateUtc embedding on Windows builds by [@&#8203;jbogard](https://github.com/jbogard) in [#&#8203;4666](https://github.com/LuckyPennySoftware/AutoMapper/pull/4666) * License validation: WARNING during the renewal grace period by [@&#8203;jbogard](https://github.com/jbogard) in [#&#8203;4667](https://github.com/LuckyPennySoftware/AutoMapper/pull/4667) * Fail the release when the tag is not on its release branch by [@&#8203;jbogard](https://github.com/jbogard) in [#&#8203;4668](https://github.com/LuckyPennySoftware/AutoMapper/pull/4668) * ci: bump lock-threads to v6 to fix token validation failure by [@&#8203;simpleqt](https://github.com/simpleqt) in [#&#8203;4658](https://github.com/LuckyPennySoftware/AutoMapper/pull/4658) * Strip whitespace from license keys before resolving precedence by [@&#8203;AVTUNEY](https://github.com/AVTUNEY) in [#&#8203;4663](https://github.com/LuckyPennySoftware/AutoMapper/pull/4663) * License validation: clear messages for malformed keys, client platforms, and IdentityModel version mismatches by [@&#8203;jbogard](https://github.com/jbogard) in [#&#8203;4670](https://github.com/LuckyPennySoftware/AutoMapper/pull/4670) * Move to central package management by [@&#8203;jbogard](https://github.com/jbogard) in [#&#8203;4672](https://github.com/LuckyPennySoftware/AutoMapper/pull/4672) * License validation: isolate from the host app's CryptoProviderFactory by [@&#8203;jbogard](https://github.com/jbogard) in [#&#8203;4674](https://github.com/LuckyPennySoftware/AutoMapper/pull/4674) * Replace broken ApiCompat setup with SDK package validation by [@&#8203;jbogard](https://github.com/jbogard) in [#&#8203;4673](https://github.com/LuckyPennySoftware/AutoMapper/pull/4673) * Add regression test for registration-order MaxDepth context failure by [@&#8203;jbogard](https://github.com/jbogard) in [#&#8203;4675](https://github.com/LuckyPennySoftware/AutoMapper/pull/4675) * Document license key environment variables in the README by [@&#8203;jbogard](https://github.com/jbogard) in [#&#8203;4677](https://github.com/LuckyPennySoftware/AutoMapper/pull/4677) #### New Contributors - [@&#8203;JiuYue0820](https://github.com/JiuYue0820) made their first contribution in [#&#8203;4648](https://github.com/LuckyPennySoftware/AutoMapper/pull/4648) - [@&#8203;simpleqt](https://github.com/simpleqt) made their first contribution in [#&#8203;4658](https://github.com/LuckyPennySoftware/AutoMapper/pull/4658) - [@&#8203;AVTUNEY](https://github.com/AVTUNEY) made their first contribution in [#&#8203;4663](https://github.com/LuckyPennySoftware/AutoMapper/pull/4663) **Full Changelog**: <https://github.com/LuckyPennySoftware/AutoMapper/compare/v16.2.0...v16.3.0> ### [`v16.2.0`](https://github.com/LuckyPennySoftware/AutoMapper/releases/tag/v16.2.0) #### What's Changed - Enhance SECURITY.md with comprehensive security policy by [@&#8203;jbogard](https://github.com/jbogard) in [#&#8203;4633](https://github.com/LuckyPennySoftware/AutoMapper/pull/4633) - Attach NuGet packages and SBOM to GitHub Release by [@&#8203;jbogard](https://github.com/jbogard) in [#&#8203;4637](https://github.com/LuckyPennySoftware/AutoMapper/pull/4637) - Support LicenseKey via environment variable fallback by [@&#8203;Nit8](https://github.com/Nit8) in [#&#8203;4634](https://github.com/LuckyPennySoftware/AutoMapper/pull/4634) - ci: publish fork-PR test reports via workflow\_run by [@&#8203;jbogard](https://github.com/jbogard) in [#&#8203;4643](https://github.com/LuckyPennySoftware/AutoMapper/pull/4643) - Run license validation off the construction path (fixes [#&#8203;4640](https://github.com/LuckyPennySoftware/AutoMapper/issues/4640)) by [@&#8203;jbogard](https://github.com/jbogard) in [#&#8203;4645](https://github.com/LuckyPennySoftware/AutoMapper/pull/4645) #### New Contributors - [@&#8203;Nit8](https://github.com/Nit8) made their first contribution in [#&#8203;4634](https://github.com/LuckyPennySoftware/AutoMapper/pull/4634) **Full Changelog**: <https://github.com/LuckyPennySoftware/AutoMapper/compare/v15.1.1...v16.2.0> ### [`v16.1.1`](https://github.com/LuckyPennySoftware/AutoMapper/releases/tag/v16.1.1) #### What's Changed - Better async handling of license validation; fixes [#&#8203;4612](https://github.com/LuckyPennySoftware/AutoMapper/issues/4612) by [@&#8203;jbogard](https://github.com/jbogard) in [#&#8203;4613](https://github.com/LuckyPennySoftware/AutoMapper/pull/4613) - More artifacts for builds (test results and SBOM) by [@&#8203;jbogard](https://github.com/jbogard) in [#&#8203;4615](https://github.com/LuckyPennySoftware/AutoMapper/pull/4615) - Update Microsoft.Sbom.DotNetTool to 4.1.5 by [@&#8203;jbogard](https://github.com/jbogard) in [#&#8203;4616](https://github.com/LuckyPennySoftware/AutoMapper/pull/4616) #### Security Fixed an issue where certain cyclic or self-referential object graphs could trigger uncontrolled recursion during mapping, potentially resulting in stack exhaustion and denial of service. Applications that process untrusted or attacker-controlled object graphs through affected mapping paths may be impacted. Users should upgrade to this release. Security advisory: GHSA-rvv3-g6hj-g44x Thanks to [@&#8203;skdishansachin](https://github.com/skdishansachin) for responsibly disclosing this issue. **Full Changelog**: <https://github.com/LuckyPennySoftware/AutoMapper/compare/v16.1.0...v16.1.1> ### [`v16.1.0`](https://github.com/LuckyPennySoftware/AutoMapper/releases/tag/v16.1.0) #### What's Changed - Add Debug and Release build configurations to slnx by [@&#8203;Copilot](https://github.com/Copilot) in [#&#8203;4590](https://github.com/LuckyPennySoftware/AutoMapper/pull/4590) - Migrating to slnx by [@&#8203;jbogard](https://github.com/jbogard) in [#&#8203;4589](https://github.com/LuckyPennySoftware/AutoMapper/pull/4589) - Allow disabling of polymorphic LINQ mapping by [@&#8203;jbogard](https://github.com/jbogard) in [#&#8203;4596](https://github.com/LuckyPennySoftware/AutoMapper/pull/4596) - Fix duplicate BOM in ServiceCollectionExtensions.cs by [@&#8203;Copilot](https://github.com/Copilot) in [#&#8203;4600](https://github.com/LuckyPennySoftware/AutoMapper/pull/4600) - Fix review feedback: double semicolon, DI condition integration test, docs example by [@&#8203;Copilot](https://github.com/Copilot) in [#&#8203;4601](https://github.com/LuckyPennySoftware/AutoMapper/pull/4601) - Adding DI-enabled conditions and pre-conditions; updated docs accordi… by [@&#8203;jbogard](https://github.com/jbogard) in [#&#8203;4599](https://github.com/LuckyPennySoftware/AutoMapper/pull/4599) - Adding support for DI-enabled destination factories. by [@&#8203;jbogard](https://github.com/jbogard) in [#&#8203;4603](https://github.com/LuckyPennySoftware/AutoMapper/pull/4603) - Correctly converting nullables for MapAtRuntime; fixes [#&#8203;4597](https://github.com/LuckyPennySoftware/AutoMapper/issues/4597) by [@&#8203;jbogard](https://github.com/jbogard) in [#&#8203;4604](https://github.com/LuckyPennySoftware/AutoMapper/pull/4604) - Correctly handling consecutive uppercase characters; fixes [#&#8203;4593](https://github.com/LuckyPennySoftware/AutoMapper/issues/4593) by [@&#8203;jbogard](https://github.com/jbogard) in [#&#8203;4605](https://github.com/LuckyPennySoftware/AutoMapper/pull/4605) - Wrapping the exception to provide better feedback to the user; fixes … by [@&#8203;jbogard](https://github.com/jbogard) in [#&#8203;4606](https://github.com/LuckyPennySoftware/AutoMapper/pull/4606) - Fixing bug around order of open generic registration by [@&#8203;jbogard](https://github.com/jbogard) in [#&#8203;4607](https://github.com/LuckyPennySoftware/AutoMapper/pull/4607) - Adding perpetual licensing by [@&#8203;jbogard](https://github.com/jbogard) in [#&#8203;4608](https://github.com/LuckyPennySoftware/AutoMapper/pull/4608) #### New Contributors - [@&#8203;Copilot](https://github.com/Copilot) made their first contribution in [#&#8203;4590](https://github.com/LuckyPennySoftware/AutoMapper/pull/4590) **Full Changelog**: <https://github.com/LuckyPennySoftware/AutoMapper/compare/v16.0.0...v16.1.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4zLjUiLCJ1cGRhdGVkSW5WZXIiOiI0My4zLjUiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=-->
renovateBot added 1 commit 2026-09-18 08:16:01 +00:00
Update dependency AutoMapper to 16.2.0
All checks were successful
Main Build Process / Build & Test (pull_request) Successful in 53s
Details
1960447952
gitea-actionsbot commented 2026-09-18 08:19:39 +00:00
Copy Link

