ci: scope NuGet vulnerability gate to PR-introduced changes#3806
Merged
ci: scope NuGet vulnerability gate to PR-introduced changes#3806
Conversation
Contributor
|
Note Reviews pausedUse the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughEnable package-lock restores and adjust MSBuild warning rules; add numerous NuGet Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@Directory.Build.props`:
- Line 12: Add a clear explanatory comment above the WarningsNotAsErrors entry
that suppresses NU1904: state which specific advisory or vulnerable package(s)
required the NU1904 suppression, reference the existing tracking TODO/issue
number, indicate whether this is temporary and include a target remediation
date, and note why a global suppression was chosen instead of using
NuGetAuditSuppress or adjusting NuGetAuditLevel; if suppression can be scoped,
replace the global NU1904 entry with specific <NuGetAuditSuppress> entries (see
existing GHSA-rvv3-g6hj-g44x usage) or lower NuGetAuditLevel to keep critical
advisories visible.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: dbbc3f3d-2657-41c2-a759-626f577fe770
📒 Files selected for processing (2)
Directory.Build.propstests/Directory.Build.props
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/workflows/ci-cd-pull-request.yml (1)
65-79: Considerfail-on-severity: moderateorhighto avoid friction from low-severity advisories with no fix available.Setting
fail-on-severity: lowis the strictest option and will block PRs on any low-severity advisory introduced or updated in dependencies. Given this PR also downgradesNU1901–NU1904from build errors to warnings inDirectory.Build.props, the intent appears to be shifting vulnerability gating from build-time to this CI job — in which caselowis defensible, but may cause friction. There is noallow-ghsasescape hatch configured, so unblocking a PR requires editing the workflow.Also note: this job has no
if:guard and runs on all PRs, unlike other jobs that skip on docs-only ortests/k6/**changes. This is appropriate for a security gate and intentional-by-design.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/ci-cd-pull-request.yml around lines 65 - 79, Update the dependency-review job to use a less noisy failure threshold by changing the actions/dependency-review-action input fail-on-severity from "low" to "moderate" or "high" (modify the fail-on-severity key in the dependency-review job), and optionally add an allow-ghsas or similar exception mechanism if you want allowed/unblockable advisories; ensure the uses: actions/dependency-review-action and comment-summary-in-pr inputs remain unchanged so the action still posts PR summaries.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In @.github/workflows/ci-cd-pull-request.yml:
- Around line 65-79: Update the dependency-review job to use a less noisy
failure threshold by changing the actions/dependency-review-action input
fail-on-severity from "low" to "moderate" or "high" (modify the fail-on-severity
key in the dependency-review job), and optionally add an allow-ghsas or similar
exception mechanism if you want allowed/unblockable advisories; ensure the uses:
actions/dependency-review-action and comment-summary-in-pr inputs remain
unchanged so the action still posts PR summaries.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 2ae13c49-aec9-4575-95bd-82fdd1b97b0c
📒 Files selected for processing (2)
.github/workflows/ci-cd-pull-request.ymlDirectory.Build.props
✅ Files skipped from review due to trivial changes (1)
- Directory.Build.props
oskogstad
changed the title
elsand
previously approved these changes
Apr 18, 2026
Contributor
There was a problem hiding this comment.
Actionable comments posted: 7
♻️ Duplicate comments (1)
src/Digdir.Domain.Dialogporten.WebApi/packages.lock.json (1)
144-148:⚠️ Potential issue | 🟠 MajorAddress AutoMapper security vulnerability (duplicate finding).
AutoMapper 14.0.0 has the same HIGH severity DoS vulnerability (GHSA-rvv3-g6hj-g44x) flagged in the test project. This affects multiple projects in the solution. Once a patched version is identified, ensure it's updated consistently across all lock files.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@src/Digdir.Domain.Dialogporten.WebApi/packages.lock.json` around lines 144 - 148, The AutoMapper package entry ("AutoMapper") in the lock file is pinned to the vulnerable 14.0.0; update it to the patched version across all affected lock files (search for the "AutoMapper" entries in packages.lock.json files), regenerate the lock files (e.g., restore/restore-lock) so the resolved version is updated consistently, and verify the new resolved version replaces "14.0.0" in every occurrence to eliminate the GHSA-rvv3-g6hj-g44x vulnerability.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@src/Digdir.Domain.Dialogporten.Application/packages.lock.json`:
- Around line 11-18: Update the AutoMapper package reference in the
Digdir.Domain.Dialogporten.Application project: change the PackageReference for
"AutoMapper" in Digdir.Domain.Dialogporten.Application.csproj to a patched
version (e.g., 15.1.1 or 16.1.1+), restore/refresh NuGet packages and regenerate
the packages.lock.json so the lockfile reflects the new resolved AutoMapper
version, then commit the updated csproj and regenerated lockfile.
