Bump Tmds.DBus from 0.21.2 to 0.92.0

[dependabot]

Updated Tmds.DBus from 0.21.2 to 0.92.0.

Release notes

Sourced from Tmds.DBus's releases.

0.92.0

This release addresses vulnerabilities from malicious senders in Tmds.DBus and Tmds.DBus.Protocol:

• Check the signal sender is the owner of the well-known name (fb41b95, b429873)
• Prevent spilling of unix fds to the next message and limit the number to 16 per message (4800917, f90642d)
• Prevent unhandled exceptions on SynchronizationContext due to a malformed body sent by a malicious sender. (f0d9d0b, a64b8b9)

Advisory: GHSA-xrw6-gwf8-vvr9

0.91.1

Tmds.DBus.Generator/Tmds.DBus.Tool:

• ProtocolGenerator: fix alignment when reading structs. (ProtocolGenerator: fix alignment when reading structs. tmds/Tmds.DBus#422)

0.91.0

Changes:

• Protocol: SignatureReader: mark type as Obsolete and remove dead code. (Protocol: SignatureReader: mark type as Obsolete and remove dead code. tmds/Tmds.DBus#416)

Bug fixes/improvements:

• Protocol: change send message methods to be void instead of ValueTask. (Protocol: change send message methods to be void instead of ValueTask. tmds/Tmds.DBus#404)
• Protocol: Reader: fix ReverseDoubleEndianness returning unreversed value on pre-.NET8 targets. (Reader: fix ReverseDoubleEndianness returning unreversed value on pre-.NET8 targets. tmds/Tmds.DBus#407)
• Protocol.Reader: limit array sizes to D-Bus max array length (64 MiB). (Protocol.Reader: limit array sizes to D-Bus max array length (64 MiB). tmds/Tmds.DBus#408)
• Protocol.Message: skip unknown header fields. (Protocol.Message: skip unknown header fields. tmds/Tmds.DBus#409)
• Protocol: enforce D-Bus max message length (128 MiB) (Protocol: enforce D-Bus max message length (128 MiB) tmds/Tmds.DBus#410)
• Fix DBusType.Signature alignment from 4 to 1. (Fix DBusType.Signature alignment from 4 to 1. tmds/Tmds.DBus#411)
• Protocol: AddressReader: fix Unescape and TryGetNext off-by-one errors. (Protocol: AddressReader: fix Unescape and TryGetNext off-by-one errors. tmds/Tmds.DBus#412)
• Protocol: DBusAddress: improve resource cleanup for X11/Windows, refactor system/session address initialization. (Protocol: DBusAddress: improve resource cleanup for X11/Windows, refactor system/session address initialization. tmds/Tmds.DBus#413)
• Protocol: Reader: enforce max recursion depth (64) when reading variant values. (Protocol: Reader: enforce max recursion depth (64) when reading variant values. tmds/Tmds.DBus#415)
• Protocol: Reader: ensure ReadSpan throws DBusReadException when null terminator byte is missing. (Protocol: Reader: ensure ReadSpan throws DBusReadException when null terminator byte is missing. tmds/Tmds.DBus#414)
• Protocol: Array/Struct/Dict: fix check for unsupported composite types. (Protocol: Array/Struct/Dict: fix check for unsupported composite types. tmds/Tmds.DBus#418)
• Protocol: VariantValue: fix GetDictionaryEntry type check, fix GetStructFieldType out-of-bounds check. (Protocol: VariantValue: fix GetDictionaryEntry type check, fix GetStructFieldType out-of-bounds check. tmds/Tmds.DBus#417)
• Protocol: MessageWriter: use Unsafe.SizeOf for JIT constant size. (Protocol: MessageWriter: use Unsafe.SizeOf for JIT constant size. tmds/Tmds.DBus#419)
• Protocol: PathNodeDictionary: simplify batch RemoveMethodHandlers. (Protocol: PathNodeDictionary: simplify batch RemoveMethodHandlers. tmds/Tmds.DBus#420)

0.90.3

• Revert the 0.90.0 change that passes reader/handler exceptions back to the handler. (Revert the 0.90.0 change that passes reader/handler exceptions back to the handler. tmds/Tmds.DBus#403)

0.90.2

Tmds.DBus.Generator/Tmds.DBus.Tool:

• ProtocolGenerator: fix codegen causing (string?)null-conversion instead of returning default(ObjectPath?) for ObjectPath properties. (ProtocolGenerator: fix codegen causing (string?)null-conversion instead of returning default(ObjectPath?) for ObjectPath properties. tmds/Tmds.DBus#402)

0.90.1

Tmds.DBus.Generator:

• Lower expected version of Microsoft.CodeAnalysis.CSharp to 4.12.0 (Downgrade Microsoft.CodeAnalysis.CSharp to version 4.12.0 tmds/Tmds.DBus#400)

0.90.0

Tmds.DBus.Protocol

This release does some refactoring which requires changes from the user. The version is binary compatible with the previous version. Obsolete attributes indicate what changes a user should make.

