LuckyPennySoftware/AutoMapper v16.3.0

on GitHub

Security

This release fixes two denial-of-service vulnerabilities. In both, deeply nested input could bypass MaxDepth and exhaust the stack. The resulting StackOverflowException can't be caught, so it ends the process. Please upgrade if your application maps untrusted, deeply nested data.

• GHSA-6vhm-j9h7-f9gh: MaxDepth wasn't enforced when mapping through constructor parameters, including positional records. Thanks to @mcambria for the report.
• GHSA-gpwp-5797-mjff: other recursion paths bypassed MaxDepth: derived maps, object and interface members, dictionary and dynamic sources, and recursive type converters.

CVE IDs have been requested and will be added here once they're assigned.

Behavior changes

• Recursion that MaxDepth can't limit now throws a catchable InsufficientExecutionStackException instead of crashing the process.
• Derived maps (Include / IncludeBase) now inherit MaxDepth and get the default limit of 64 for self-referential maps. If your polymorphic graphs legitimately go deeper, set MaxDepth explicitly.
• Constructor mapping now stops at the same depth as property mapping.
• Condition on ForAllMembers, or any condition whose member parameter is object or a base type, now receives the source member value instead of the value converted to the destination type, when those types differ. This matches the documented contract. A null in a nullable source member is now seen as null rather than 0 or false (#4655).

Other highlights

• Fixed Context.Items are only available... exceptions with MaxDepth, which depended on registration or warmup order (#4651)

• License keys get a 30-day renewal grace period, which logs a warning instead of an error (#4667)

• Clearer license validation messages for malformed keys, client platforms and IdentityModel version mismatches (#4670)

• Whitespace is stripped from license keys (#4663), and license validation is isolated from the host app's CryptoProviderFactory (#4674)

• What's Changed

• Bump Testcontainers.MsSql to 4.14.0 to clear NU1903 by @jbogard in #4652
• docs: replace dead MyGet build link with CI feed link by @JiuYue0820 in #4648
• Emit the context check for the containing type map in CollectionMapper (fixes #4650) by @jbogard in #4651
• Pass the source member value to Condition by @jbogard in #4655
• Fix licensing page structure in docs ToC by @jbogard in #4664
• Fix BuildDateUtc embedding on Windows builds by @jbogard in #4666
• License validation: WARNING during the renewal grace period by @jbogard in #4667
• Fail the release when the tag is not on its release branch by @jbogard in #4668
• ci: bump lock-threads to v6 to fix token validation failure by @simpleqt in #4658
• Strip whitespace from license keys before resolving precedence by @AVTUNEY in #4663
• License validation: clear messages for malformed keys, client platforms, and IdentityModel version mismatches by @jbogard in #4670
• Move to central package management by @jbogard in #4672
• License validation: isolate from the host app's CryptoProviderFactory by @jbogard in #4674
• Replace broken ApiCompat setup with SDK package validation by @jbogard in #4673
• Add regression test for registration-order MaxDepth context failure by @jbogard in #4675
• Document license key environment variables in the README by @jbogard in #4677

New Contributors

• @JiuYue0820 made their first contribution in #4648
• @simpleqt made their first contribution in #4658
• @AVTUNEY made their first contribution in #4663

Full Changelog: v16.2.0...v16.3.0