In `@src/Digdir.Domain.Dialogporten.GraphQL/packages.lock.json`:
- Around line 5-13: The lockfile shows AppAny.HotChocolate.FluentValidation
(0.12.0) depending on HotChocolate.Execution 14.1.0 which is incompatible with
the resolved HotChocolate 15.1.13 set; fix by either (A) replacing
AppAny.HotChocolate.FluentValidation with a compatible alternative (e.g., switch
to FairyBread or HotChocolate.Validation middleware and update package
references and registration code), (B) pin HotChocolate packages back to a 14.x
set that matches AppAny.HotChocolate.FluentValidation, or (C) use the unmerged
HC-15.1 branch of AppAny.HotChocolate.FluentValidation (PR `#116`) and update
project package references to that branch; update the project/nuget package
references (csproj/PackageReference or package management config) and regenerate
the lockfile so HotChocolate.Execution and AppAny.HotChocolate.FluentValidation
are aligned.
In `@src/Digdir.Domain.Dialogporten.Janitor/packages.lock.json`:
- Around line 219-223: The packages.lock.json currently pins AutoMapper at
14.0.0 which is vulnerable (GHSA-rvv3-g6hj-g44x); update the AutoMapper
dependency entry from 14.0.0 to a safe patched release (15.1.1 or 16.1.1
depending on the target framework) in your project dependency declarations
(where AutoMapper is referenced) and then regenerate all lockfiles
(packages.lock.json / any other lock manifests) so the resolved field for
AutoMapper reflects the new version; ensure the change propagates to any related
dependency entries (e.g., the AutoMapper package block in packages.lock.json)
and run a restore/build to verify no breaking changes.
In `@src/Digdir.Tool.Dialogporten.GenerateFakeData/packages.lock.json`:
- Around line 22-29: The project currently pins AutoMapper to 14.0.0 in the
.csproj which is vulnerable (GHSA-rvv3-g6hj-g44x); update the package reference
in the relevant .csproj to a patched release (>=15.1.1 or 16.1.1) replacing the
PackageReference for AutoMapper, then run dotnet restore / dotnet restore
--use-lock-file and regenerate all packages.lock.json files so the lockfiles
reflect the new version (verify AutoMapper entry in packages.lock.json shows
15.1.1 or 16.1.1); repeat for any other projects referencing AutoMapper and
commit the updated .csproj and regenerated lockfiles.
In `@tests/Digdir.Domain.Dialogporten.E2E.Cleanup.Tests/packages.lock.json`:
- Around line 62-68: The lockfile pins AutoMapper at 14.0.0 which is vulnerable
to GHSA-rvv3-g6hj-g44x; update the upstream package reference for AutoMapper
(the dependency named "AutoMapper" in packages.lock.json) to a patched version
(>=15.1.1 or >=16.1.1) in your project file(s), then
restore/restore-lock/regenerate the lockfile so packages.lock.json is updated
(ensure the "resolved" entry reflects the new version and re-run your restore
command to produce a new lockfile).
In `@tests/Digdir.Domain.Dialogporten.GraphQl.E2E.Tests/packages.lock.json`:
- Around line 107-113: The AutoMapper entry in packages.lock.json shows version
14.0.0 which has a DoS vulnerability; update your project NuGet reference(s) to
a fixed version (at least 15.1.1, or preferably 16.1.1) by changing the
AutoMapper package version in the project file(s) that reference AutoMapper,
then run dotnet restore (or your package restore) to regenerate
packages.lock.json so the "AutoMapper" resolved version reflects the upgraded
release; ensure any build/test CI steps pick up the new lock file and that
transitive consumers (see the "AutoMapper" entry and its
"Microsoft.Extensions.Options" dependency) remain compatible.
In
`@tests/Digdir.Domain.Dialogporten.Infrastructure.Unit.Tests/packages.lock.json`:
- Around line 62-69: The lockfile shows AutoMapper at 14.0.0 which is vulnerable
(CVE-2026-32933); update the AutoMapper package reference in the owning project
(where PackageReference for "AutoMapper" is declared) to 15.1.1 or newer,
restore/rebuild to regenerate the packages.lock.json, and commit the updated
lockfile so the tests use the patched AutoMapper version.
---
Duplicate comments:
In `@src/Digdir.Domain.Dialogporten.WebApi/packages.lock.json`:
- Around line 144-148: The AutoMapper package entry ("AutoMapper") in the lock
file is pinned to the vulnerable 14.0.0; update it to the patched version across
all affected lock files (search for the "AutoMapper" entries in
packages.lock.json files), regenerate the lock files (e.g.,
restore/restore-lock) so the resolved version is updated consistently, and
verify the new resolved version replaces "14.0.0" in every occurrence to
eliminate the GHSA-rvv3-g6hj-g44x vulnerability.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 9044a10c-3349-4e67-bb5c-93b8872c190d
📒 Files selected for processing (29)
Directory.Build.propssrc/Digdir.Domain.Dialogporten.Application/packages.lock.jsonsrc/Digdir.Domain.Dialogporten.Domain/packages.lock.jsonsrc/Digdir.Domain.Dialogporten.GraphQL/Digdir.Domain.Dialogporten.GraphQL.csprojsrc/Digdir.Domain.Dialogporten.GraphQL/packages.lock.jsonsrc/Digdir.Domain.Dialogporten.Infrastructure/packages.lock.jsonsrc/Digdir.Domain.Dialogporten.Janitor/packages.lock.jsonsrc/Digdir.Domain.Dialogporten.Service/packages.lock.jsonsrc/Digdir.Domain.Dialogporten.WebApi/packages.lock.jsonsrc/Digdir.Library.Dialogporten.WebApiClient.WebApiSample/packages.lock.jsonsrc/Digdir.Library.Dialogporten.WebApiClient/Directory.Build.propssrc/Digdir.Library.Dialogporten.WebApiClient/packages.lock.jsonsrc/Digdir.Library.Entity.Abstractions/packages.lock.jsonsrc/Digdir.Library.Entity.EntityFrameworkCore/packages.lock.jsonsrc/Digdir.Library.Utils.AspNet/Digdir.Library.Utils.AspNet.csprojsrc/Digdir.Library.Utils.AspNet/packages.lock.jsonsrc/Digdir.Tool.Dialogporten.GenerateFakeData/packages.lock.jsontests/Digdir.Domain.Dialogporten.Application.Integration.Tests/packages.lock.jsontests/Digdir.Domain.Dialogporten.Application.Unit.Tests/packages.lock.jsontests/Digdir.Domain.Dialogporten.Architecture.Tests/packages.lock.jsontests/Digdir.Domain.Dialogporten.E2E.Cleanup.Tests/packages.lock.jsontests/Digdir.Domain.Dialogporten.GraphQl.E2E.Tests/packages.lock.jsontests/Digdir.Domain.Dialogporten.GraphQl.Integration.Tests/packages.lock.jsontests/Digdir.Domain.Dialogporten.GraphQl.Unit.Tests/packages.lock.jsontests/Digdir.Domain.Dialogporten.Infrastructure.Unit.Tests/packages.lock.jsontests/Digdir.Domain.Dialogporten.WebAPI.E2E.Tests/packages.lock.jsontests/Digdir.Domain.Dialogporten.WebApi.Unit.Tests/packages.lock.jsontests/Digdir.Library.Dialogporten.E2E.Common/packages.lock.jsontests/Digdir.Library.Dialogporten.WebApiClient.Unit.Tests/packages.lock.json
✅ Files skipped from review due to trivial changes (7)
- src/Digdir.Library.Dialogporten.WebApiClient/Directory.Build.props
- src/Digdir.Library.Utils.AspNet/Digdir.Library.Utils.AspNet.csproj
- src/Digdir.Library.Entity.Abstractions/packages.lock.json
- src/Digdir.Domain.Dialogporten.Domain/packages.lock.json
- src/Digdir.Library.Entity.EntityFrameworkCore/packages.lock.json
- src/Digdir.Library.Dialogporten.WebApiClient/packages.lock.json
- src/Digdir.Domain.Dialogporten.GraphQL/Digdir.Domain.Dialogporten.GraphQL.csproj
🚧 Files skipped from review as they are similar to previous changes (1)
- Directory.Build.props
Collaborator
Author
|
@coderabbitai pause |
Contributor
✅ Actions performedReviews paused. |
|
majoer
approved these changes
Apr 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.