Issue/1066 fix nu1903 finding - #1067
Open
MartinHock wants to merge 1 commit into
Open
Conversation
MartinHock
force-pushed
the
issue/1066-fixnu1903-finding
branch
from
July 19, 2026 15:15
6476a28 to
fce75f6
Compare
Contributor
Author
|
I have cleaned up the PR, shoud be OK now |
Contributor
Author
|
The PR is now reduced to one commit changing only Directory.Packages.props, and the current GitHub Actions workflow passes successfully on Ubuntu, Windows, and macOS. However, the merge is still blocked by an expected required status check named build, which is not reported by the current workflow. Could a maintainer please update the branch protection/ruleset or bypass the obsolete check? |
MartinHock
added a commit
to MartinHock/CleanArchitecture
that referenced
this pull request
Jul 21, 2026
Updated the comment explaining the exclusion of the NU1903 warning for the vulnerable transitive dependency SQLitePCLRaw.lib.e_sqlite3. The revised comment clarifies that the warning will remain visible but will not fail the build while the issue is being addressed (see issue ardalis#1066 and PR ardalis#1067). It also notes to remove the exclusion once the dependency is updated or the PR is merged. No functional code changes were made.
MartinHock
force-pushed
the
issue/1066-fixnu1903-finding
branch
from
August 17, 2026 18:40
9c1a17a to
a4bf844
Compare
There was a problem hiding this comment.
Pull request overview
This PR primarily addresses a NuGet security advisory (NU1903) by explicitly pinning and referencing a SQLitePCLRaw native bundle package, while also updating test/build tooling and applying several consistency cleanups across the solution.
Changes:
- Pin and reference
SQLitePCLRaw.bundle_e_sqlite3to address the transitive dependency security finding. - Update repo-wide testing/tooling defaults (Microsoft.Testing.Platform, CI workflow test reporting, analyzer settings).
- Apply naming/consistency updates across constants, routes, logging placeholders, and test infrastructure.
Reviewed changes
Copilot reviewed 51 out of 52 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
| tests/Clean.Architecture.UnitTests/NoOpMediator.cs | Adjusts NoOp mediator stream behavior/cancellation handling. |
| tests/Clean.Architecture.IntegrationTests/Data/EfRepositoryUpdate.cs | Updates test to use fixture DbContext accessor. |
| tests/Clean.Architecture.IntegrationTests/Data/BaseEfRepoTestFixture.cs | Adds dispose patterns and encapsulates DbContext field. |
| tests/Clean.Architecture.IntegrationTests/Clean.Architecture.IntegrationTests.csproj | Adds an additional test dependency. |
| tests/Clean.Architecture.FunctionalTests/CustomWebApplicationFactory.cs | Updates async dispose override and logging template placeholder casing. |
| tests/Clean.Architecture.FunctionalTests/Clean.Architecture.FunctionalTests.csproj | Adds additional test/container-related dependencies. |
| tests/Clean.Architecture.FunctionalTests/ApiEndpoints/ContributorList.cs | Updates SeedData constant naming usage. |
| tests/Clean.Architecture.AspireTests/Clean.Architecture.AspireTests.csproj | Updates target framework to net10.0. |
| tests/.runsettings | Introduces test runner parallelization settings. |
| tests/.editorconfig | Adds test-folder editorconfig overrides. |
| src/Clean.Architecture.Web/Contributors/Update.UpdateContributorValidator.cs | Removes unused using and updates constant naming. |
| src/Clean.Architecture.Web/Contributors/Update.UpdateContributorRequest.cs | Makes route building culture-invariant and comparison-explicit. |
| src/Clean.Architecture.Web/Contributors/Update.cs | Removes unused use case import. |
| src/Clean.Architecture.Web/Contributors/List.cs | Passes cancellation tokens through mediator/send calls; updates constant naming. |
| src/Clean.Architecture.Web/Contributors/GetById.GetContributorByIdRequest.cs | Makes route building culture-invariant and comparison-explicit. |
| src/Clean.Architecture.Web/Contributors/GetById.cs | Updates import to renamed GetContributor namespace. |
| src/Clean.Architecture.Web/Contributors/Delete.DeleteContributorRequest.cs | Makes route building culture-invariant and comparison-explicit. |
| src/Clean.Architecture.Web/Contributors/Create.cs | Passes cancellation token to mediator; removes redundant null initializer. |
