docs: document secure UnsafeEntityLogging default in todoapp-mvc sample - #485
Merged
Merged
Conversation
…le (CommunityToolkit#480) - Bump CommunityToolkit.Datasync.Server(.EntityFrameworkCore) to 10.1.0 so the sample builds against the release that introduced UnsafeEntityLogging (CommunityToolkit#446). - Explicitly set UnsafeEntityLogging = false in TodoItemsController with a comment explaining the sample keeps entity logging disabled to avoid writing TodoItem contents to logs.
This was referenced Jul 6, 2026
adrianhall
added a commit
that referenced
this pull request
Jul 6, 2026
…903 (#489) (#493) - Bump samples/todoapp-mvc Microsoft.EntityFrameworkCore.SqlServer 10.0.3 -> 10.0.9 to match the repo's EFCoreVersion (missed in #485). - Bump stray Microsoft.AspNetCore.Components.WebAssembly*/Microsoft.Extensions.Http pins in todoapp-blazor-wasm from 10.0.3 -> 10.0.9. - Bump Microsoft.EntityFrameworkCore (Avalonia), Microsoft.Extensions.Logging.Debug (MAUI), Microsoft.Extensions.DependencyInjection (WinUI3), and System.Text.Json/System.Formats.Asn1/System.IO.Packaging (Uno, local CPM) from 10.0.3 -> 10.0.9 across the todoapp client-platform samples. - Bump CommunityToolkit.Datasync.Client 10.0.0 -> 10.1.0 across every client sample (Avalonia, MAUI, Uno, WPF, WinUI3, todoapp-tutorial/ClientApp, todoapp-blazor-wasm/Client) to match the latest published package, alongside the already-updated 10.1.0 server samples. - Pin Microsoft.OpenApi to 2.7.5 in root Directory.Packages.props to resolve the NU1903 high-severity advisory (GHSA-v5pm-xwqc-g5wc) on the 2.0.0 version floated transitively via Microsoft.AspNetCore.OpenApi/NSwag.AspNetCore/ Swashbuckle.AspNetCore. CentralPackageTransitivePinningEnabled propagates this through project references into samples/datasync-server and samples/datasync-server-cosmosdb-singlecontainer without needing per-sample pins; verified every restored project.assets.json in the repo now resolves Microsoft.OpenApi/2.7.5. The remaining NU1903 advisory (SQLitePCLRaw.lib.e_sqlite3, GHSA-2m69-gcr7-jv3q) has no patched version available and is tracked separately in #492. Verified: dotnet restore/build/test on Datasync.Toolkit.sln (2280+ tests passing across all suites), plus restore+build for every affected sample solution/project (todoapp-mvc, todoapp-blazor-wasm, datasync-server, datasync-server-cosmosdb-singlecontainer, todoapp-tutorial, TodoApp.Avalonia, TodoApp.Avalonia.Desktop, TodoApp.WPF). TodoApp.MAUI/TodoApp.Uno mobile TFMs and TodoApp.WinUI3 build could not be fully exercised in this environment due to missing Android/iOS/Windows workloads, but package restore succeeded up to that point, confirming the version pins resolve cleanly. Co-authored-by: ahall <ahall@cloudflare.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #480
Summary
Reviews the
samples/todoapp-mvcserver sample against v10.1.0'sUnsafeEntityLoggingoption (#446).CommunityToolkit.Datasync.ServerandCommunityToolkit.Datasync.Server.EntityFrameworkCorepackage references from 10.0.0 to 10.1.0, since the sample was still pinned to the release that predatesUnsafeEntityLogging.UnsafeEntityLogging = falseinTodoItemsControllerwith a comment documenting that this is the deliberate secure default — entity logging is intentionally left disabled soTodoItemcontents are never written to the logs.No behavior change: the sample already defaulted to
UnsafeEntityLogging = falsebefore this PR; the change only makes the default explicit and documented, and updates the package version so the sample actually builds against the option that introduced it.Testing
dotnet build samples/todoapp-mvc/part5.sln— succeeds with 0 warnings / 0 errors.