Fix #192 fallout: per-TFM DI.Abstractions alignment + S2077 pragma#197
Merged
Conversation
Dependabot's group bump (#192) flattened Microsoft.Extensions.DependencyInjection .Abstractions on the net6.0 and net8.0 targets of the shipped EntityFrameworkCore package to 10.0.9, forcing net6/net8 consumers onto the 10.x transitive floor and breaking the repo's per-TFM pinning convention (EF Core Relational stays 6/8/10). Restore net6.0 -> 6.0.0 and net8.0 -> 8.0.2 (their pre-#192 values); net10.0 keeps 10.0.0. Builds clean across all TFMs with no downgrade. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
This PR restores the intended per-target-framework (per-TFM) lower-bound dependency alignment for Microsoft.Extensions.DependencyInjection.Abstractions in the shipped Wolfgang.AuditTrail.EntityFrameworkCore package, undoing the net6/net8 flattening introduced by the Dependabot group bump in #192.
Changes:
- Set
Microsoft.Extensions.DependencyInjection.Abstractionslower bound back to 6.0.0 fornet6.0. - Set
Microsoft.Extensions.DependencyInjection.Abstractionslower bound back to 8.0.2 fornet8.0. - Leave
net10.0unchanged at 10.0.0, maintaining the existing per-TFM mapping.
#192 bumped SonarAnalyzer.CSharp 10.27 -> 10.28, which strengthened S2077 (SQL injection via string formatting) and now flags the two interpolated DROP TABLE statements in AuditSchemaInstaller.DropTablesAsync — a pre-existing failure that #192's stale Stage 2 run missed (it fires on net10 too, untouched by this branch). The identifiers are already validated (EnsureSafeIdentifier) and provider-quoted (QuoteIdentifier), and come from AuditOptions, not user input; DDL identifiers cannot be parameterized. Extend the existing EF1002 pragma to cover S2077 with that justification. AuditSchemaMigrator passes EF-generated CommandText (a plain variable, not interpolated) so S2077 doesn't fire there. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Chris-Wolfgang
changed the title
The SonarAnalyzer 10.28 bump (via #192) also flags the interpolated DELETE FROM {table} reset statements in ProviderSaveChangesBenchmarks. Table names are hardcoded provider-switch literals (no user input); extend the existing EF1002 pragma to cover S2077. Verified the full solution builds clean with --no-incremental (which exercises Sonar's symbolic-execution rules). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This was referenced Jul 5, 2026
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cleans up two pieces of collateral damage from the Dependabot group bump #192, both in the shipped
EntityFrameworkCoreproject, needed before tagging v0.1.1.1. Per-TFM DI.Abstractions alignment
#192 flattened
Microsoft.Extensions.DependencyInjection.Abstractionson net6/net8 to 10.0.9, forcing those consumers onto the 10.x transitive floor and breaking per-TFM pinning.2. S2077 pragma on schema-installer DROPs
#192 also bumped
SonarAnalyzer.CSharp10.27 → 10.28, which strengthened S2077 and now flags the two interpolatedDROP TABLEstatements inAuditSchemaInstaller— a pre-existing main breakage #192's stale Stage 2 run missed (fires on net10 too). Identifiers are already validated + provider-quoted and come fromAuditOptions, not user input; DDL identifiers can't be parameterized. Extended the existingEF1002pragma to coverS2077.Both build clean across all TFMs (incl.
--no-incrementalto exercise Sonar's symbolic-execution rules).