| src/Clean.Architecture.Web/Configurations/MiddlewareConfig.cs | Whitespace and logging template placeholder casing updates. |
| src/Clean.Architecture.Web/Configurations/LoggerConfigs.cs | Uses invariant culture for console logging sink. |
| src/Clean.Architecture.UseCases/Contributors/Update/UpdateContributorHandler.cs | Normalizes cancellation token naming and propagation. |
| src/Clean.Architecture.UseCases/Contributors/List/ListContributorsQuery.cs | Updates constant naming for default paging. |
| src/Clean.Architecture.UseCases/Contributors/List/ListContributorsHandler.cs | Updates constant naming for default paging. |
| src/Clean.Architecture.UseCases/Contributors/GetContributor/GetContributorQuery.cs | Moves query to GetContributor namespace. |
| src/Clean.Architecture.UseCases/Contributors/Get/GetContributorHandler.cs | Updates constructor parameter naming and repository usage. |
| src/Clean.Architecture.UseCases/Constants.cs | Makes constants container static and renames constants to PascalCase. |
| src/Clean.Architecture.ServiceDefaults/Extensions.cs | Adds pragma suppression for intentional commented samples; makes path checks ordinal-ignore-case. |
| src/Clean.Architecture.Infrastructure/Email/MimeKitEmailSender.cs | Renames parameters and adjusts logging; minor formatting changes. |
| src/Clean.Architecture.Infrastructure/Email/FakeEmailSender.cs | Renames parameters and adjusts logging. |
| src/Clean.Architecture.Infrastructure/Data/SeedData.cs | Renames constants to PascalCase and updates usages. |
| src/Clean.Architecture.Infrastructure/Data/EventDispatcherInterceptor.cs | Changes domain-event check to use count rather than Any(). |
| src/Clean.Architecture.Infrastructure/Data/Config/VogenEfCoreConverters.cs | Seals generated converter partial class. |
| src/Clean.Architecture.Infrastructure/Data/Config/DataSchemaConstants.cs | Renames constants to PascalCase. |
| src/Clean.Architecture.Infrastructure/Clean.Architecture.Infrastructure.csproj | Adds explicit reference to SQLitePCLRaw.bundle_e_sqlite3. |
| src/Clean.Architecture.Core/Services/DeleteContributorService.cs | Refactors service docs/DI naming; introduces LoggerMessage delegate logging. |
| src/Clean.Architecture.Core/Interfaces/IEmailSender.cs | Renames method parameter names for clarity. |
| src/Clean.Architecture.Core/ContributorAggregate/Handlers/ContributorNameUpdatedEmailNotificationHandler.cs | Updates structured logging placeholder casing. |
| src/Clean.Architecture.Core/ContributorAggregate/Handlers/ContributorDeletedHandler.cs | Updates structured logging placeholder casing. |
| sample/tests/NimblePros.SampleToDo.FunctionalTests/NimblePros.SampleToDo.FunctionalTests.csproj | Adds an additional test dependency. |
| sample/src/NimblePros.SampleToDo.Infrastructure/NimblePros.SampleToDo.Infrastructure.csproj | Adds explicit SQLitePCLRaw native library package reference. |
| sample/src/NimblePros.SampleToDo.AspireHost/NimblePros.SampleToDo.AspireHost.csproj | Adds MessagePack dependency; normalizes XML formatting/BOM. |
| sample/Directory.Packages.props | Adds/updates package pins including SSH.NET, SQLitePCLRaw, Aspire, MessagePack. |
| MinimalClean/src/MinimalClean.Architecture.AspireHost/MinimalClean.Architecture.AspireHost.csproj | Adds MessagePack dependency. |
| MinimalClean/Directory.Packages.props | Adds several package pins and normalizes props file structure. |
| global.json | Opts into Microsoft.Testing.Platform as the test runner. |
| Directory.Packages.props | Updates central package versions; pins SQLitePCLRaw bundle; adds SSH.NET/Docker.DotNet.Enhanced; bumps xUnit packages. |
| Directory.Build.props | Enables latest analyzer level/mode; adjusts warning-as-error handling; sets net10.0. |
| Clean.Architecture.slnx | Adds solution items (gitignore, editorconfig entries). |
| .gitignore | Adds SonarQube folder and local state ignores. |
| .github/workflows/cross-platform-build-test.yml | Updates test execution/reporting and artifact upload patterns. |
| .github/dependabot.yml | Expands Dependabot config with grouping, labels, scheduling, and commit message format. |
| .editorconfig | Adds analyzer severity overrides and comments. |
Suppressed comments (3)
.github/workflows/cross-platform-build-test.yml:74
- Same issue as the unit test step:
--report-xunit-trxis not adotnet testoption; pass Microsoft.Testing.Platform report args after--(e.g.--report-trx).
run: dotnet test tests/Clean.Architecture.IntegrationTests/Clean.Architecture.IntegrationTests.csproj --configuration ${{ matrix.configuration }} --no-build --report-xunit-trx
.github/workflows/cross-platform-build-test.yml:79
- For Microsoft.Testing.Platform, report args must come after
--. Also,--filteris adotnet testoption and should remain before the--separator.
run: dotnet test tests/Clean.Architecture.FunctionalTests/Clean.Architecture.FunctionalTests.csproj --configuration ${{ matrix.configuration }} --no-build --report-xunit-trx --filter "FullyQualifiedName!~DockerAvailabilityTests"
.github/workflows/cross-platform-build-test.yml:89
- The upload glob only matches a
TestResults/folder at the repo root.dotnet testtypically writes results under each test project folder (e.g.tests/**/TestResults/**). This likely results in no artifacts being uploaded.
path: 'TestResults/**/*.trx'
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| public class NoOpMediator : IMediator | ||
| { | ||
| public async Task<IAsyncEnumerable<TResponse>> CreateStream<TResponse>(IStreamQuery<TResponse> query, CancellationToken cancellationToken = default) | ||
| public static async Task<IAsyncEnumerable<TResponse>> CreateStream<TResponse>(IStreamQuery<TResponse> query, CancellationToken cancellationToken = default) |
Comment on lines
26
to
27
| await client.DisconnectAsync(true, | ||
| new CancellationToken(canceled: true)); |
| # TRX report for detailed results | ||
| - name: Run Unit Tests (${{ matrix.configuration }}) | ||
| run: dotnet test tests/Clean.Architecture.UnitTests/Clean.Architecture.UnitTests.csproj --configuration ${{ matrix.configuration }} --no-build --verbosity normal --logger "trx" --collect:"XPlat Code Coverage" | ||
| run: dotnet test tests/Clean.Architecture.UnitTests/Clean.Architecture.UnitTests.csproj --configuration ${{ matrix.configuration }} --no-build --report-xunit-trx |
| public async ValueTask Handle(ContributorDeletedEvent domainEvent, CancellationToken cancellationToken) | ||
| { | ||
| logger.LogInformation("Handling Contributed Deleted event for {contributorId}", domainEvent.ContributorId); | ||
| logger.LogInformation("Handling Contributed Deleted event for {ContributorId}", domainEvent.ContributorId); |
Comment on lines
+151
to
+152
| // DO not force Logger Massages Delegates all everywhere | ||
| dotnet_diagnostic.CA1848.severity= none |
| <PackageVersion Include="Shouldly" Version="4.3.0" /> | ||
| <PackageVersion Include="SSH.NET" Version="2026.0.0" /> | ||
| <PackageVersion Include="SQLite" Version="3.53.4" /> | ||
| <PackageVersion Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.5" /> |
MartinHock
added a commit
to MartinHock/CleanArchitecture
that referenced
this pull request
Aug 17, 2026
Pin SQLitePCLRaw.bundle_e_sqlite3 to 3.0.3 to avoid the vulnerable transitive SQLitePCLRaw.lib.e_sqlite3 version reported by NU1903. Signed-off-by: MartinHock <10596865+MartinHock@users.noreply.github.com>
MartinHock
force-pushed
the
issue/1066-fixnu1903-finding
branch
from
August 23, 2026 16:39
a4bf844 to
9b4c235
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
There is a transitive dependency that causes a security issuue in "SQLitePCLRaw.bundle_e_sqlite3.
An explicit
fixes this