From a20ca49311c37dee68b7d2429c1b6c71987e33ac Mon Sep 17 00:00:00 2001 From: Danny Rorabaugh Date: Wed, 21 Oct 2026 14:24:16 -0400 Subject: [PATCH 1/2] Update SIL.*Tasks to 4.0.0 and fix restore against libpalaso 18.0.0 The floating 18.0.0-* libpalaso references started resolving to stable 18.0.0, whose minimums for L10NSharp, icu.net, System.Resources.Extensions and NUnit are above what Chorus pinned, so restore failed with NU1605. Raise those pins and pin libpalaso to 18.0.0. L10NSharp 11 no longer pulls in System.ServiceModel, so Chorus references it directly. Security: System.ServiceModel.Primitives 4.8.1 -> 10.1.0 drops the vulnerable System.Security.Cryptography.Xml chain from LibChorus's netstandard2.0 graph (4.10.x and 8.x still carry vulnerable versions). NuGet.CommandLine 6.7.0 -> 6.14.3 in l10n.proj (GHSA-68w7-72jg-6qpp). l10n.proj referenced a nonexistent PkgGitVersion_GitVersion_MsBuild property, so its manual GitVersion import never ran (NuGet already imports those targets) and RestartBuild was always true. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 15 +++++++++++---- l10n/l10n.proj | 7 +++---- src/Chorus.Tests/Chorus.Tests.csproj | 2 +- src/Chorus/Chorus.csproj | 5 +++-- src/ChorusHub/ChorusHub.csproj | 4 ++-- src/ChorusHubApp/ChorusHubApp.csproj | 4 ++-- src/ChorusHubTests/ChorusHubTests.csproj | 2 +- src/ChorusMerge.Tests/ChorusMerge.Tests.csproj | 4 ++-- src/ChorusMerge/ChorusMerge.csproj | 2 +- .../LibChorus.IntegrationTests.csproj | 4 ++-- .../LibChorus.TestUtilities.csproj | 8 ++++---- src/LibChorus/LibChorus.csproj | 14 +++++++------- src/LibChorusTests/LibChorus.Tests.csproj | 8 ++++---- 13 files changed, 43 insertions(+), 36 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 959585b8..19ccd73d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -28,12 +28,15 @@ and this project adheres to [Semantic Versioning](http://semver.org/). - [SIL.Chorus.LibChorus] Add ChorusStorage (the bundle cache) as an Excluded folder - [SIL.Chorus.LibChorus] Changed HgResumeTransport LastKnownCommonBases to use Json serialization instead of BinaryFormatter - Update SIL.Chorus.Mercurial dependency to version 7.0.1.93 which uses Python 3 and should be faster -- Update SIL.BuildTasks build-time dependency from version 3.0.0 to 3.3.0 -- Update libPalaso dependency from version 15.0.0-* to 18.0.0-* +- Update SIL.BuildTasks build-time dependency from version 3.0.0 to 4.0.0 +- Update SIL.ReleaseTasks build-time dependency from version 3.0.0 to 4.0.0 +- Update libPalaso dependency from version 15.0.0-* to 18.0.0 - Update Newtonsoft.Json dependency from version 13.0.2 to 13.0.4 - Update Microsoft.NET.Test.Sdk dependency from version 17.3.1 to 17.14.1 -- Update icu.net dependency from version 3.0.0-* to 3.0.1 -- Update L10NSharp dependency from version 8.0.0-beta0005 to 10.0.0-* +- Update System.Resources.Extensions dependency from version 6.0.0 to 10.0.13 +- Update NUnit test dependency from version 3.13.3 to 3.14.0 +- Update icu.net dependency from version 3.0.0-* to 4.0.0 +- Update L10NSharp dependency from version 8.0.0-beta0005 to 11.0.1 - [SIL.Chorus] Remove `emailForSubmissions` argument from `LocalizationManagerWinforms.Create` call (removed in L10NSharp 10) - [SIL.Chorus.LibChorus] Read each revision's full hash from the existing `hg log` output instead of launching one `hg` process per revision to widen the short hash @@ -47,6 +50,10 @@ and this project adheres to [Semantic Versioning](http://semver.org/). - [SIL.Chorus.LibChorus] Return from each `hg` call as soon as its output ends, rather than on the next 100 ms poll, saving 30-80 ms per call +### Security + +- [SIL.Chorus.LibChorus] Update System.ServiceModel.Primitives (netstandard2.0) from version 4.8.1 to 10.1.0, dropping the vulnerable System.Security.Cryptography.Xml 4.7.0 (GHSA-vh55-786g-wjwj) from the dependency graph +- Update NuGet.CommandLine (l10n