Skip to content

Bump AutoMapper from 12.0.1 to 16.1.1#111

Closed
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/nuget/src/backend/Atlas.Application.Alert/multi-d3ce253f09
Closed

Bump AutoMapper from 12.0.1 to 16.1.1#111
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/nuget/src/backend/Atlas.Application.Alert/multi-d3ce253f09

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Mar 15, 2026 •
edited
Loading

Updated AutoMapper from 12.0.1 to 16.1.1.

Release notes

Sourced from AutoMapper's releases.

16.1.1

What's Changed

Security

Fixed an issue where certain cyclic or self-referential object graphs could trigger uncontrolled recursion during mapping, potentially resulting in stack exhaustion and denial of service.

Applications that process untrusted or attacker-controlled object graphs through affected mapping paths may be impacted.

Users should upgrade to this release.

Security advisory: GHSA-rvv3-g6hj-g44x

Thanks to @​skdishansachin for responsibly disclosing this issue.

Full Changelog: LuckyPennySoftware/AutoMapper@v16.1.0...v16.1.1

16.1.0

What's Changed

New Contributors

Full Changelog: LuckyPennySoftware/AutoMapper@v16.0.0...v16.1.0

16.0.0

What's Changed

Full Changelog: LuckyPennySoftware/AutoMapper@v15.1.0...v16.0.0

16.0.0-beta-1

What's Changed

Full Changelog: LuckyPennySoftware/AutoMapper@v15.1.0...v16.0.0-beta-1

This release is a beta release that introduces .NET 10 support and package signing. Signed packages means going forward packages can be validated against trusted authorities that the package has been published by Lucky Penny Software and not tampered with.

15.1.0

What's Changed

New Contributors

Full Changelog: LuckyPennySoftware/AutoMapper@v15.0.1...v15.1.0

15.0.1

What's Changed

Full Changelog: LuckyPennySoftware/AutoMapper@v15.0.0...v15.0.1

This release supersedes the 15.0.0 release, reverting behavior and overloads so that the AddAutoMapper overloads separate the "scanning for maps" from the "scanning for dependencies". Unfortunately it's not really possible to combine these two together.

This also fixes a critical bug in #​4545 that does not work with .NET 4.x applications (as intended).

Because of this, the 15.0.0 will be delisted because of the breaking changes there.

15.0.0

Full Changelog: LuckyPennySoftware/AutoMapper@v14.0.0...v15.0.0

  • Added support for .NET Standard 2.0
  • Requiring license key
  • Moving from MIT license to dual commercial/OSS license

To set your license key:

services.AddAutoMapper(cfg => {
    cfg.LicenseKey = "<License key here>";
});

This also introduced a breaking change with MapperConfiguration requiring an ILoggerFactory for logging purposes:

public MapperConfiguration(MapperConfigurationExpression configurationExpression, ILoggerFactory loggerFactory)

Registering AutoMapper with services.AddAutoMapper will automatically supply this parameter. Otherwise you'll need to supply the logger factory.

You can obtain your license key at AutoMapper.io

14.0.0

What's Changed

New Contributors

Full Changelog: LuckyPennySoftware/AutoMapper@v13.0.1...v14.0.0

13.0.1

What's Changed

New Contributors

Full Changelog: LuckyPennySoftware/AutoMapper@v13.0.0...v13.0.1

13.0.0

What's Changed

New Contributors

Full Changelog: LuckyPennySoftware/AutoMapper@v12.0.1...v13.0.0

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
Bump AutoMapper from 12.0.1 to 16.1.1
eb46c87 
---
updated-dependencies:
- dependency-name: AutoMapper
  dependency-version: 16.1.1
  dependency-type: direct:production
  update-type: version-update:semver-major
- dependency-name: AutoMapper
  dependency-version: 16.1.1
  dependency-type: direct:production
  update-type: version-update:semver-major
- dependency-name: AutoMapper
  dependency-version: 16.1.1
  dependency-type: direct:production
  update-type: version-update:semver-major
- dependency-name: AutoMapper
  dependency-version: 16.1.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github
Copy link
Author

dependabot bot commented on behalf of github Mar 15, 2026

Labels

The following labels could not be found: backend, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@chatgpt-codex-connector
Copy link

chatgpt-codex-connector bot commented Mar 15, 2026

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

@github-advanced-security
Copy link

github-advanced-security bot commented Mar 15, 2026

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

  • The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
  • Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
  • You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

@lKGreat lKGreat closed this Mar 15, 2026
@dependabot @github
Copy link
Author

dependabot bot commented on behalf of github Mar 15, 2026

OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot dependabot bot deleted the dependabot/nuget/src/backend/Atlas.Application.Alert/multi-d3ce253f09 branch March 15, 2026 18:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@lKGreat