Repository navigation
Fix BuildDateUtc embedding on Windows builds - #4666
Merged
Merged
Conversation
On Windows, Exec runs the command from a .cmd file, which consumed the single % in --format=%cI, so git failed and its error message was embedded as the build date. Double the % on Windows, and only embed the output when git succeeds and it looks like an ISO 8601 date. Fixes #4665 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
No blocking code issues were identified, but the Windows-specific command behavior still needs confirmation from Windows CI.
No open issues 🎉
What changed in this PR
This PR addresses #4665 by correcting commit-date embedding on Windows, which perpetual-license validation depends on.
Changes:
- Use platform-specific percent escaping for Git’s date format and embed output only when Git succeeds and it matches the expected date prefix.
- Add a regression test requiring
BuildInfo.BuildDateto be non-null, covered by the existing Windows release test run.
| File | Description |
|---|---|
| src/UnitTests/Licensing/BuildInfoTests.cs | Adds a regression test for the embedded build date. |
| src/AutoMapper/AutoMapper.csproj | Fixes Windows escaping and guards build-date metadata generation. |
Review effort: Balanced
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b7bef5f6a8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
This was referenced Nov 5, 2026
Merged
Open
This was referenced Nov 13, 2026
sondresjolyst
pushed a commit
to sondresjolyst/garge-api
that referenced
this pull request
Nov 14, 2026
Updated [AutoMapper](https://github.com/LuckyPennySoftware/AutoMapper) from 16.2.0 to 16.3.0. <details> <summary>Release notes</summary> _Sourced from [AutoMapper's releases](https://github.com/LuckyPennySoftware/AutoMapper/releases)._ ## 16.3.0 ## Security This release fixes two denial-of-service vulnerabilities. In both, deeply nested input could bypass `MaxDepth` and exhaust the stack. The resulting `StackOverflowException` can't be caught, so it ends the process. Please upgrade if your application maps untrusted, deeply nested data. - [GHSA-6vhm-j9h7-f9gh](GHSA-6vhm-j9h7-f9gh): `MaxDepth` wasn't enforced when mapping through constructor parameters, including positional records. Thanks to @mcambria for the report. - [GHSA-gpwp-5797-mjff](GHSA-gpwp-5797-mjff): other recursion paths bypassed `MaxDepth`: derived maps, `object` and interface members, dictionary and dynamic sources, and recursive type converters. CVE IDs have been requested and will be added here once they're assigned. ## Behavior changes - Recursion that `MaxDepth` can't limit now throws a catchable `InsufficientExecutionStackException` instead of crashing the process. - Derived maps (`Include` / `IncludeBase`) now inherit `MaxDepth` and get the default limit of 64 for self-referential maps. If your polymorphic graphs legitimately go deeper, set `MaxDepth` explicitly. - Constructor mapping now stops at the same depth as property mapping. - `Condition` on `ForAllMembers`, or any condition whose member parameter is `object` or a base type, now receives the source member value instead of the value converted to the destination type, when those types differ. This matches the documented contract. A `null` in a nullable source member is now seen as `null` rather than `0` or `false` (#4655). ## Other highlights - Fixed `Context.Items are only available...` exceptions with `MaxDepth`, which depended on registration or warmup order (#4651) - License keys get a 30-day renewal grace period, which logs a warning instead of an error (#4667) - Clearer license validation messages for malformed keys, client platforms and IdentityModel version mismatches (#4670) - Whitespace is stripped from license keys (#4663), and license validation is isolated from the host app's `CryptoProviderFactory` (#4674) - ## What's Changed * Bump Testcontainers.MsSql to 4.14.0 to clear NU1903 by @jbogard in LuckyPennySoftware/AutoMapper#4652 * docs: replace dead MyGet build link with CI feed link by @JiuYue0820 in LuckyPennySoftware/AutoMapper#4648 * Emit the context check for the containing type map in CollectionMapper (fixes #4650) by @jbogard in LuckyPennySoftware/AutoMapper#4651 * Pass the source member value to Condition by @jbogard in LuckyPennySoftware/AutoMapper#4655 * Fix licensing page structure in docs ToC by @jbogard in LuckyPennySoftware/AutoMapper#4664 * Fix BuildDateUtc embedding on Windows builds by @jbogard in LuckyPennySoftware/AutoMapper#4666 * License validation: WARNING during the renewal grace period by @jbogard in LuckyPennySoftware/AutoMapper#4667 * Fail the release when the tag is not on its release branch by @jbogard in LuckyPennySoftware/AutoMapper#4668 * ci: bump lock-threads to v6 to fix token validation failure by @simpleqt in LuckyPennySoftware/AutoMapper#4658 * Strip whitespace from license keys before resolving precedence by @AVTUNEY in LuckyPennySoftware/AutoMapper#4663 * License validation: clear messages for malformed keys, client platforms, and IdentityModel version mismatches by @jbogard in LuckyPennySoftware/AutoMapper#4670 * Move to central package management by @jbogard in LuckyPennySoftware/AutoMapper#4672 * License validation: isolate from the host app's CryptoProviderFactory by @jbogard in LuckyPennySoftware/AutoMapper#4674 * Replace broken ApiCompat setup with SDK package validation by @jbogard in LuckyPennySoftware/AutoMapper#4673 * Add regression test for registration-order MaxDepth context failure by @jbogard in LuckyPennySoftware/AutoMapper#4675 * Document license key environment variables in the README by @jbogard in LuckyPennySoftware/AutoMapper#4677 ## New Contributors * @JiuYue0820 made their first contribution in LuckyPennySoftware/AutoMapper#4648 * @simpleqt made their first contribution in LuckyPennySoftware/AutoMapper#4658 * @AVTUNEY made their first contribution in LuckyPennySoftware/AutoMapper#4663 **Full Changelog**: LuckyPennySoftware/AutoMapper@v16.2.0...v16.3.0 Commits viewable in [compare view](LuckyPennySoftware/AutoMapper@v16.2.0...v16.3.0). </details> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/sondresjolyst/garge-api/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #4665
Problem
EmbedBuildDaterangit log -1 --format=%25cI. Packages are built on Windows, whereExecwrites the command to a.cmdfile. cmd consumes the single%, so git received--format=cIand failed. Because ofIgnoreExitCode="true", the error textfatal: invalid --pretty format: cIwas embedded asBuildDateUtcin 16.1.0, 16.1.1 and 16.2.0. As a result,BuildInfo.BuildDateisnulland perpetual licensing never applies.Changes
%%cIon Windows and%cIeverywhere else.Execexits with 0 and the output matches^\d{4}-\d{2}-\d{2}T. Otherwise no attribute is written. There is intentionally no fallback to the current time, so a rebuild from source can't extend perpetual coverage.BuildInfoTests.BuildDate_IsEmbedded.Build.ps1runs tests on the Windows runner before packing, so a regression now fails the release.Verification
2026-10-16T15:08:34-05:00.-p:OS=Windows_NT, which makes git output a literal%cI) makes the guard drop the value and the test fail, as intended.Releases 16.1.0–16.2.0 are still affected. Customers on those versions need to upgrade to get perpetual licensing.
🤖 Generated with Claude Code