Bump Sarif.Sdk from 2.4.16 to 5.4.1#3396
Open
dependabot[bot] wants to merge 1 commit into
Open
Conversation
--- updated-dependencies: - dependency-name: Sarif.Sdk dependency-version: 5.4.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Contributor
|
Thank you for your contribution, one of the team will evaluate shortly. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updated Sarif.Sdk from 2.4.16 to 5.4.1.
Release notes
Sourced from Sarif.Sdk's releases.
4.6.5
v4.6.5 Sdk | Driver | Converters | Multitool | Multitool Library
AccessViolationExceptioninEnumeratedArtifact.RetrieveDataFromStreamwhen the caller-provided stream'sSeekre-enters native code (e.g. ASP.NET WebAPI'sSeekableBufferedRequestStreamover IIS'sHttpBufferlessInputStream). Always rewind viaPeekableStreaminstead of trustingStream.CanSeek.4.6.4
v4.6.4 Sdk | Driver | Converters | Multitool | Multitool Library
partialFingerprintscheck fromBaseProvideRequiredResultProperties(Base1015), which removes the firing for ADO1015/ADO1017 and GH1015/GH1017. Both Advanced Security for Azure DevOps and GitHub code scanning computepartialFingerprintsautomatically when omitted, so theerror-level "this property is required by the {service} service" message was misleading. See GHAZDO third-party SARIF docs (Sprint 245ruleIdinclusion, Sprint 255advancedsecurity.publish.allowmissingpartialfingerprints) and GitHub code scanning SARIF support — Fingerprint generation. AI producers are already advised against persisting fingerprints by AI2011.Microsoft.CodeAnalysis.Sarif.Multitool.OptionsInterpretter(and its test classOptionsInterpretterTests) toOptionsInterpreter/OptionsInterpreterTests(singlet). External callers ofSarif.Multitool.Libraryconstructingnew OptionsInterpretter(...)must update tonew OptionsInterpreter(...).partitionmultitool verb that splits one SARIF log into many by strategy (PerRule(default),PerRunPerRule,PerRun,PerResult,PerRunPerTarget,PerRunPerTargetPerRule,PerIndexList). WrapsSarifPartitioner.Partition, so each output gets itstool.driver.rulesandrun.artifactspruned to only what the partition references.SplittingStrategy.PerIndexListplus the--indicesmini-language for explicit per-result bucket assignment:<runId>:<r1>,<r2>;<runId>:...|<bucket>..., with bare-int shorthand for run 0 and SARIF URL fallback (sarif:/runs/X/results/Y, §3.10.3). Optional--spillover-bucket NAMEcaptures uncovered results;--strict-coverageerrors on uncovered results. Duplicate or out-of-range addresses error.Microsoft.CodeAnalysis.Sarif.Writers.PartitionFunctions(ForStrategy,ForIndexList,ParseIndexSpec,ResultAddress) to centralize partition-key derivation across SDK consumers.System.ArgumentException: Illegal characters in path.thrown fromMultithreadedAnalyzeCommandBase.IsOpcArtifacton .NET Framework when an artifact's URI yields a file path containing characters illegal in a Windows path (e.g., the?of a URI query string, or|,<,>,"). The path is now sanitized viaPathExtensions.ReplaceInvalidCharInFileNamebefore being passed toPath.GetExtension.InvalidOperationException: Collection was modifiedthrown fromNewtonsoft.Json.JsonSerializerInternalWriter.SerializeDictionaryinsideSarifLogger.Disposeon .NET Framework whenSarifRewritingVisitor.VisitReportingDescriptorran concurrently with serialization on a peer logger that shared the sameReportingDescriptorinstance. The visitor now builds a newMessageStringsdictionary and assigns the field atomically, so any concurrent reader sees a stable dictionary that nobody is mutating.4.6.3
v4.6.3 Sdk | Driver | Converters | Multitool | Multitool Library
