docs(dnn): #131 Step 0 — DNN 10.3.2 runtime VERIFIED .NET Framework 4.8 - #514
Merged
Merged
Conversation
…ework 4.8 Step 0 of the §7 staircase (PR #511) confirmed via primary-source artifact: DotNetNuke.Core 10.3.2 .nupkg ships lib/net48/DotNetNuke.dll as its ONLY target framework folder (no lib/net8.0/). The compiled binary declares .NET Framework 4.8 — same runtime as installed DNN 9.11.1.19 (web.config targetFramework="4.8"). No .NET-8 jump. Method (nupkg lib/ inspection) is strictly stronger than the plan's original 'stand up install + check web.config' — a running web.config value is hand-editable; the lib/net48/ folder is compiler-produced. Consequence (decision-relevant for jsboige): - OpenStore / NBrightBuy 4.1.11 blocker DISSOLVES (was predicated on 'DNN 10.x = .NET 8, no .NET 8 port' — premise now falsified). - Re-opens Stripe Native (#445) decision for jsboige (business call, worker signals, does not overturn). - Corroborated by DNN requirements doc + all 13 DNN 10.3.2 NuGet packages + 2sxc v21 module-compat proof (DNN 10.02.1). Step 0 = GO. Next (on jsboige go): Step 1 = 9.11.1 -> 9.13.x (closes CVE-2025-64095 only; CVE-2025-52488 needs 10.0.1+ = Step 3). Sandbox/research only — no prod deploy. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
jsboige
added a commit
that referenced
this pull request
Jun 17, 2026
…CVEs, target 10.1.2 (#520) Anti-fabrication catch: authoritative NVD + official GHSA advisories disprove a claim in the merged v2 plan (#511 §2/§7 Step 1) and Step 0 doc (#514): 'CVE-2025-64095 patched in 9.13.x' is WRONG — it is patched in 10.1.1. Authoritative CVE map (NVD + GHSA, machine-verified 2026-06-17): - CVE-2025-64095 (unauth file upload, CVSS 10.0 CRITICAL S:C) -> patched 10.1.1 (GHSA-3m8r-w7xg-jqvw). More severe than v2 plan stated (9.8). - CVE-2025-52488 (NTLM hash leak, CVSS 8.6 HIGH) -> patched 10.0.1 (GHSA-mgfv-2362-jq96). => The 9.13.x palier (latest 9.13.9) closes ZERO of the 2 CVEs, not 1. Newly-surfaced 2sxc compat cliff (issue #6902, OPEN): DNN 10.2.0+ breaks 2sxc via DnnJsInclude (full IIS crash). Argumentum runs 2sxc 15.02 (predates the >=v21 workaround) -> 10.2.x+ requires a 2sxc upgrade. The CVE targets (10.0.1, 10.1.2) are BEFORE 10.2.0 -> safe from the cliff. Refined target: 10.1.2 = closes BOTH CVEs + before 2sxc cliff (no 2sxc/template rework) = pragmatic security stop. 9.13.9 = optional migration stepping-stone only (0 CVEs). 10.2.x-10.3.2 (latest) = optional, needs 2sxc upgrade + audit. Reframes jsboige decision: 'stop at 10.1.2 (least disruption)' vs 'go 10.3.2 latest (needs 2sxc work)'. #445 re-decision unchanged. Sandbox/research only — no prod deploy. Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
42 tasks
jsboige
added a commit
that referenced
this pull request
Jun 17, 2026
…522) Prep/runbook only — execution GATED on jsboige target decision (10.1.2 vs 10.3.2, #520). Extends plan v2 (#511) + Step 0 (#514) + CVE refinement (#520). Repo-grounded: sandbox baseline (9.11.1.19, net48, 2sxc 15.02, 4 bespoke .cshtml, Glossary3 14.09.00, IIS :8090), Argumentum-specific risk register (2sxc cliff @10.2.0+ = issue #6902), per-stage go/no-go, rollback readiness. Honesty boundary flagged: generic DNN upgrade-wizard mechanics (§4) NOT verified vs official guide this session (tooling outage) — must confirm before execution. No prod deploy, no CSV/taxonomy/dnn-ui-strings touch. Visual verdict = ai-01 (worker signals). Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
jsboige
added a commit
that referenced
this pull request
Jun 18, 2026
…5→≥21 (jsboige decision #2) (#531) jsboige interactive decision #2 (issue #458, 2026-06-18): "Je suis pour l'upgrade complète, même si c'est plus lourde" → target = 10.3.2-latest + 2sxc 15→≥21 + template audit. Supersedes the 10.1.2 target of #520/#522/ #527/#528. #445 Stripe Native unblocked (OpenStore blocker dissolved). Net-new decision-spec (131-target-revision-10.3.2-full-upgrade.md, +141): - The 6-phase go-live procedure (#527) + rollback contract + .NET 4.8 runtime finding remain valid; only target + 2sxc scope change. - 2sxc upgrade path: 15.02 → 21.07 LTS on DNN 9.11.1 (2sxc-first), then DNN → 10.3.2. Adds new Phase 1.5 + expanded Phase 3/4 (content migration is now real, unlike the 10.1.2 no-op). - KEY GROUNDED FINDING (§3): the template audit is largely ALREADY DONE. All 4 Argumentum custom templates already use @inherits Custom.Hybrid.Razor14 (verified, not asserted) — the legacy RazorComponent migration #131 flagged is complete. APIs in use (App.Query, AsList, CmsContext, Link.To, Edit.TagToolbar) all maintained in 2sxc 21. Residual risk is the 25 stock apps' v20 infra changes (staging-test item, not repo-audit). Superseded banners added to the 4 target-bearing runbooks pointing to the new decision-spec as source of truth (#520, #522, #527 §4 "no 2sxc migration" explicitly invalidated, #511 errata redirected). No merged history rewritten. Doc-only, non-gated. Execution (deploy/upgrade/2sxc) stays GATED jsboige. No prod mutation, no DB/RDP, no template edit. Refs #131 #458 #445 #514 #520 #522 #527 #528. Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Step 0 result — §7 staircase (companion to PR #511, merged)
Executes Step 0 of the §7 staircase from the v2 plan (#511): confirm the DNN 10 runtime. Verdict: GO.
The finding (primary source)
DotNetNuke.Core10.3.2.nupkgshipslib/net48/DotNetNuke.dll(2.9 MB, the core DNN assembly) as its only target-framework folder — nolib/net8.0/. The compiled binary declares .NET Framework 4.8, the same runtime as the installed DNN 9.11.1.19 (web.configtargetFramework="4.8"). There is no .NET-8 jump.Why this method is authoritative
The v2 plan's Step 0 action was "stand up an install + check
web.config." This substitutes nupkglib/inspection, which is strictly stronger: a runningweb.configvalue is hand-editable intent; thelib/net48/folder is compiler-produced (from the.csproj<TargetFramework>), no human-edit step. Pure read of the published artifact — no install/DB/IIS. Fully within "sandbox/research only."Decision-relevant consequences (for jsboige)
UPGRADE-ASSESSMENT.mdpredicated it on "DNN 10.x = .NET 8 → no .NET 8 port." Premise falsified: DNN 10.x is .NET Framework 4.8; NBrightBuy 4.1.11 (.NET Framework) targets the same runtime. No framework port required.Next (on jsboige go)
Step 1 = 9.11.1 → 9.13.x (closes CVE-2025-64095, CVSS 9.8). Note: 9.13.x does not close CVE-2025-52488 (NTLM, patched 10.0.1 only) — full closure needs Step 3. jsboige's security-palier target (v2 plan §8 Q1) remains the gating decision.
Scope: doc-only. No code, no CSV, no deploy.
🤖 Generated with Claude Code