Skip to content

chore(deps): Bump Microsoft.NET.Test.Sdk from 17.8.0 to 18.0.1#12

Open
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/nuget/IronBase.NET/src/IronBase.Tests/Microsoft.NET.Test.Sdk-18.0.1
Open

chore(deps): Bump Microsoft.NET.Test.Sdk from 17.8.0 to 18.0.1#12
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/nuget/IronBase.NET/src/IronBase.Tests/Microsoft.NET.Test.Sdk-18.0.1

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Nov 26, 2025 •
edited
Loading

Updated Microsoft.NET.Test.Sdk from 17.8.0 to 18.0.1.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

18.0.1

What's Changed

Fixing an issue with loading covrun64.dll on systems that have .NET 10 SDK installed: https://learn.microsoft.com/en-us/dotnet/core/compatibility/sdk/10.0/code-coverage-dynamic-native-instrumentation

Internal changes

Full Changelog: microsoft/vstest@v18.0.0...v18.0.1

18.0.0

What's Changed

Internal fixes and updates

17.14.1

What's Changed

Full Changelog: microsoft/vstest@v17.14.0...v17.14.1

17.14.0

What's Changed

.NET versions updated

This version of VS Test upgraded .NET to net8 and net9. All projects targeting net6.0 (or other end-of-life .NET target frameworks) should pin their version of Microsoft.NET.Test.SDK to 17.13.0, or update the projects to net8 or newer. We remain backwards compatible with previous versions of Microsoft.NET.Test.SDK. This change does NOT prevent you from:

  • Updating to the latest VS, and running tests from net6.0 test projects.
  • Updating to the latest .NET SDK, and running tests from net6.0 test projects.

It also has no impact on .NET Framework projects, where we continue targeting .NET Framework 4.6.2.

Changes

Internal version updates and fixes

New Contributors

17.14.0-preview-25107-01

What's Changed

.NET versions updated

This version of VS Test upgraded .NET to net8 and net9. All projects targeting net6.0 (or other end-of-life .NET target frameworks) should pin their version of Microsoft.NET.Test.SDK to 17.13.0, or update the projects to net8 or newer. We remain backwards compatible with previous versions of Microsoft.NET.Test.SDK. This change does NOT prevent you from:

  • Updating to the latest VS, and running tests from net6.0 test projects.
  • Updating to the latest .NET SDK, and running tests from net6.0 test projects.

It also has no impact on .NET Framework projects, where we continue targeting .NET Framework 4.6.2.

Changes

Internal version updates and fixes

Will probably revert before release:

New Contributors

Full Changelog: microsoft/vstest@v17.13.0...v17.14.0-preview-25107-01

17.13.0

What's Changed

New Contributors

Full Changelog: microsoft/vstest@v17.12.0...v17.13.0

17.12.0

What's Changed

Internal and infrastructure fixes:

Full Changelog: microsoft/vstest@v17.11.1...v17.12.0

17.11.1

What's Changed

Full Changelog: microsoft/vstest@v17.11.0...v17.11.1

17.11.0

What's Changed

New Contributors

Full Changelog: microsoft/vstest@v17.10.0...v17.11.0-release-24352-06

17.11.0-release-24373-02

What's Changed

Full Changelog: microsoft/vstest@v17.11.0-release-24352-06...v17.11.0-release-24373-02

17.11.0-release-24352-06

What's Changed

New Contributors

Full Changelog: microsoft/vstest@v17.10.0...v17.11.0-release-24352-06

17.10.0

What's Changed

And many infrastructure related changes and updates.

New Contributors

Full Changelog: microsoft/vstest@v17.9.0...v17.10.0

17.10.0-release-24177-07

What's Changed

New Contributors

And many infrastructure related changes to migrate our pipelines to common build system.