• These types have been renamed to be less generic:

`Connection` -> `DBusConnection` (https://github.com/tmds/Tmds.DBus/pull/373)
`Address` -> `DBusAddress` (https://github.com/tmds/Tmds.DBus/pull/372)
`ActionException` -> `ObserverHandler` (https://github.com/tmds/Tmds.DBus/pull/371)

When you have code that requires the Connection type, you can call DBusConnection.AsConnection().

• The exception types have been refactored. A base type is introduced for connection related errors, and one for errors related to a received message. These base types also share a common base. (Protocol: refactor exception types. tmds/Tmds.DBus#370, Protocol: add DBusReaderException and throw it when the Read operation and data being read mismatch. tmds/Tmds.DBus#385, Protocol: add DBusReplyException that deprecates ProtocolException, and which serves as a base for DBusReplyException (previously: DBusException/DBusMethodException). tmds/Tmds.DBus#386, Protocol: fiddle with the exception types a bit more. tmds/Tmds.DBus#387).

DBusExceptionBase
├── DBusConnectionException
│   ├── DBusConnectionClosedException
│   │   └── DisconnectedException (obsolete -> DBusConnectionClosedException)
│   └── DBusConnectFailedException
│       └── ConnectException (obsolete -> DBusConnectFailedException)
└── DBusMessageException
    ├── DBusReadException
    ├── DBusErrorReplyException
    │   └── DBusException (obsolete -> DBusErrorReplyException)
    └── DBusUnexpectedValueException
        └── ProtocolException (obsolete -> DBusUnexpectedValueException)

Behavioral changes:

• The Reader throws DBusReadException when the message body and the read operations mismatch. When trying to read a handle that was already read, it throws DBusUnexpectedValueException. (Protocol: add DBusReaderException and throw it when the Read operation and data being read mismatch. tmds/Tmds.DBus#385, Protocol: throw DBusUnexpectedValueException instead of InvalidOperationException when handle was already read. tmds/Tmds.DBus#399)
• When an observer reader/handler throws, we stop observing and pass the exception to the handler. (Protocol: when reader/handler throw, stop observing and pass the exception to the handler. tmds/Tmds.DBus#395)
• Message.SignatureAsString return an empty string when the signature header is omitted. (Protocol: Message: make SignatureAsString return an empty string when the header is omitted. tmds/Tmds.DBus#384)
• Reader.ReadHandle methods return a non-null handle to avoid user having to do null-handling. (Protocol: make ReadHandle methods return a non-null handle to avoid user having to do null-handling. tmds/Tmds.DBus#364)

New APIs:

• A new DBusService type represents a peer reachable via the connection. (Protocol: add DBusService type which represents a named connection. tmds/Tmds.DBus#374)
• A new DBusObject type may be used as a base class for proxy classes. (Protocol: add a DBusObject base class. Add connection methods for watching signals and property changes. tmds/Tmds.DBus#376)
• A new SkipSafeHandle type may be used with the Reader.ReadHandle/VariantValue.ReadHandle method to indicate a handle should not be read. This enables letting the user decide to skip reading the handle or not through what generic argument they are passing. (Protocol: add SkipSafeHandle class as a way to skip reading handles so other readers can still consume them. tmds/Tmds.DBus#363)
• New methods are added to DBusConnection for watching signals and property changes. (Protocol: add a DBusObject base class. Add connection methods for watching signals and property changes. tmds/Tmds.DBus#376)

Tmds.DBus.Generator

• This new package provides a Roslyn source generator that performs code generation for the Tmds.DBus.Protocol API. Only proxies are supported. (Add Tmds.DBus.Protocol.SourceGenerator: a source generator for the Protocol library. tmds/Tmds.DBus#378)

Documentation

... (truncated)

0.23.0

Tmds.DBus.Protocol:

• Protocol: add hierarchical path support and improved async handling for method handling. (#​360)
• Protocol: use non-blocking SynchronizationContext.Post instead of Send for callbacks. (#​361)

0.22.0

Tmds.DBus:

• Fix libX11 library name. (Fix libX11 library name. tmds/Tmds.DBus#353)

Tmds.DBus.Protocol:

• Use .NET 9 System.Threading.Lock (Use .NET 9 System.Threading.Lock. tmds/Tmds.DBus#331)
• Fix libX11 library name. (Fix libX11 library name. tmds/Tmds.DBus#353)
• Remove obsolete APIs (Protocol: Remove obsolete code tmds/Tmds.DBus#355)
• Add request/release name APIs (Protocol: add request/release name APIs (similar to those of Tmds.DBus). tmds/Tmds.DBus#356)

Tmds.DBus.Tool:

• codegen: remove unused invalidated list (Protocol: remove unused invalidated list tmds/Tmds.DBus#334)

0.21.3

This release backports the fixes from 0.92.0 to Tmds.DBus.Protocol.

Advisory: GHSA-xrw6-gwf8-vvr9

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.