Bump Tmds.DBus.Protocol from 0.90.2 to 0.92.0

[dependabot]

Updated Tmds.DBus.Protocol from 0.90.2 to 0.92.0.

Release notes

Sourced from Tmds.DBus.Protocol's releases.

0.92.0

This release addresses vulnerabilities from malicious senders in Tmds.DBus and Tmds.DBus.Protocol:

• Check the signal sender is the owner of the well-known name (fb41b95, b429873)
• Prevent spilling of unix fds to the next message and limit the number to 16 per message (4800917, f90642d)
• Prevent unhandled exceptions on SynchronizationContext due to a malformed body sent by a malicious sender. (f0d9d0b, a64b8b9)

Advisory: GHSA-xrw6-gwf8-vvr9

0.91.1

Tmds.DBus.Generator/Tmds.DBus.Tool:

• ProtocolGenerator: fix alignment when reading structs. (ProtocolGenerator: fix alignment when reading structs. tmds/Tmds.DBus#422)

0.91.0

Changes:

• Protocol: SignatureReader: mark type as Obsolete and remove dead code. (Protocol: SignatureReader: mark type as Obsolete and remove dead code. tmds/Tmds.DBus#416)

Bug fixes/improvements:

• Protocol: change send message methods to be void instead of ValueTask. (Protocol: change send message methods to be void instead of ValueTask. tmds/Tmds.DBus#404)
• Protocol: Reader: fix ReverseDoubleEndianness returning unreversed value on pre-.NET8 targets. (Reader: fix ReverseDoubleEndianness returning unreversed value on pre-.NET8 targets. tmds/Tmds.DBus#407)
• Protocol.Reader: limit array sizes to D-Bus max array length (64 MiB). (Protocol.Reader: limit array sizes to D-Bus max array length (64 MiB). tmds/Tmds.DBus#408)
• Protocol.Message: skip unknown header fields. (Protocol.Message: skip unknown header fields. tmds/Tmds.DBus#409)
• Protocol: enforce D-Bus max message length (128 MiB) (Protocol: enforce D-Bus max message length (128 MiB) tmds/Tmds.DBus#410)
• Fix DBusType.Signature alignment from 4 to 1. (Fix DBusType.Signature alignment from 4 to 1. tmds/Tmds.DBus#411)
• Protocol: AddressReader: fix Unescape and TryGetNext off-by-one errors. (Protocol: AddressReader: fix Unescape and TryGetNext off-by-one errors. tmds/Tmds.DBus#412)
• Protocol: DBusAddress: improve resource cleanup for X11/Windows, refactor system/session address initialization. (Protocol: DBusAddress: improve resource cleanup for X11/Windows, refactor system/session address initialization. tmds/Tmds.DBus#413)
• Protocol: Reader: enforce max recursion depth (64) when reading variant values. (Protocol: Reader: enforce max recursion depth (64) when reading variant values. tmds/Tmds.DBus#415)
• Protocol: Reader: ensure ReadSpan throws DBusReadException when null terminator byte is missing. (Protocol: Reader: ensure ReadSpan throws DBusReadException when null terminator byte is missing. tmds/Tmds.DBus#414)
• Protocol: Array/Struct/Dict: fix check for unsupported composite types. (Protocol: Array/Struct/Dict: fix check for unsupported composite types. tmds/Tmds.DBus#418)
• Protocol: VariantValue: fix GetDictionaryEntry type check, fix GetStructFieldType out-of-bounds check. (Protocol: VariantValue: fix GetDictionaryEntry type check, fix GetStructFieldType out-of-bounds check. tmds/Tmds.DBus#417)
• Protocol: MessageWriter: use Unsafe.SizeOf for JIT constant size. (Protocol: MessageWriter: use Unsafe.SizeOf for JIT constant size. tmds/Tmds.DBus#419)
• Protocol: PathNodeDictionary: simplify batch RemoveMethodHandlers. (Protocol: PathNodeDictionary: simplify batch RemoveMethodHandlers. tmds/Tmds.DBus#420)

0.90.3

• Revert the 0.90.0 change that passes reader/handler exceptions back to the handler. (Revert the 0.90.0 change that passes reader/handler exceptions back to the handler. tmds/Tmds.DBus#403)

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[Copilot]

Pull request overview

Updates the X11 Skia runtime project’s D-Bus dependencies to incorporate upstream fixes (including security hardening) by bumping Tmds.DBus.Protocol (and matching Tmds.DBus.Generator) from 0.90.2 to 0.92.0.

Changes:

• Bump Tmds.DBus.Protocol to 0.92.0.
• Bump Tmds.DBus.Generator to 0.92.0.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.