Full Changelog: microsoft/vstest@v17.10.0-preview-24080-01...v17.10.0-release-24177-07

17.10.0-preview-24080-01

What's Changed

New Contributors

Full Changelog: microsoft/vstest@v17.9.0-preview-23577-04...v17.10.0-preview-24080-01

17.9.0

What's Changed

New Contributors

Full Changelog: microsoft/vstest@v17.8.0...v17.9.0

17.9.0-release-23619-01

What's Changed

Full Changelog: microsoft/vstest@v17.9.0-preview-23577-04...v17.9.0-release-23619-01

17.9.0-preview-23577-04

What's Changed

  • Updated VSSDK.BuildTools version by @​cvpoienaru in #​4765
  • Update dump client to latest by @​nohwnd in #​4724
  • Fix staircase in logger by @​nohwnd in #​4756
  • Create a proper MSBuild ToolTask based VSTestTask by @​nohwnd in #​2702
  • Fix CPU is consumed by polling frequently when there is no subscriber by @​nohwnd, @​cvpoienaru in #​4735
  • Remove javascript in HtmlLogger by @​daveMueller in #​4744
  • Update VSIX metadata by @​nohwnd in #​4550
  • Add platform guard by @​dotMorten in #​4737

Full Changelog: microsoft/vstest@v17.9.0-preview-23531-01...v17.9.0-preview-23577-04

17.9.0-preview-23531-01

What's Changed

Full Changelog: microsoft/vstest@v17.9.0-preview-23503-02...v17.9.0-preview-23531-01

17.9.0-preview-23503-02

What's Changed

  • Remove dependency on Nuget.Frameworks by @​nohwnd in #​4693

Full Changelog: microsoft/vstest@v17.8.0-release-23468-02...v17.9.0-preview-23503-02

Commits viewable in compare view.

Dependabot compatibility score

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot @github
Copy link
Author

dependabot bot commented on behalf of github Nov 26, 2025

Labels

The following labels could not be found: dependencies, dotnet. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot bot requested a review from petitan as a code owner November 26, 2025 21:38
@dependabot dependabot bot force-pushed the dependabot/nuget/IronBase.NET/src/IronBase.Tests/Microsoft.NET.Test.Sdk-18.0.1 branch from 4f723f1 to 206af61 Compare December 8, 2025 22:32
@dependabot
chore(deps): Bump Microsoft.NET.Test.Sdk from 17.8.0 to 18.0.1
c5435c4 
---
updated-dependencies:
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/nuget/IronBase.NET/src/IronBase.Tests/Microsoft.NET.Test.Sdk-18.0.1 branch from 206af61 to c5435c4 Compare December 19, 2025 22:02
petitan added a commit that referenced this pull request Dec 21, 2025
@petitan @claude
fix(mcp): fix 13 bugs in MCP server
94e0c62 
CRITICAL:
- BUG #1: Transaction commit/rollback now uses write lock (was read lock - race condition)
- BUG #2: max_operations=0 now uses default limit (was unlimited - DoS vulnerability)
- BUG #3: switch_database acquires write lock before existence check (TOCTOU fix)
- BUG #4: API key serialization uses ? instead of unwrap (was panic risk)

HIGH:
- BUG #5: Script versioning uses optimistic locking with version check (race condition fix)
- BUG #6: API key cache logs errors instead of silent ignore
- BUG #7: Script delete checks for dependent scripts before deletion
- BUG #8: TLS key file read once into memory, no double-open
- BUG #9: Collection flags update uses write lock (was read lock)

MEDIUM:
- BUG #10: Projection validation checks values before truncating cast
- BUG #12: Script name validation added (same rules as collection names)
- BUG #13: Directory creation failures logged instead of silent ignore
- BUG #14: All unwrap/expect calls replaced with proper error handling

NOT A BUG:
- BUG #11: parking_lot::Mutex doesn't poison (verified)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
petitan added a commit that referenced this pull request Dec 21, 2025
@petitan @claude
fix(bridge): fix 12 bugs in ironbase-bridge
7326ff7 
BUG #1: Signal handler panic - .expect() replaced with graceful error handling
BUG #2: Error response body read - unwrap_or_default() replaced with proper error handling
BUG #3: JSON serialization - .ok() replaced with serialize_response() helper
BUG #4: stdout write errors - detect broken pipe and exit gracefully
BUG #5: DoS via unbounded batch - add MAX_BATCH_SIZE limit (1000)
BUG #6: DoS via response size - add MAX_RESPONSE_SIZE limit (10MB)
BUG #7: SSRF via URL parsing - use url crate for proper URL construction
BUG #8: Insecure TLS mode - add prominent warning banner
BUG #9: Notification errors silent - log notification forward errors
BUG #10: Health check sleep overflow - cap backoff to MAX_HEALTH_BACKOFF_MS
BUG #11: Empty batch allowed - reject per JSON-RPC 2.0 spec
BUG #12: Missing jsonrpc validation - validate "2.0" version field