AI1xxx= MUST/SHALL error;AI2xxx= SHOULD warning/note).AI2006→AI1005,AI1007→AI2014. TheAI3xxxseries is eliminated.AI1010.EvidenceBackingResolvable(error) — everysarif:URI inai/evidence[].backingSHALL resolve to an element within the log file (§3.10.3).AI1011.RedactedRunMarker(error) —ai/redactedSHALL betrueor absent (neverfalse); whentrue,run.redactionTokensSHALL be non-empty;ai/fullLogLocationSHALL NOT appear unlessai/redactedistrue.AI1012.ProvideRuleSubId(error) — AI-generated results MUST carry a hierarchical sub-component onresult.ruleIdbeyond the basereportingDescriptor.id.AI1013.NotificationAssociatedRuleResolvable(error) — ifnotification.associatedRuleis present, it SHALL resolve to a valid rule intool.driver.rules[]or an extension'srules[].AI1014.ExecutionNotificationPlacement(error) —AI/EXEC/*descriptors SHALL appear only intoolExecutionNotifications;AI/CFG/*descriptors SHALL appear only intoolConfigurationNotifications.AI2015.ProvideAttackerPosition(warning) — each result SHOULD declareai/attackerPosition. Follows the all-or-nothing pattern.AI2016.EvidenceBackingConsistency(warning) — anai/evidence[]entry withstrength: "demonstrated"SHOULD carry non-emptybacking.AI2017.ProvideNotificationDescriptor(warning) — every notification SHOULD have adescriptorthat resolves to areportingDescriptorintool.driver.notifications[].AI2018.ProvideExecutionSignalArtifact(note) —AI/EXEC/ALAS-SIGNALnotifications SHOULD include alocations[]entry referencing a valid artifact withrolescontaining"attachment".AI2019.ProvideNotificationTimestamp(note) — notifications SHOULD includetimeUtcfor execution timeline reconstruction.4.6.2
v4.6.2 Sdk | Driver | Converters | Multitool | Multitool Library
4.6.1
v4.6.1 Sdk | Driver | Converters | Multitool | Multitool Library
--post-urivalidation. The driver now appends?healthcheck=trueto POST URIs during validation and accepts HTTP 202 (Accepted), or 422 (Unprocessable Entity) as valid responses. This provides better support for endpoints that implement health check functionality while maintaining backwards compatibility with servers that return 422 for empty payloads.SarifLogger.AnalyzingTargetnow optionally emits an explicit artifacts table entry (withAnalysisTargetrole) for every scan target whenOptionallyEmittedData.AnalysisTargetsis set via--insert.4.6.0
v4.6.0 Sdk | Driver | Converters | Multitool | Multitool Library
kustocommand inSarif.Multitool.net8.0.HashData.MD5,HashUtilities.ComputeMD5Hashdue to the inherent insecurity of this algorithm.Microsoft.Azure.Kusto.Data.Azure.Identityreference from 1.10.2 to 1.13.1 inWorkItemsandSarif.Multitool.Libraryto resolve CVE-2024-29992 and other CVEs.Azure.Corefrom 1.35.0 to 1.41.1 to satisfy minimum requirement ofAzure.Identity1.12.1 (that has no known vulnerabilities).System.Text.Encodings.Webfrom 5.0.1 to 6.0.0 (required by transitive closure of dependency requirements from other updates).Newtonsoft.Jsonreferences to 13.0.3 to resolve CVE-2024-21907.Microsoft.Data.SqlClientfrom 2.1.7 to 5.2.2 so its dependenciesMicrosoft.IdentityModel.JsonWebTokensandSystem.IdentityModel.Tokens.Jwtupgrade to non-vulnerable version 6.35.0 (GHSA-59j7-ghrg-fj52).-r(recurse) flag during the multi-threaded analysis file enumeration phase.ERR997.NoValidAnalysisTargetswhen scanning symbolic link files.ERR997.NoValidAnalysisTargetswhen passing wildcard patterns (e.g., *.txt) toOrderedFileSpecifier. A recent change limited our wildcard support strictly to use of * only.ERR999.UnhandledEngineException: System.IO.FileNotFoundException: Could not find filewhen a file name or directory path contains URL-encoded characters.ERR997.NoValidAnalysisTargetswhen ambiguous file/directory references are provided toOrderedFileSpecifier. Previously, the code required an explicit directory separator to be added to the end of a directory path. Now, the code inspects the file system and assumes that a reference to an existing directory was intended by the user (even without a trailing separator).ERR997.NoValidAnalysisTargets | TargetParseErrorwhen