From ab0c30c7937f29f1453d5916aa5940abbb8cc55d Mon Sep 17 00:00:00 2001 From: Artur Bobb <24595815+Chookees@users.noreply.github.com> Date: Mon, 26 Oct 2026 08:25:13 +0000 Subject: [PATCH 1/2] Bump .NET SDK pin to 10.0.403 (runtime 10.0.14) for CVE-2026-111497 --- .github/workflows/ci.yml | 3 +++ CHANGELOG.md | 4 ++++ CONTRIBUTING.md | 2 +- README.md | 4 ++-- docs/FINAL_REPORT.md | 4 ++-- docs/adr/0003-sdk-pinning-policy.md | 4 ++-- docs/coverage-summary.md | 2 ++ global.json | 2 +- tests/FunctionFoundry.Engineering.Tests/SdkPinningTests.cs | 2 +- 9 files changed, 18 insertions(+), 9 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index bb1a474..44f7b27 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -28,6 +28,9 @@ jobs: with: global-json-file: global.json + - name: Show .NET info + run: dotnet --info + - name: Verify pinned SDK shell: bash run: | diff --git a/CHANGELOG.md b/CHANGELOG.md index 3c72465..94159c4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +### Security + +- SDK pin raised to 10.0.403 (runtime 10.0.14) for CVE-2026-111497. + ## [1.1.0] - 2026-08-03 ### Added diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index ff1ef39..4e62f3b 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -4,7 +4,7 @@ Thank you for contributing. This repository builds specialized .NET libraries, n ## Development setup -1. Install .NET SDK **10.0.302** exactly (see `global.json`). +1. Install .NET SDK **10.0.403** exactly (see `global.json`). 2. Restore, build, and test: ```bash diff --git a/README.md b/README.md index f3658c2..edd2286 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,7 @@ # FunctionFoundry [![CI](https://github.com/Chookees/FunctionFoundry/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/Chookees/FunctionFoundry/actions/workflows/ci.yml) -[![.NET](https://img.shields.io/badge/.NET-10.0.302-512BD4?logo=dotnet&logoColor=white)](global.json) +[![.NET](https://img.shields.io/badge/.NET-10.0.403-512BD4?logo=dotnet&logoColor=white)](global.json) [![Tests](https://img.shields.io/badge/tests-271%20passed-brightgreen)](docs/coverage-summary.md) [![Coverage](https://img.shields.io/badge/coverage-85.8%25%20line-brightgreen)](docs/coverage-summary.md) [![Branch Coverage](https://img.shields.io/badge/branch%20coverage-remeasure-lightgrey)](docs/coverage-summary.md) @@ -32,7 +32,7 @@ Each product has a dedicated README under `src//README.md` describing e ## Requirements -* .NET SDK **10.0.302** (pinned in `global.json`; roll-forward disabled) +* .NET SDK **10.0.403** (pinned in `global.json`; roll-forward disabled; runtime 10.0.14) * Target framework: `net10.0` * C# 14.0 diff --git a/docs/FINAL_REPORT.md b/docs/FINAL_REPORT.md index 668d7c2..904c6e2 100644 --- a/docs/FINAL_REPORT.md +++ b/docs/FINAL_REPORT.md @@ -7,7 +7,7 @@ * `tests/` — per-package xUnit projects + Engineering.Tests * `samples/` / `benchmarks/` — per-package executables * `docs/adr`, `docs/packages`, CI under `.github/workflows` -* Central build: `Directory.Build.props/targets`, `Directory.Packages.props`, `global.json` (**10.0.302**) +* Central build: `Directory.Build.props/targets`, `Directory.Packages.props`, `global.json` (**10.0.302**; note: SDK pin later raised to **10.0.403** / runtime 10.0.14 for CVE-2026-111497) ## 2. Delivered packages @@ -92,7 +92,7 @@ See `docs/packages/size-and-compatibility-report-v1.md`. * PBI commit order on main not strictly 01→12 * Separate `v0.5.0` tag omitted * Unicode confusables: compact subset, not full UCD -* SDK maintenance upgrade **10.0.301 → 10.0.302** +* SDK maintenance upgrade **10.0.301 → 10.0.302** (later raised to **10.0.403** / runtime 10.0.14 for CVE-2026-111497) ## 16. Remaining known risks diff --git a/docs/adr/0003-sdk-pinning-policy.md b/docs/adr/0003-sdk-pinning-policy.md index 3263253..05e1532 100644 --- a/docs/adr/0003-sdk-pinning-policy.md +++ b/docs/adr/0003-sdk-pinning-policy.md @@ -2,7 +2,7 @@ * **Status:** Accepted * **Date:** 2026-07-14 -* **Updated:** 2026-08-03 +* **Updated:** 2026-10-26 * **Deciders:** FunctionFoundry architects ## Context @@ -11,7 +11,7 @@ Silent SDK roll-forward can change analyzer behavior, pack outputs, and language ## Decision -* Pin SDK `10.0.302` in `global.json` (maintenance upgrade from `10.0.301`). +* Pin SDK `10.0.403` in `global.json` (security/maintenance upgrade from `10.0.302`; runtime 10.0.14 for CVE-2026-111497). * Set `rollForward` to `disable`. * Target `net10.0` and C# 14.0. * Treat future SDK moves as explicit maintenance upgrades with changelog notes and CI verification. diff --git a/docs/coverage-summary.md b/docs/coverage-summary.md index 6e071ba..584c2c6 100644 --- a/docs/coverage-summary.md +++ b/docs/coverage-summary.md @@ -2,6 +2,8 @@ Measured with Coverlet Cobertura on a Release `net10.0` build (SDK **10.0.302**), aggregated by unique package name (same methodology as CI). +Note: SDK pin later raised to **10.0.403** / runtime 10.0.14 for CVE-2026-111497; remeasure coverage under the new SDK when convenient. + **Unit tests:** 242 passed, 0 failed, 0 skipped. ## Overall diff --git a/global.json b/global.json index c66295e..794b415 100644 --- a/global.json +++ b/global.json @@ -1,6 +1,6 @@ { "sdk": { - "version": "10.0.302", + "version": "10.0.403", "rollForward": "disable", "allowPrerelease": false } diff --git a/tests/FunctionFoundry.Engineering.Tests/SdkPinningTests.cs b/tests/FunctionFoundry.Engineering.Tests/SdkPinningTests.cs index 61a7774..880195b 100644 --- a/tests/FunctionFoundry.Engineering.Tests/SdkPinningTests.cs +++ b/tests/FunctionFoundry.Engineering.Tests/SdkPinningTests.cs @@ -10,7 +10,7 @@ public void GlobalJson_pins_exact_sdk_without_roll_forward() string path = FindRepoFile("global.json"); using JsonDocument document = JsonDocument.Parse(File.ReadAllText(path)); JsonElement sdk = document.RootElement.GetProperty("sdk"); - Assert.Equal("10.0.302", sdk.GetProperty("version").GetString()); + Assert.Equal("10.0.403", sdk.GetProperty("version").GetString()); Assert.Equal("disable", sdk.GetProperty("rollForward").GetString()); Assert.False(sdk.GetProperty("allowPrerelease").GetBoolean()); } From 3fd773cf67b9b5e20cea3fd4e36e840045bb5cb8 Mon Sep 17 00:00:00 2001 From: "Artur B." <24595815+Chookees@users.noreply.github.com> Date: Mon, 26 Oct 2026 15:07:46 +0000 Subject: [PATCH 2/2] Fix CHANGELOG bullet style for SDK 10.0.403 security entry --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 94159c4..9ce1284 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,7 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Security -- SDK pin raised to 10.0.403 (runtime 10.0.14) for CVE-2026-111497. +* SDK pin raised to 10.0.403 (runtime 10.0.14) for CVE-2026-111497 (GHSA-p3jp-9v83-76w9). ## [1.1.0] - 2026-08-03