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
petitan added a commit that referenced this pull request Dec 26, 2025
@petitan @claude
fix(mcp): security hardening - 8 vulnerability fixes
8ca12be 
Security fixes:
- #7: API key timing attack - constant-time comparison now length-independent
- #9: _system.scripts access - restricted to localhost only
- #12: RwLock poison panic - graceful error handling instead of unwrap()
- #17: Collection name validation - blocked '.' to prevent fake system collections
- #19: Admin error enumeration - generic error message prevents info disclosure
- #4: Rhai privilege escalation - blocked _system.* writes from scripts
- #6: Schema silent failure - errors now logged instead of ignored
- #15-16: Error message info leak - sanitized storage/script error messages

All 66 tests passing.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
petitan added a commit that referenced this pull request Jan 6, 2026
@petitan @claude
docs(fuzzy): document BUG #12 - lazy mode search lacks ctx support
b1fe6fb 
Known issue: search_in_file() in lazy mode does not check ExecutionContext
for cancellation/timeout. The serde Visitor pattern used for streaming
deserialization doesn't easily support periodic checks.

Risk assessment: LOW
- Fuzzy indexes typically small (field values only)
- Lazy mode only for >10MB indexes
- Outer search_with_ctx() checks during document loading

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
petitan added a commit that referenced this pull request Jan 7, 2026
@petitan @claude
fix(fuzzy): resolve timeout on large collections by raising lazy thre…
18f4ebf 
…shold and adding limit support

- Raise FUZZY_LAZY_LOAD_THRESHOLD from 16MB to 100MB
  - 76MB email subject index now loads into memory instead of streaming
  - Enables cancellation checks during search (fixes BUG #12 workaround)

- Add limit parameter to fuzzy_search_with_ctx()
  - FuzzyIndex::search_with_ctx() now accepts optional limit
  - Results sorted by similarity, then truncated to top N
  - Propagated through collection_core and MCP adapter

Performance improvement on 78K emails collection:
- Before: 60+ second timeout (lazy mode, no cancellation)
- After: 0.8 seconds (eager mode with limit=5)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
petitan added a commit that referenced this pull request Jan 14, 2026
@petitan @claude
docs(fuzzy): document BUG #12 - lazy mode search lacks ctx support
3e95c81 
Known issue: search_in_file() in lazy mode does not check ExecutionContext
for cancellation/timeout. The serde Visitor pattern used for streaming
deserialization doesn't easily support periodic checks.

Risk assessment: LOW
- Fuzzy indexes typically small (field values only)
- Lazy mode only for >10MB indexes
- Outer search_with_ctx() checks during document loading

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
petitan added a commit that referenced this pull request Jan 14, 2026
@petitan @claude
fix(fuzzy): resolve timeout on large collections by raising lazy thre…
e112e51 
…shold and adding limit support

- Raise FUZZY_LAZY_LOAD_THRESHOLD from 16MB to 100MB
  - 76MB email subject index now loads into memory instead of streaming
  - Enables cancellation checks during search (fixes BUG #12 workaround)

- Add limit parameter to fuzzy_search_with_ctx()
  - FuzzyIndex::search_with_ctx() now accepts optional limit
  - Results sorted by similarity, then truncated to top N
  - Propagated through collection_core and MCP adapter

Performance improvement on 78K emails collection:
- Before: 60+ second timeout (lazy mode, no cancellation)
- After: 0.8 seconds (eager mode with limit=5)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@petitan petitan Awaiting requested review from petitan petitan is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants