From e5f0be37b9260128ef5a8a7c379b78a7fcf53167 Mon Sep 17 00:00:00 2001
From: jsboige <jsboige@gmail.com>
Date: Tue, 23 Jun 2026 12:40:24 +0200
Subject: [PATCH] build: close NU1903 (AutoMapper CVE) while staying on the
 last free MIT version
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Decision jsboige 2026-06-23: keep the repo MIT-pure rather than adopt AutoMapper's
commercial dual-licensed line. 14.0.0 is the LAST free MIT version — 15.0.0+ is the
commercial line and there is NO free patched build (14.x receives no fix for
GHSA-rvv3-g6hj-g44x). "Migrate to the latest free version" is already satisfied:
14.0.0 IS the latest free version.

The advisory (CVE-2026-32933, DoS via uncontrolled recursion) is not reachable here:
the only AutoMapper Profile is a flat, acyclic ArgumentVirtue<->Fallacy map (scalar
ForMember projections only), so the vulnerable recursion path is never taken.

- MappingProfile.cs: add explicit MaxDepth(1) on both directions — mirrors the vendor's
  MaxDepth-default fix, makes the bound explicit (belt-and-suspenders, output-neutral on
  a flat map).
- .csproj: targeted <NuGetAuditSuppress> for THIS advisory only (not a blanket NoWarn),
  with a comment documenting the rationale.

Build is now fully zero-warning (CS + NU). Tests: 533 passed / 0 failed / 5 skipped
(MaxDepth(1) verified output-neutral).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .../Argumentum.AssetConverter.csproj                | 13 ++++++++++++-
 .../Entities/MappingProfile.cs                      |  9 ++++++++-
 2 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/Generation/Converters/Argumentum.AssetConverter/Argumentum.AssetConverter.csproj b/Generation/Converters/Argumentum.AssetConverter/Argumentum.AssetConverter.csproj
index 2f499ec4c..e2d523a88 100644
--- a/Generation/Converters/Argumentum.AssetConverter/Argumentum.AssetConverter.csproj
+++ b/Generation/Converters/Argumentum.AssetConverter/Argumentum.AssetConverter.csproj
@@ -39,7 +39,18 @@
     <PackageReference Include="Utf8Json" Version="1.3.7" />
     <PackageReference Include="xunit.extensibility.core" Version="2.8.1" />
   </ItemGroup>
- 
+
+  <!-- NU1903: AutoMapper 14.0.0 carries GHSA-rvv3-g6hj-g44x (DoS via uncontrolled recursion). We stay on
+       14.0.0 — the LAST free MIT version; 15.0.0+ is the commercial dual-licensed line — to keep this OSS
+       repo MIT-pure (decision jsboige 2026-06-23). The vuln is NOT reachable here: the only AutoMapper
+       Profile is a flat, acyclic map (Entities/MappingProfile.cs) with an explicit MaxDepth(1) guard, so
+       the vulnerable recursion path is never taken. No free patched version exists (14.x gets no fix), so
+       this single advisory is suppressed with justification rather than "fixed" by adopting a commercial
+       dependency. Targeted suppression (this advisory only), not a blanket NoWarn. -->
+  <ItemGroup>
+    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-rvv3-g6hj-g44x" />
+  </ItemGroup>
+
   <ItemGroup>
     <Folder Include="Data\Target\" />
     <Folder Include="Published\v1.3\" />
diff --git a/Generation/Converters/Argumentum.AssetConverter/Entities/MappingProfile.cs b/Generation/Converters/Argumentum.AssetConverter/Entities/MappingProfile.cs
index 0a4ece0bc..6f4fce377 100644
--- a/Generation/Converters/Argumentum.AssetConverter/Entities/MappingProfile.cs
+++ b/Generation/Converters/Argumentum.AssetConverter/Entities/MappingProfile.cs
@@ -24,6 +24,13 @@ public MappingProfile()
 			.ForMember(dest => dest.FamilleCamelCase, opt => opt.MapFrom(src => src.FamilyFrCamelcase))
 			.ForMember(dest => dest.Carte, opt => opt.MapFrom(src => string.IsNullOrEmpty(src.Card) ? (int?)null : int.Parse(src.Card)))
 			.ForMember(dest => dest.DecimalPath, opt => opt.MapFrom(src =>  Decimal.Parse(src.DecimalPathPadded).ToString(CultureInfo.InvariantCulture)))
-			.ReverseMap();
+			// Belt-and-suspenders for GHSA-rvv3-g6hj-g44x (DoS via uncontrolled recursion). This map is
+			// flat and acyclic — only scalar ForMember projections — so the vulnerable recursion path is
+			// never taken on AutoMapper 14.0.0 (the last free MIT version). MaxDepth(1) makes that bound
+			// explicit on both directions, mirroring the vendor's MaxDepth-default fix, so the NU1903
+			// audit suppression in the .csproj is defensible rather than blind.
+			.MaxDepth(1)
+			.ReverseMap()
+			.MaxDepth(1);
 	}
 }
\ No newline at end of file