Repository navigation
Conversation
….1.12 advisories Restore on develop fails with NU1902/NU1903 (warnings as errors) on every project, so no build or PR check can pass (Chaptarr#313, Chaptarr#301). - System.Security.Cryptography.Pkcs 10.0.0 arrives transitively through MailKit/MimeKit (even the newest MimeKit asks for 10.0.0). Pin the patched 10.0.14 servicing release in Chaptarr.Core. - SixLabors.ImageSharp 3.1.12 is the last 3.1.x release. The patched 3.2.0 adds a build-time license-key check that fails Release builds without a Six Labors license key, so it is not a drop-in bump. Suppress its six advisories by URL, in a commented block, until the package is upgraded with a key or replaced. Fixes Chaptarr#313 Fixes Chaptarr#301 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GXPbRG8Geef4zMeMQgpQ8H
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Restore on
developfails on every project withNU1902/NU1903(NuGet audit warnings treated as errors). No build or PR check can pass until this is fixed. Fixes #313 and #301.A clean restore of
develop(e67374f) reports eight advisories in two packages:Changes
Directory.Packages.propsand references it fromChaptarr.Core. Same major version, anddeps.jsonnow resolves 10.0.14.SixLabors_ValidateLicense) that fails Release builds unless a Six Labors license key is configured (SixLaborsLicenseKeyor asixlabors.licfile). Debug builds only warn. I tried the bump first, and the Release build errors with "No Six Labors license found". So this PR keeps 3.1.12 and adds sixNuGetAuditSuppressentries, one per advisory URL, in a commented block marked temporary. Any new advisory will still fail the build.Follow-up for the maintainers
Getting rid of the suppressions needs one of:
That's a licensing decision, so I've left it to you.
Testing
dotnet restore src/Chaptarr.sln: no errors or warnings (before: eight advisories on every project).dotnet build src/Chaptarr.sln -c Releasefrom a clean tree: 0 errors, 0 warnings.AI disclosure
This PR was written with Claude Code, using Claude Opus 5.5 (
claude-opus-5-5,mediumeffort). I reviewed the change and the test results before submitting.🤖 Generated with Claude Code
https://claude.ai/code/session_01GXPbRG8Geef4zMeMQgpQ8H