Problem
A high-severity Dependabot security alert (GHSA-rvv3-g6hj-g44x) has been raised against the AutoMapper 14.x dependency. The package was intentionally pinned to the 14.x line ([14.0.0,15.0.0) in the .csproj and via ignore rules in dependabot.yml) due to concerns about the commercial licensing introduced in AutoMapper 15.x.
Investigation shows that:
- The vulnerability (GHSA-rvv3-g6hj-g44x) affects the entire 14.x and 15.x lines, as well as 16.0.0 — the first clean version is 16.1.1.
- AutoMapper 15.x+ uses a dual-license model: free for open-source and non-commercial projects. As this is an open-source proof-of-concept with no commercial purpose, the licensing restriction does not apply.
- AutoMapper 16.x introduced a breaking API change: the
AddAutoMapper(Type) / AddAutoMapper(Assembly) DI overloads were removed in favour of AddAutoMapper(Action<IMapperConfigurationExpression>).
Reference: AutoMapper and MediatR Licensing Update – Jimmy Bogard
Proposed Solution
Upgrade AutoMapper from the pinned 14.x line to 16.x (minimum 16.1.1), remove the Dependabot ignore rules that prevented the major-version update, adapt the DI registration call to the new API, and verify that all existing mappings and tests continue to work correctly.
Suggested Approach
-
Update .csproj — change the version constraint for AutoMapper from [14.0.0,15.0.0) to [16.1.1,17.0.0) in src/Dotnet.Samples.AspNetCore.WebApi/Dotnet.Samples.AspNetCore.WebApi.csproj.
-
Update dependabot.yml — remove the ignore entries that pin AutoMapper to the 14.x major version from both NuGet entries (.github/dependabot.yml).
-
Fix DI registration — update AddMappings() in src/Dotnet.Samples.AspNetCore.WebApi/Extensions/ServiceCollectionExtensions.cs:
// Before (AutoMapper ≤15.x)
services.AddAutoMapper(typeof(PlayerMappingProfile));
// After (AutoMapper 16.x)
services.AddAutoMapper(cfg => cfg.AddProfile<PlayerMappingProfile>());
-
Verify PlayerMappingProfile.cs — confirm src/Dotnet.Samples.AspNetCore.WebApi/Mappings/PlayerMappingProfile.cs needs no further changes (standard CreateMap/ForMember/MapFrom/Ignore APIs are unaffected).
-
Run the test suite — dotnet test --settings .runsettings — all tests must pass before closing this issue.
-
Update CHANGELOG.md — add an entry under [Unreleased] > Changed.
Acceptance Criteria
References
Problem
A high-severity Dependabot security alert (GHSA-rvv3-g6hj-g44x) has been raised against the AutoMapper 14.x dependency. The package was intentionally pinned to the 14.x line (
[14.0.0,15.0.0)in the.csprojand viaignorerules independabot.yml) due to concerns about the commercial licensing introduced in AutoMapper 15.x.Investigation shows that:
AddAutoMapper(Type)/AddAutoMapper(Assembly)DI overloads were removed in favour ofAddAutoMapper(Action<IMapperConfigurationExpression>).Reference: AutoMapper and MediatR Licensing Update – Jimmy Bogard
Proposed Solution
Upgrade AutoMapper from the pinned
14.xline to16.x(minimum16.1.1), remove the Dependabot ignore rules that prevented the major-version update, adapt the DI registration call to the new API, and verify that all existing mappings and tests continue to work correctly.Suggested Approach
Update
.csproj— change the version constraint forAutoMapperfrom[14.0.0,15.0.0)to[16.1.1,17.0.0)insrc/Dotnet.Samples.AspNetCore.WebApi/Dotnet.Samples.AspNetCore.WebApi.csproj.Update
dependabot.yml— remove theignoreentries that pin AutoMapper to the 14.x major version from both NuGet entries (.github/dependabot.yml).Fix DI registration — update
AddMappings()insrc/Dotnet.Samples.AspNetCore.WebApi/Extensions/ServiceCollectionExtensions.cs:Verify
PlayerMappingProfile.cs— confirmsrc/Dotnet.Samples.AspNetCore.WebApi/Mappings/PlayerMappingProfile.csneeds no further changes (standardCreateMap/ForMember/MapFrom/IgnoreAPIs are unaffected).Run the test suite —
dotnet test --settings .runsettings— all tests must pass before closing this issue.Update
CHANGELOG.md— add an entry under[Unreleased] > Changed.Acceptance Criteria
[16.1.1,17.0.0)in the.csprojdependabot.ymldotnet restoreproduces no NU1903 warning)AddAutoMapperregistration updated to the 16.x config-action APIdotnet build --configuration Releasesucceeds with 0 warnings and 0 errorsdotnet test --settings .runsettings— all tests passCHANGELOG.mdupdated under[Unreleased]References
masterbranchdependabot.ymlpin comment:# Pin AutoMapper to 14.x line to avoid commercial v15.x upgrades