[dependabot]

Updated AutoMapper from 16.2.0 to 16.3.0.

Release notes

Sourced from AutoMapper's releases.

16.3.0

Security

This release fixes two denial-of-service vulnerabilities. In both, deeply nested input could bypass MaxDepth and exhaust the stack. The resulting StackOverflowException can't be caught, so it ends the process. Please upgrade if your application maps untrusted, deeply nested data.

• GHSA-6vhm-j9h7-f9gh: MaxDepth wasn't enforced when mapping through constructor parameters, including positional records. Thanks to @​mcambria for the report.
• GHSA-gpwp-5797-mjff: other recursion paths bypassed MaxDepth: derived maps, object and interface members, dictionary and dynamic sources, and recursive type converters.

CVE IDs have been requested and will be added here once they're assigned.

Behavior changes

• Recursion that MaxDepth can't limit now throws a catchable InsufficientExecutionStackException instead of crashing the process.
• Derived maps (Include / IncludeBase) now inherit MaxDepth and get the default limit of 64 for self-referential maps. If your polymorphic graphs legitimately go deeper, set MaxDepth explicitly.
• Constructor mapping now stops at the same depth as property mapping.
• Condition on ForAllMembers, or any condition whose member parameter is object or a base type, now receives the source member value instead of the value converted to the destination type, when those types differ. This matches the documented contract. A null in a nullable source member is now seen as null rather than 0 or false (#​4655).

Other highlights

• Fixed Context.Items are only available... exceptions with MaxDepth, which depended on registration or warmup order (#​4651)

• License keys get a 30-day renewal grace period, which logs a warning instead of an error (#​4667)

• Clearer license validation messages for malformed keys, client platforms and IdentityModel version mismatches (#​4670)

• Whitespace is stripped from license keys (#​4663), and license validation is isolated from the host app's CryptoProviderFactory (#​4674)

• What's Changed

• Bump Testcontainers.MsSql to 4.14.0 to clear NU1903 by @​jbogard in Bump Testcontainers.MsSql to 4.14.0 to clear NU1903 LuckyPennySoftware/AutoMapper#4652
• docs: replace dead MyGet build link with CI feed link by @​JiuYue0820 in docs: replace dead MyGet build link with CI feed link LuckyPennySoftware/AutoMapper#4648
• Emit the context check for the containing type map in CollectionMapper (fixes #​4650) by @​jbogard in Emit the context check for the containing type map in CollectionMapper (fixes #4650) LuckyPennySoftware/AutoMapper#4651
• Pass the source member value to Condition by @​jbogard in Pass the source member value to Condition LuckyPennySoftware/AutoMapper#4655
• Fix licensing page structure in docs ToC by @​jbogard in Fix licensing page structure in docs ToC LuckyPennySoftware/AutoMapper#4664
• Fix BuildDateUtc embedding on Windows builds by @​jbogard in Fix BuildDateUtc embedding on Windows builds LuckyPennySoftware/AutoMapper#4666
• License validation: WARNING during the renewal grace period by @​jbogard in License validation: WARNING during the renewal grace period LuckyPennySoftware/AutoMapper#4667
• Fail the release when the tag is not on its release branch by @​jbogard in Fail the release when the tag is not on its release branch LuckyPennySoftware/AutoMapper#4668
• ci: bump lock-threads to v6 to fix token validation failure by @​simpleqt in ci: bump lock-threads to v6 to fix token validation failure LuckyPennySoftware/AutoMapper#4658
• Strip whitespace from license keys before resolving precedence by @​AVTUNEY in Strip whitespace from license keys before resolving precedence LuckyPennySoftware/AutoMapper#4663
• License validation: clear messages for malformed keys, client platforms, and IdentityModel version mismatches by @​jbogard in License validation: clear messages for malformed keys, client platforms, and IdentityModel version mismatches LuckyPennySoftware/AutoMapper#4670
• Move to central package management by @​jbogard in Move to central package management LuckyPennySoftware/AutoMapper#4672
• License validation: isolate from the host app's CryptoProviderFactory by @​jbogard in License validation: isolate from the host app's CryptoProviderFactory LuckyPennySoftware/AutoMapper#4674
• Replace broken ApiCompat setup with SDK package validation by @​jbogard in Replace broken ApiCompat setup with SDK package validation LuckyPennySoftware/AutoMapper#4673
• Add regression test for registration-order MaxDepth context failure by @​jbogard in Add regression test for registration-order MaxDepth context failure LuckyPennySoftware/AutoMapper#4675
• Document license key environment variables in the README by @​jbogard in Document license key environment variables in the README LuckyPennySoftware/AutoMapper#4677

New Contributors

• @​JiuYue0820 made their first contribution in docs: replace dead MyGet build link with CI feed link LuckyPennySoftware/AutoMapper#4648
• @​simpleqt made their first contribution in ci: bump lock-threads to v6 to fix token validation failure LuckyPennySoftware/AutoMapper#4658
• @​AVTUNEY made their first contribution in Strip whitespace from license keys before resolving precedence LuckyPennySoftware/AutoMapper#4663

Full Changelog: LuckyPennySoftware/AutoMapper@v16.2.0...v16.3.0

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.