Skip to content

Bump bunit from 1.32.7 to 2.7.2 - #6

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/nuget/tests/ControlMenu.Tests/bunit-2.7.2
Closed

Bump bunit from 1.32.7 to 2.7.2#6
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/nuget/tests/ControlMenu.Tests/bunit-2.7.2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Updated bunit from 1.32.7 to 2.7.2.

Release notes

Sourced from bunit's releases.

2.7.2

Fixed

  • Implemented InvokeConstructorAsync on BunitJSRuntime and BunitJSObjectReference for .NET 10+, which previously threw NotImplementedException. Reported by @​Floopy-Doo in #​1818. Fixed by @​linkdotnet.

2.6.2

Added

  • net11.0 support

2.5.3

Added

  • Render(RenderFragment) is preferred via the OverloadResolutionAttribute. Reported by @​ScarletKuro in #​1800. Fixed by @​linkdotnet.
  • FindByTestId to bunit.web.query to gather elements by a given test id. By @​jimSampica

2.4.2

Fixed

  • Use proper return typed for InputAsync and ChangeAsync methods.

2.3.4

Added

  • Added generic overloads Find{TComponent, TElement} and FindAll{TComponent, TElement} to query for specific element types (e.g., IHtmlInputElement). By @​linkdotnet.
  • Added generic overloads WaitForElement{TComponent, TElement} and WaitForElements{TComponent, TElement} to wait for specific element types. By @​linkdotnet.

Fixed

  • Adding convenient overloads for InputAsync and ChangeAsync to have feature parity with the sync version. Reported by @​ScarletKuro. Fixed by @​linkdotnet.

2.2.2

Added

  • Added FindByAllByLabel to bunit.web.query package. By @​linkdotnet.

Fixed

  • Updated AngleSharp.Diffing to fix a bug related to unknown HTML elements. Reported by @​md-at-slashwhy.

2.1.1

Changed

  • Registering AuthenticationState in the services container rather than as part of the RenderTree. Fixes #​1774 reported by @​aayjaychan.

2.0.66

This major release focuses on platform updates and API simplifications.

For a migration guide, see Upgrading bUnit.

Changed

  • Target framework support updated: added support for .NET 10 (net10.0) and dropped all versions prior to .NET 8 (net8.0).
  • Cleanup of the API with simplifications of many API calls and methods. This also includes renaming of some objects to better reflect their purpose.

Added

  • Support for form submission from submit buttons and inputs that are outside the form element but associated via the HTML5 form attribute. Reported and fixed in #​1766.
  • Improved renderer logic that catches more edge cases.
  • Improved developer experience in relation to JSInterop.

1.40.0

Fixed

  • Aligned Microsoft packages to their TFM version

1.39.5

Fixed

  • Do not set the Uri or BaseUri property on the FakeNavigationManager if navigation is prevented by a handler on net7.0 or greater. Reported and fixed by @​ayyron-dev in #​1647
  • Use default renderer properties for AngleSharp. Reported by @​jtleaming in [#​1692].
  • FindComponents throws an exception, when a base and derived class was searched for. Reported by @​BlueDragon709 in [#​1691].

1.38.5

Added

  • Added support for xunit v3 in the bunit.template. By @​linkdotnet.

1.37.7

Added

  • Added support for RendererInfo and AssignedRenderMode (.net9.0).

1.36.0

Added

  • Bumped .NET 9 version dependencies to stable packages.

1.35.3

Added

  • Extension packages (bunit.generators and bunit.web.query) are flagged as stable.

1.34.0

Fixed

1.33.3

Added

  • bunit.generators respect parameters from the base class.
  • Supports components using constructor injection in net9.0.

Fixed

  • Use latest System.Text.Json due to CVE in 8.0.4.

