Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/Tools/Cli/DINOForge.Tools.Cli.csproj
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@
<PackageReference Include="Microsoft.Data.Sqlite" Version="8.*" />

<!-- Error tracking -->
<PackageReference Include="Sentry" Version="4.11.0" />
<PackageReference Include="Sentry" Version="6.7.0" />

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CRITICAL: Bumping Sentry 4.x → 6.x introduces a new transitive dependency (k4os.compression.lz4 via blake3) that Socket for GitHub has flagged as a HIGH-severity license policy violation. This brings an unapproved license into the project's dependency graph.

Sentry itself is unused code — no Sentry.* API calls exist anywhere in the C# codebase. The cleanest resolution is to remove this PackageReference entirely rather than upgrade it, which also eliminates the transitive license violation.

If Sentry error tracking is genuinely needed, verify the license policy with your security team before merging, and audit the Sentry 4→6 migration guide for any breaking API changes.

Fix these issues in Kilo Cloud


Reply with @kilocode-bot fix it to have Kilo Code address this issue.


<!-- System.Drawing for screenshot capture -->
<PackageReference Include="System.Drawing.Common" Version="8.*" />
Expand Down
44 changes: 25 additions & 19 deletions src/Tools/Cli/packages.lock.json
Original file line number Diff line number Diff line change
Expand Up @@ -5,10 +5,10 @@
"Microsoft.Data.Sqlite": {
"type": "Direct",
"requested": "[8.*, )",
"resolved": "8.0.27",
"contentHash": "qlS+YrntAGokJdNNU9iEbf1cjhUw82xspqWq1J4haGrUk800HqHid5q9/dfkLGxNGYubT/MysPoIbo364et20Q==",
"resolved": "8.0.29",
"contentHash": "UT01MJBITsT5CFLK9bhYWjz847BHlC2em7nhBNCCSYsI72mIzrXHfrQT8R+huQKJGZo94/a9GWGzKPn7mmlMyw==",
"dependencies": {
"Microsoft.Data.Sqlite.Core": "8.0.27",
"Microsoft.Data.Sqlite.Core": "8.0.29",
"SQLitePCLRaw.bundle_e_sqlite3": "2.1.6"
}
},
Expand Down Expand Up @@ -101,6 +101,12 @@
"Microsoft.SourceLink.Common": "8.0.0"
}
},
"MinVer": {
"type": "Direct",

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

WARNING: MinVer appears as type: "Direct" in the lockfile, meaning it ships in the application's runtime dependency graph. MinVer is a build-time-only MSBuild package for deriving assembly versions from git tags — it has no runtime purpose and should not be a Direct dependency.

No corresponding <PackageReference Include="MinVer" .../> exists in the csproj, making this entry anomalous. If MinVer is being pulled in via MSBuild targets integration, it should be marked with PrivateAssets="all" or excluded from the lockfile's Direct set. Shipping it as a runtime dependency inflates the output and widens the attack surface unnecessarily.

Fix these issues in Kilo Cloud


Reply with @kilocode-bot fix it to have Kilo Code address this issue.