Code Coverage

Package Line Rate Branch Rate Complexity Health
LittleTown.Core 91% 93% 88 ✔
LittleTown.StaticDataAccess 100% 100% 10 ✔
Summary 92% (147 / 159) 93% (56 / 60) 98 ✔

📊 Rapport HTML complet

![Code Coverage](https://img.shields.io/badge/Code%20Coverage-92%25-success?style=flat) Package | Line Rate | Branch Rate | Complexity | Health -------- | --------- | ----------- | ---------- | ------ LittleTown.Core | 91% | 93% | 88 | ✔ LittleTown.StaticDataAccess | 100% | 100% | 10 | ✔ **Summary** | **92%** (147 / 159) | **93%** (56 / 60) | **98** | ✔ 📊 [Rapport HTML complet](https://docs.borealian.ovh/workspace/mcmuzzle//LittleTown/44/coverage-report/index.html)
renovateBot force-pushed renovate/automapper-16.x from 1960447952 to 6a6b27b68b 2026-11-11 21:04:14 +00:00 Compare
renovateBot changed title from Update dependency AutoMapper to 16.2.0 to Update dependency AutoMapper to 16.3.0 2026-11-11 21:04:15 +00:00
gitea-actionsbot commented 2026-11-11 21:13:09 +00:00
Copy Link

Code Coverage

Package Line Rate Branch Rate Complexity Health
LittleTown.Core 91% 93% 88 ✔
LittleTown.StaticDataAccess 100% 100% 10 ✔
Summary 92% (147 / 159) 93% (56 / 60) 98 ✔

📊 Rapport HTML complet

![Code Coverage](https://img.shields.io/badge/Code%20Coverage-92%25-success?style=flat) Package | Line Rate | Branch Rate | Complexity | Health -------- | --------- | ----------- | ---------- | ------ LittleTown.Core | 91% | 93% | 88 | ✔ LittleTown.StaticDataAccess | 100% | 100% | 10 | ✔ **Summary** | **92%** (147 / 159) | **93%** (56 / 60) | **98** | ✔ 📊 [Rapport HTML complet](https://docs.borealian.ovh/workspace/mcmuzzle//LittleTown/44/coverage-report/index.html)
All checks were successful
Main Build Process / Build & Test (pull_request) Successful in 46s
Required
Details
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin renovate/automapper-16.x:renovate/automapper-16.x
git checkout renovate/automapper-16.x
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
Kind/Breaking
Breaking change that won't be backward compatible
 Kind/Bug
Something is not working
 kind/devops
Kind/Documentation
Documentation changes
 Kind/Enhancement
Improve existing functionality
 Kind/Feature
New functionality
 Kind/Security
This is security issue
 Kind/Testing
Issue or pull request related to testing
Priority
Critical
The priority is critical
Priority
High
The priority is high
Priority
Low
The priority is low
Priority
Medium
The priority is medium
Reviewed
Confirmed
Issue has been confirmed
Reviewed
Duplicate
This issue or pull request already exists
Reviewed
Invalid
Invalid issue
Reviewed
Won't Fix
This issue won't be fixed
Status
Abandoned
Somebody has started to work on this but abandoned work
Status
Blocked
Something is blocking this issue or pull request
Status
Need More Info
Feedback is required to reproduce issue or to continue work
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
renovateBot mcmuzzle
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mcmuzzle/LittleTown#44
Delete Branch "renovate/automapper-16.x"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?