Commits viewable in compare view.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code labels May 18, 2026
@bilbospocketses

bilbospocketses commented May 18, 2026

Copy link
Copy Markdown
Owner

@dependabot rebase

@bilbospocketses
bilbospocketses enabled auto-merge (squash) May 18, 2026 23:39
@dependabot
Bump bunit from 1.32.7 to 2.7.2
1b7a248 
---
updated-dependencies:
- dependency-name: bunit
  dependency-version: 2.7.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/nuget/tests/ControlMenu.Tests/bunit-2.7.2 branch from bae011a to 1b7a248 Compare May 18, 2026 23:41
@bilbospocketses

bilbospocketses commented May 19, 2026

Copy link
Copy Markdown
Owner

Closing Dependabot's automated bump — doing the bunit 1.x → 2.x migration manually as a single PR to handle the breaking API changes (IRenderedComponent shape, ComponentParameter rewrites, etc.) properly in our test code. Will track separately.

auto-merge was automatically disabled May 19, 2026 00:14

Pull request was closed

@dependabot @github

dependabot Bot commented on behalf of github May 19, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/nuget/tests/ControlMenu.Tests/bunit-2.7.2 branch May 19, 2026 00:14
@bilbospocketses bilbospocketses mentioned this pull request May 19, 2026
Merged
1 task
bilbospocketses added a commit that referenced this pull request May 19, 2026
@bilbospocketses
deps(test): bunit 1.32.7 -> 2.7.2 + API migration (#12)
31bb298 
bunit 2.x breaking changes per https://bunit.dev/docs/migrations/1to2.html:
  - TestContext renamed to BunitContext
  - RenderComponent<T>() unified into Render<T>()
  - IRenderedComponent<T> -> IRenderedComponent (not used here)
  - ComponentParameter / ComponentParameterFactory removed (not used here)

Applied across all 9 bunit-using test files:
  Components/Layout/SidebarFlyoutTests.cs
  Components/HomeSections/{HomeIntegrationTests,HomeModuleTilesTests,
    HomeScanBandTests,HomeDiscoveredCamerasTests,HomeDiscoveredAndroidTests}.cs
  Components/Shared/Settings/{SettingsSectionTests,SettingsGridTests,
    SettingsGridCellTests}.cs

Plus tests/ControlMenu.Tests/ControlMenu.Tests.csproj bunit ref bump.

Closes Dependabot PR #6 (closed manually in favor of this migration PR).
@bilbospocketses bilbospocketses mentioned this pull request May 19, 2026
Merged
5 tasks
bilbospocketses added a commit that referenced this pull request May 19, 2026
@bilbospocketses
chore(security): tighten rulesets (rebase-drop + CodeQL/Scorecard gat…
631f6ce 
…ing + tag-signing) + scorecard PR trigger (#17)

Cross-repo Tier B security parity sweep. svgedit, OAO, ws-scrcpy-web all
landed equivalent ruleset tightening in parallel sessions today; this PR
brings CM to parity plus a CM-specific Scorecard-as-required-check extra.

Ruleset changes (API-only, already applied pre-PR via gh api PUT):
- Branch ruleset 16554261:
  - pull_request.allowed_merge_methods ["merge","squash","rebase"] -> ["squash","merge"]
  - required_status_checks: added Analyze (csharp), Analyze (javascript-typescript),
    Analyze (actions) (CodeQL App, integration_id 15368) + Scorecard analysis
- Tag ruleset 16554225: added required_signatures
- Repo-level: allow_rebase_merge true -> false (UI cleanup; ruleset is the binding gate)

scorecard.yml companion changes (in this PR):
- Added `pull_request: branches: [master]` trigger so the new required check
  actually reports on PRs. Without it, every PR would block forever waiting
  for Scorecard analysis that never runs.
- Gated `publish_results: ${{ github.event_name == 'push' }}` — PR runs
  publish a branch-HEAD SHA not on master, triggering the same OpenSSF
  webapp "imposter commit" 400 we hit in PR #15 (different cause, same
  SHA-not-on-commit-graph failure mode).

Deferrals documented in CHANGELOG:
- Items #6 + #7 (secret-scanning non_provider_patterns + validity_checks)
  require GHAS license; PATCH calls silently no-op on free tier (confirmed
  empirically on svgedit). Deferred indefinitely.
bilbospocketses added a commit that referenced this pull request Jun 18, 2026
@bilbospocketses
Security & robustness remediation: the network/robustness cluster (au…
da3141b 
…dit Item 43) (#63)

* fix(cameras): RTSP probe authenticates with Digest, never preemptive Basic

The RTSP DESCRIBE probe base64'd the URL userinfo into an `Authorization:
Basic` header on the FIRST request, before any challenge. That leaks a
trivially-reversible password — over the unencrypted TCP/554 channel — to
whatever answers the socket, including a hostile device answering network
discovery.