processing OPC files by correctly handling programmatic usage and skipping redundant file access when a stream is provided viaEnumeratedArtifact.UriFormatException: Invalid URI: The format of the URI could not be determined.when creating aZipArchiveArtifactwith a relative URI.MultithreadedCommandBaseto check for empty or oversized artifacts before attempting to load OPC artifacts. This avoids unnecessary processing and improves performance by skipping invalid inputs early.MultithreadedZipArchiveArtifactProvider(which indicates that enumerated artifact paths should not include the base archive).LogTargetParseError(IAnalysisContext, Region, string, Exception)to include optional exception argument to denote code location where parse error occurred.MultithreadedAnalyzeCommandBase.EnumerateArtifactnow supports scanning into compressed (OPC) files. Initial support file extensions are:.apk,.appx,.appxbundle,.docx,.epub,.jar,.msix,.msixbundle,.odp,.ods,.odt,.onepkg,.oxps,.pkg,.pptx,.unitypackage,.vsix,.vsdx,.xps,.xlsx,.zip.4.5.4
v4.5.4 Sdk | Driver | Converters | Multitool | Multitool Library
4.5.3
v4.5.3 Sdk | Driver | Converters | Multitool | Multitool Library
4.5.2
v4.5.2 Sdk | Driver | Converters | Multitool | Multitool Library
4.5.1
v4.5.1 Sdk | Driver | Converters | Multitool | Multitool Library
SarifandSarif.Driverto resolve version conflict build error.System.Diagnostics.Debug4.3.0,System.IO.FileSystem.Primitives4.3.0,System.Text.Encoding.Extensions4.3.0.4.5.0
v4.5.0 Sdk | Driver | Converters | Multitool | Multitool Library
System.Text.Encoding.CodePagesfrom 8.0.0 to 4.3.0 inSarif.System.MemoryandSystem.Runtime.CompilerServices.Unsafe.System.Collections.Immutable.Microsoft.Data.SqlClientreference from 2.1.2 to 2.1.7 inWorkItemsandSarif.Multitool.Libraryto resolve CVE-2024-0056.System.Data.SqlClientreference from 4.8.5 to 4.8.6 inWorkItemsto resolve CVE-2024-0056.FileEncoding.IsTextualDatamethod for detecting binary files.Stack.Createmethod to populate missingPhysicalLocationinstances when stack frames reference relative file paths.UnsupportedOperationExceptioninZipArchiveArtifact.MultithreadedAnalyzeCommandBaseto return rich return code with the--rich-return-codeoption.IsBinaryproperty toIEnumeratedArtifactand implement the property inZipArchiveArtifact.IsBinarycategorization forZipArchiveArtifacts.max-file-size-in-kbparameter to 10 megabytes.--timeout-in-secondsparameter toAnalyzeOptionsBase, which will override theTimeoutInMillisecondsproperty inAnalyzeContextBase.--post-uriwill skip sending the SARIF log to the configured endpoint if the file contains no results or fatal execution errors.ADO1011.ReferenceFinalSchema,ADO1013.ProvideRequiredSarifLogProperties,ADO1014.ProvideRequiredRunProperties,ADO1015.ProvideRequiredResultProperties,ADO1016.ProvideRequiredLocationProperties,ADO1017.ProvideRequiredPhysicalLocationProperties,ADO1018.ProvideRequiredToolProperties,ADO2012.ProvideRequiredReportingDescriptorProperties,GH1011.ReferenceFinalSchema,GH1013.ProvideRequiredSarifLogProperties,GH1014.ProvideRequiredRunProperties,GH1015.ProvideRequiredResultProperties,GH1016.ProvideRequiredLocationProperties,GH1017.ProvideRequiredPhysicalLocationProperties,GH1018.ProvideRequiredToolProperties,GH2012.ProvideRequiredReportingDescriptorProperties.--rule-kindparameter toAnalyzeOptionsBase, which specifies rule kinds to run (Sarif,Ghas,Ado). Example:--rule-kind Ado;Sarif.4.2.1
SARIF Package Release History (SDK, Driver, Converters, and Multitool)
v4.2.1 Sdk | Driver | Converters | Multitool | Multitool Library
NotSupportedExceptionthrown (on .NET 4.8 and earlier) on accessingDeflateStream.LengthfromMultithreadedZipArchiveArtifactProvider.SizeInBytesproperty.4.0.0
v4.0.0 Sdk | Driver | Converters | Multitool | Multitool Library