packaging build tool) from version 6.7.0 to 6.14.3 (GHSA-68w7-72jg-6qpp) ### Removed diff --git a/l10n/l10n.proj b/l10n/l10n.proj index 5b6e5f76..90526fa7 100644 --- a/l10n/l10n.proj +++ b/l10n/l10n.proj @@ -1,5 +1,4 @@ - netframework4.8 @@ -7,7 +6,7 @@ $(GitVersion_NuGetVersion) Jason Naylor SIL International - - - + + diff --git a/src/Chorus.Tests/Chorus.Tests.csproj b/src/Chorus.Tests/Chorus.Tests.csproj index 3e4d2658..312c64ee 100644 --- a/src/Chorus.Tests/Chorus.Tests.csproj +++ b/src/Chorus.Tests/Chorus.Tests.csproj @@ -12,7 +12,7 @@ - + diff --git a/src/Chorus/Chorus.csproj b/src/Chorus/Chorus.csproj index e4513243..c67c3201 100644 --- a/src/Chorus/Chorus.csproj +++ b/src/Chorus/Chorus.csproj @@ -11,8 +11,8 @@ - - + + @@ -22,6 +22,7 @@ + diff --git a/src/ChorusHub/ChorusHub.csproj b/src/ChorusHub/ChorusHub.csproj index d93125f3..6ba25785 100644 --- a/src/ChorusHub/ChorusHub.csproj +++ b/src/ChorusHub/ChorusHub.csproj @@ -13,8 +13,8 @@ - - + + diff --git a/src/ChorusHubApp/ChorusHubApp.csproj b/src/ChorusHubApp/ChorusHubApp.csproj index 65fd6dfc..84ffe679 100644 --- a/src/ChorusHubApp/ChorusHubApp.csproj +++ b/src/ChorusHubApp/ChorusHubApp.csproj @@ -11,8 +11,8 @@ - - + + diff --git a/src/ChorusHubTests/ChorusHubTests.csproj b/src/ChorusHubTests/ChorusHubTests.csproj index a6f91c7f..f2709d3c 100644 --- a/src/ChorusHubTests/ChorusHubTests.csproj +++ b/src/ChorusHubTests/ChorusHubTests.csproj @@ -12,7 +12,7 @@ - + diff --git a/src/ChorusMerge.Tests/ChorusMerge.Tests.csproj b/src/ChorusMerge.Tests/ChorusMerge.Tests.csproj index 6919befc..1c495598 100644 --- a/src/ChorusMerge.Tests/ChorusMerge.Tests.csproj +++ b/src/ChorusMerge.Tests/ChorusMerge.Tests.csproj @@ -14,9 +14,9 @@ - + - + diff --git a/src/ChorusMerge/ChorusMerge.csproj b/src/ChorusMerge/ChorusMerge.csproj index 4348af3e..a2c335c8 100644 --- a/src/ChorusMerge/ChorusMerge.csproj +++ b/src/ChorusMerge/ChorusMerge.csproj @@ -13,7 +13,7 @@ - + diff --git a/src/LibChorus.IntegrationTests/LibChorus.IntegrationTests.csproj b/src/LibChorus.IntegrationTests/LibChorus.IntegrationTests.csproj index df642835..79ead629 100644 --- a/src/LibChorus.IntegrationTests/LibChorus.IntegrationTests.csproj +++ b/src/LibChorus.IntegrationTests/LibChorus.IntegrationTests.csproj @@ -18,9 +18,9 @@ - + - + diff --git a/src/LibChorus.TestUtilities/LibChorus.TestUtilities.csproj b/src/LibChorus.TestUtilities/LibChorus.TestUtilities.csproj index 2e311485..654d7f09 100644 --- a/src/LibChorus.TestUtilities/LibChorus.TestUtilities.csproj +++ b/src/LibChorus.TestUtilities/LibChorus.TestUtilities.csproj @@ -9,10 +9,10 @@ - - - - + + + + diff --git a/src/LibChorus/LibChorus.csproj b/src/LibChorus/LibChorus.csproj index 33a00e2a..da7b8777 100644 --- a/src/LibChorus/LibChorus.csproj +++ b/src/LibChorus/LibChorus.csproj @@ -14,19 +14,19 @@ - + - + - - - + + + - - + + diff --git a/src/LibChorusTests/LibChorus.Tests.csproj b/src/LibChorusTests/LibChorus.Tests.csproj index 30987ebf..e09d2627 100644 --- a/src/LibChorusTests/LibChorus.Tests.csproj +++ b/src/LibChorusTests/LibChorus.Tests.csproj @@ -14,12 +14,12 @@ - + - - - + + + From 5ef1ec2be6f9304d1f01cc77c5ddc41cdef4d650 Mon Sep 17 00:00:00 2001 From: Danny Rorabaugh Date: Wed, 21 Oct 2026 15:19:27 -0400 Subject: [PATCH 2/2] Install SIL.BuildTasks 4.0.0 for the Chorus Hub installer ChorusHub.wixproj installs its own SIL.BuildTasks via nuget.exe for the FileUpdate task that stamps the license year, separate from the PackageReference in ChorusHub.csproj. Co-Authored-By: Claude Opus 5.5 --- src/Installer/ChorusHub.wixproj | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/Installer/ChorusHub.wixproj b/src/Installer/ChorusHub.wixproj index 64b4c63c..47ef359e 100644 --- a/src/Installer/ChorusHub.wixproj +++ b/src/Installer/ChorusHub.wixproj @@ -47,7 +47,7 @@ - 2.5.0 + 4.0.0 $(NuGetToolsPath)/packages/SIL.BuildTasks.$(SilBuildTasksVersion)/tools/SIL.BuildTasks.dll