Now the probe sends an unauthenticated DESCRIBE first and only answers an
explicit `WWW-Authenticate: Digest` challenge (RFC 2617, qop=auth + legacy
no-qop), which puts only a realm+nonce-bound hash on the wire, never the
password. We deliberately do NOT fall back to Basic: a Basic-only server
stays a 401 rather than re-leaking the password. Userinfo is now split and
percent-decoded (the old Basic path sent the still-encoded form), and the
response is read in a loop to the full Content-Length instead of a single
8 KiB chunk.

The test issues a Digest challenge and independently recomputes the expected
response from the client's Authorization header, asserting the first request
carried no credentials and the client never sends Basic.

Review finding #6 (2026-06-14 security/code-review audit).

* fix(email): enforce SMTP TLS via MailKit (no cleartext fallback)

EmailService used the obsolete System.Net.Mail.SmtpClient with EnableSsl,
which cannot do implicit TLS (SMTPS / port 465) and gives no explicit control
over the connection's security mode.

Replace it with MailKit. Port 465 now uses SecureSocketOptions.SslOnConnect
(implicit TLS); every other port uses SecureSocketOptions.StartTls, which
requires the server to offer STARTTLS and throws rather than continuing in
cleartext. The mode is chosen by ResolveSecureSocketOptions, unit-tested to
never return None, Auto, or StartTlsWhenAvailable — the options that would
permit a cleartext session.

Adds MailKit 4.17.0.

Review finding #7 (2026-06-14 security/code-review audit).

* fix(cameras): pool Hikvision ISAPI HTTP via IHttpClientFactory

HikvisionIsapiClient newed up an HttpClientHandler + HttpClient on every
probe and disposed them, leaking a socket per call. A camera scan across a
subnet could exhaust ephemeral ports.

Switch to IHttpClientFactory (the pattern already used by OnvifClient,
JellyfinService, DependencyManagerService, ...), which recycles a shared
SocketsHttpHandler so connections pool across probes. Because credentials
can't live on a shared handler, auth is now applied per request: an
unauthenticated GET first, then an answer to the 401 Digest (preferred) or
Basic challenge — preserving support for both older firmware (V5.6.2, which
requires Digest) and newer firmware (Basic), with no preemptive credentials.

The Digest/Basic header construction is extracted to a shared
DigestAuthHelper (the digest math is identical to the RTSP probe's). Tests
mock IHttpClientFactory and drive both challenge→200 flows, independently
recomputing the Digest response to confirm correctness.

Review finding #25 (2026-06-14 security/code-review audit).

* refactor(cameras): RTSP probe shares the DigestAuthHelper

RtspProbeClient carried its own copy of the RFC 2617 Digest construction
(ParseAuthParams / BuildDigestAuthorization / Md5Hex), identical to the
helper extracted for the Hikvision client. Point it at the shared
DigestAuthHelper and delete the duplicates. No behavior change — the RTSP
probe tests stay green.

* fix(utilities): FileUnblock uses -LiteralPath (no wildcard interpretation)

UnblockDirectoryAsync built `Get-ChildItem '<path>'` and `Get-Item
$_.FullName` with no -LiteralPath, so a directory or file name containing
'[' or ']' (e.g. C:\Photos\[2024]\) was parsed as a PowerShell wildcard
character class and silently matched nothing — the unblock quietly did
nothing for those paths.

Add -LiteralPath to both cmdlets. The single-quote doubling stays (it guards
quote injection, orthogonal to wildcards); the piped Unblock-File already
binds via PSPath, which is literal.

Review finding #12 (2026-06-14 security/code-review audit).

* fix(scrcpy): accumulate multi-frame WebSocket probe responses

ScrcpyProbeService.ProbeAsync read a single ≤8 KiB WebSocket frame and
deserialized it. A probe response with a long videoEncoders/audioEncoders
list exceeds one frame, so the JSON was truncated and deserialization
failed — the device silently reported no probe data.