"requested": "[7.*, )",
"resolved": "7.0.0",
"contentHash": "2lMTCQl5bGP4iv0JNkockPnyllC6eHLz+CoK2ICvalvHod+exXSxueu9hq+zNkU7bZBJf8wMfeRC/Edn8AGmEg=="
},
"ScreenRecorderLib": {
"type": "Direct",
"requested": "[6.6.0, )",
Expand All @@ -109,9 +115,9 @@
},
"Sentry": {
"type": "Direct",
"requested": "[4.11.0, )",
"resolved": "4.11.0",
"contentHash": "uIWfs/AH8lq2lW3P0K7oOvOoja1HZpKA7TIwWHdHDNq2fRV3I6AwIJQtOqrB61dXqI+7zwo6DCMkYF/vY9HZwA=="
"requested": "[6.7.0, )",
"resolved": "6.7.0",
"contentHash": "fE8rXrzo1xZrKYtvSxDcww7ZLJbB4t+pZK748zrS5ctFo4L0sNNEkRDkJ6smSGwe0kpDRBQn4bQHPrvUOmzUaA=="
},
"SketchFabApi.Net": {
"type": "Direct",
Expand All @@ -127,23 +133,23 @@
"Spectre.Console": {
"type": "Direct",
"requested": "[0.*, )",
"resolved": "0.55.2",
"contentHash": "yc0g12YJpmZHofGJLTQX02/uqfzJ6XHRx6pe9rANNjleQptXMHPxD9KI2/DWkXiJWddc+4oizEdGox15c89hhw==",
"resolved": "0.57.2",
"contentHash": "wzsB+P9i6F9G+cFOJxRotCiQWNSzZVAMxi8YMiHlGXXU1JLMXGp7zSSqBMmROZS2bzpK5jk+Saa7Evp8HwqhKg==",
"dependencies": {
"Spectre.Console.Ansi": "0.55.2"
"Spectre.Console.Ansi": "0.57.2"
}
},
"System.CommandLine": {
"type": "Direct",
"requested": "[2.*, )",
"resolved": "2.0.8",
"contentHash": "FbpgF8p/ClXnoXEWLjQB34kNh5rsLewEgIgLyVzLDucAOQ4cNs7ec9Cam7gdKPruSb6zp4Mx8htZGTL4/5PJPg=="
"resolved": "2.0.10",
"contentHash": "6i1D6/U3i1f/PiXTt9pDvbJwdXEe0F2DZPup6BHzeIu5yPk/lkFzgtrJnPbj54JWUh8Y9vJeKG/TZIT6MkF8TA=="
},
"System.Drawing.Common": {
"type": "Direct",
"requested": "[8.*, )",
"resolved": "8.0.27",
"contentHash": "G/4T2mE+RElzXxHO+PdCngA2lEjGbZvEMyfsFjZHZXROdbI6n5AQC3LHcTKJ2wTHILf4U5eA5zF/ili0YAj+BQ==",
"resolved": "8.0.29",
"contentHash": "sJZ5BBGGRU8rnVYeaeolaaYQg9grIixN/lZvr3mzJAygZKFiW/v8qdD28EO+ZccWLl2yjLQSz3jgeApJLnhoEA==",
"dependencies": {
"Microsoft.Win32.SystemEvents": "8.0.0"
}
Expand Down Expand Up @@ -178,8 +184,8 @@
},
"Microsoft.Data.Sqlite.Core": {
"type": "Transitive",
"resolved": "8.0.27",
"contentHash": "xdTCV/0Mmx1TV9O7gyvRtyQFBtoMVwVWUn6p4W++u2AENEOugIApAaCY6wYr894UPJBwIv3ChyVVOJ9joo9dXw==",
"resolved": "8.0.29",
"contentHash": "B/7Z0la03kNVdmZtgSN/PocA2nsPiVUq56iCh25oW8W31Yzg1ofrMWy79i0DcDOXuHjy7+jlsUlSNytwe9Et5A==",
"dependencies": {
"SQLitePCLRaw.core": "2.1.6"
}
Expand Down Expand Up @@ -349,8 +355,8 @@
},
"Serilog": {
"type": "Transitive",
"resolved": "4.3.1",
"contentHash": "savYe7h5yRlkqBVOwP8cIRDOdqKiPmYCU4W87JH38sBmcKD5EBoXvQIw6bNEvZ/pTe1gsiye3VFCzBsoppGkXQ=="
"resolved": "4.4.0",
"contentHash": "ZC6Le3rr4TVJJjS4KsQAesxeF1EhW9qcZmmG7eP5Y2G3+gTGkJEUXkq4+tZNPtyp05I0wWOxnIjwtxFweJsObw=="
},
"Serilog.Sinks.Console": {
"type": "Transitive",
Expand All @@ -370,8 +376,8 @@
},
"Spectre.Console.Ansi": {
"type": "Transitive",
"resolved": "0.55.2",
"contentHash": "tN3KEJQQZwLW9HJnG5YTSAxfBwxsmg1wVuGvhGG2rM+pbl+NGaHU8pDcNofPlOXlgpkbpBMxI5t9o9qPfy3sHQ=="
"resolved": "0.57.2",
"contentHash": "Y1+u73shwP+JYHmrkdN6bSt2kaGBEAafhi2nrecczbXdFRey+k7J/WF9YPfcB0rqivv2S8fmif6FSBq9m/AFvw=="
},
"SQLitePCLRaw.bundle_e_sqlite3": {
"type": "Transitive",
Expand Down