Skip to content

Harden JSON dependency chain and enable multi-target .NET package release - #11

Merged
chsword merged 8 commits into
masterfrom
copilot/resolve-security-issues
Sep 11, 2026
Merged

chsword merged 8 commits into
masterfrom
copilot/resolve-security-issues

Conversation

Copilot AI commented Sep 10, 2026

Copy link
Copy Markdown
Contributor

This PR addresses two gaps in one pass: outdated JSON dependencies with known security exposure, and lack of a modern multi-.NET release path for ResizingClient. The change set upgrades dependency/runtime wiring and introduces a CI release flow aligned with current .NET SDKs.

  • Security dependency refresh

    • Upgraded Newtonsoft.Json to 13.0.3 in server/client package metadata.
    • Updated server assembly reference and binding redirect to 13.0.0.0 to keep runtime resolution consistent.
  • Multi-.NET client packaging

    • Migrated ResizingClient to SDK-style project format.
    • Added multi-targeting: net452, netstandard2.0, net8.0.
    • Added framework-conditional references for compatibility (System.Configuration / System.Net.Http on net452, System.Configuration.ConfigurationManager on non-net452).
  • Release automation for multiple SDK lines

    • Added GitHub Actions workflow to build with .NET 8/9/10.
    • Added tag-triggered packing/publishing path for NuGet packages.
    • Set explicit workflow token permissions (contents: read) to satisfy security policy.
  • Test project modernization (minimal scope)

    • Migrated ResizingClient.Tests to SDK-style MSTest (net8.0).
    • Replaced placeholder test with an assertion-based FormatUrl mode-token coverage case.
<!-- source/ResizingClient/ResizingClient.csproj -->
<PropertyGroup>
  <TargetFrameworks>net452;netstandard2.0;net8.0</TargetFrameworks>
</PropertyGroup>

Copilot AI linked an issue Sep 10, 2026 that may be closed by this pull request
Copilot AI and others added 2 commits September 11, 2026 00:01
Co-authored-by: chsword <274085+chsword@users.noreply.github.com>
Co-authored-by: chsword <274085+chsword@users.noreply.github.com>
Copilot AI changed the title [WIP] Fix security issues and support multiple .NET version releases Harden JSON dependency chain and enable multi-target .NET package release Sep 11, 2026
Copilot AI requested a review from chsword September 11, 2026 00:07
Co-authored-by: chsword <274085+chsword@users.noreply.github.com>
Co-authored-by: chsword <274085+chsword@users.noreply.github.com>
@chsword
chsword requested a lite review from Copilot September 11, 2026 00:29
@chsword
chsword marked this pull request as ready for review September 11, 2026 00:31

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

The net45-to-net452 project incompatibility and release gaps around package metadata and test execution must be fixed.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR refreshes JSON dependencies, modernizes ResizingClient for multi-target NuGet packaging, and adds multi-SDK GitHub Actions release automation.

Changes:

  • Upgrades Newtonsoft.Json references and binding redirects.
  • Adds net452, netstandard2.0, and net8.0 targets.
  • Modernizes tests and adds tag-based NuGet publishing.
  • Updates documentation and disables legacy AppVeyor jobs.
File summaries
File Description
source/ResizingServer/Web.config Updates the JSON binding redirect.
source/ResizingServer/ResizingServer.csproj Updates the JSON assembly reference.
source/ResizingServer/packages.config Updates the server JSON package.
source/ResizingClient/ResizingClient.csproj Adds SDK-style multi-targeting and package references.
source/ResizingClient/packages.config Updates client package metadata.
source/ResizingClient.Tests/UnitTest1.cs Adds URL mode-token assertions.
source/ResizingClient.Tests/ResizingClient.Tests.csproj Modernizes the MSTest project.
README.md Documents supported target frameworks.
appveyor.yml Disables legacy AppVeyor jobs.
.github/workflows/dotnet-ci-release.yml Adds matrix builds and NuGet publishing.
Review details
  • Files reviewed: 10/10 changed files
  • Comments generated: 4
  • Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread source/ResizingClient/ResizingClient.csproj Outdated
Comment thread .github/workflows/dotnet-ci-release.yml
Comment thread source/ResizingClient/ResizingClient.csproj
Comment thread source/ResizingClient/ResizingClient.csproj Outdated
Co-authored-by: chsword <274085+chsword@users.noreply.github.com>
Co-authored-by: chsword <274085+chsword@users.noreply.github.com>

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

ResizingServer CI validation must be restored, and the README target documentation needs correction.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (1)

appveyor.yml:12

  • These settings disable all AppVeyor build/test/deploy jobs, while the new Actions workflow only builds and tests ResizingClient. That leaves ResizingServer, including the updated Newtonsoft reference and binding redirect, without CI validation. Keep an equivalent server check or add a Windows server job before disabling the existing path.
build: off
test: off
deploy: off
  • Files reviewed: 10/10 changed files
  • Comments generated: 1
  • Review effort level: Lite

Comment thread README.md Outdated
@chsword

chsword commented Sep 11, 2026

Copy link
Copy Markdown
Owner

@copilot Fix the code for all comments in this review thread.

When a review comment includes a suggested change, apply the suggestion exactly.

Do not make changes beyond what is described in the linked review thread.

Co-authored-by: chsword <274085+chsword@users.noreply.github.com>

Copilot AI commented Sep 11, 2026

Copy link
Copy Markdown
Contributor Author

@copilot Fix the code for all comments in this review thread.

When a review comment includes a suggested change, appl...

Implemented in f32130e.

  • Corrected README target documentation to net45.
  • Restored ResizingServer CI validation by adding a Windows build-server job that restores/builds the server project and is required before pack.

@chsword
chsword added this pull request to stack #13 September 11, 2026 01:23
@chsword
chsword merged commit 1736e74 into master Sep 11, 2026
5 of 6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

解决安全问题 支持多.net 版本发布

3 participants