Extract ReadFullTextMessageAsync, which loops ReceiveAsync until
EndOfMessage, assembling the full payload (with a 1 MiB safety cap and
Close/non-Text handling). Unit-tested with a scripted multi-frame WebSocket
to confirm a >8 KiB message reassembles and parses intact.

Review finding #22 (2026-06-14 security/code-review audit).

* fix(logging): Serilog provider no longer owns the global logger (dispose:false)

AddFileSink registered the SerilogLoggerProvider with dispose:true, so the
process-global Log.Logger was disposed whenever the host's logger factory was
disposed (host shutdown, or a second host built in the same process), tearing
down live logging for every other holder of Log.Logger. Nothing flushed the
file sink at process exit either.

- dispose:false: the configurator owns the logger lifetime, not the DI provider.
- Register an AppDomain.ProcessExit flush exactly once (idempotent across
  repeated inits) so buffered events reach disk at shutdown.
- Flush/close any previously-configured logger before replacing it, so a
  re-init doesn't leak the prior file handle.

Review finding #32 (2026-06-14 security/code-review audit).

* ci(dependabot): gate auto-merge on head-repo identity, not just actor

The auto-merge job ran on `github.actor == 'dependabot[bot]'` alone. Add
`github.event.pull_request.head.repo.full_name == github.repository` so the
PR's head branch must live in this repository — a fork PR can present the
author but never satisfies the head-repo check, closing the path where a
fork could ride auto-merge.

Review finding #18 (2026-06-14 security/code-review audit).

* fix(executor): default timeout for bundled-binary invocations

The executor kills a child process tree on cancellation, but the
ExecuteResolvedAsync callers (adb, magick/vtracer/potrace, sqlite3, the
--version probes) passed no deadline. A hung child therefore blocked the
awaiting Blazor circuit indefinitely.

Add an optional `timeout` to both ExecuteResolvedAsync overloads, backed by a
generous DefaultCommandTimeout (5 min) when unspecified, implemented as a
linked CTS + CancelAfter. On expiry the existing kill-on-cancel tears down the
child tree and we return a TimedOut CommandResult; a caller-driven
cancellation still propagates as OperationCanceledException. Long-running
processes (go2rtc, scrcpy, ws-scrcpy-web) are supervised elsewhere and don't
use this path, so the backstop can't clip them.

Review finding #19 (2026-06-14 security/code-review audit).

* docs: D2 dependency-integrity writeup + network/robustness changelog

Lands the documentation deferred from the D2 PR (#62, master is PR-gated):

- CHANGELOG [Unreleased]: the runtime dependency-download integrity gate
  (transport hard-gate → pinned SHA-256 → upstream checksum → Authenticode →
  user-confirm), plus the eight network/robustness findings from this branch.
  Trims the now-stale "still needs an integrity strategy" note on the
  dotnet-install entry.
- TECHNICAL_GUIDE: rewrites DownloadAndInstallAsync to verify-before-extract,
  documents the tiered IArtifactVerifier gate and the SharpCompress `.7z`
  extraction (which un-inerts ImageMagick's portable auto-update).
- README: one line noting downloads are integrity-verified before install.

* test: relax executor token matchers for the default-timeout wrapper

ExecuteResolvedAsync now runs commands under a linked CTS (the #19 default
timeout), so the executor sees that linked token rather than the caller's
CancellationToken.None. Tests that mocked ExecuteAsync with an exact `default`
token (adb, sqlite3, adb kill-server) stopped matching — their Setups missed
(null result) and Verifies saw zero invocations.

Relax those token arguments to It.IsAny<CancellationToken>(); the command name,
argument list, and working directory are still asserted exactly. The raw-executor
paths (docker, --version probes) are unwrapped and keep their exact tokens.

* docs: note MD5-sess scope + RTSP connection-reuse (code-review polish)

Two clarifying comments from the whole-branch review (no behavior change):
- DigestAuthHelper computes plain-MD5 HA1 only; MD5-sess is intentionally
  unsupported (unseen on IP cameras, fail-closed over untested crypto).
- The RTSP authenticated retry reuses the open connection per convention; a
  server that closes after 401 degrades to a graceful probe failure.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

AddAuthorization() / AddTestAuthorization() doesn't work with shallow rendering

1 participant

@bilbospocketses