SarifLoggerno longer allows providing aToolinstance. Use therunparameter instead (and populate it with any customToolobject). #2614SarifLoggerupdates version details differently. #2611ToolComponentargument toIAnalysisLogger.Log(ReportingDescriptor, Result)method. #2611--normalize-for-githubargument to--normalize-for-ghasforconvertcommand and mark--normalize-for-githubas obsolete. #2581IAnalysisContext.LogToolNotificationmethod to addReportingDescriptorparameter. This is required in order to populatedAssociatedRuledata inNotificationinstances. The new method has an option value of null for theassociatedRuleparameter to maximize build compatibility. #2604LogMissingreportingConfigurationhelper toLogMissingReportingConfiguration. #2599MaxFileSizeInKilobytesfrom int to long inIAnalysisContextand other classes. #2599Guidproperties defined in SARIF spec, updated Json schema to useuuid, and updated C# object model to useGuid?instead ofstring. #2555AnalyzeCommandBaseas obsolete. This type will be removed in the next significant update. #2599LogUnhandledEngineExceptionno longer has a return value (and updates theRuntimeErrorscontext property directly as other helpers do). #2599MultithreadedAnalyzeCommandBaseby correcting task creation. []#2618](Threading fixes sarif-sdk#2618)Collection was modified; enumeration operation may not executeinMultithreadedAnalyzeCommandBase, raised when analyzing with the--hashesswitch. #2459. There was a previous attempt to fix this in #2447.match-results-forwardcommand fails to generate VersionControlDetails data. #2487match-results-forwardcommands for results with sub-rule ids. #2486mergecommand to properly produce runs by tool and version when passed the--merge-runsargument. #2488IOExceptionandDirectoryNotFoundExceptionexceptions thrown bymergecommand when splitting by rule (due to invalid file characters in rule ids). #2513virtualkeyword for public methods and properties, by regenerate and manually sync the changes. #2537NullReferenceExceptionwhen file hashing fails (due to file locked or other errors reading the file). #2596PluginDriverproperty (AdditionalOptionsProvider) that allows additional options to be exported (typically for command-line arguments). #2599LogFileSkippedDueToSizethat fires a warning notification if any file is skipped due to exceeding size threshold. #2599ShouldEnqueuepredicate method to filter files from driver processing. #2599ShouldComputeHashespredicate method to prevent files from hashing. #2601MaxFileSizeInKilobytes, which will allow SDK users to change the value. (Default value is 1024) #2578GH1007, which requires flattened result message so GHAS code scanning can ingest the log. #2580SarifLoggerwith aFileRegionsCacheinstance.InsertOptionalDataVisitor(previously initialized exclusively fromFileRegionsCache.Instance).trace and emitted timing data. ProvideScanExecution` trace with no utilization.LogToolNotificationas called fromSarifLogger. #2604--normalize-for-ghasargument to therewritecommand to ensure rewritten SARIF is compatible with GitHub Advanced Security (GHAS) ingestion requirements. #2581SarifLoggernow supports extensions rules data when logging (by providing aToolComponentinstance to the result logging method). #2661SarifLoggerprovides aComputeHashDatacallback to provide hash data for in-memory scan targets. #2614HashUtilities.ComputeHashes(Stream)and `ComputeHashesForText(string) helpers. #26143.1.0
v3.1.0 Sdk | Driver | Converters | Multitool | Multitool Library
System.Collections.Immutableminimum version requirement to 1.5.0. #25043.1.0-beta1
v3.1.0-beta1 Sdk | Driver | Converters | Multitool | Multitool Library
System.Collections.Immutable1.5.0. #25043.0.0
v3.0.0 Sdk | Driver | Converters | Multitool | Multitool Library
JsonConvert.Defaultsis not already configured) to address GitHub advisory GHSA-5crp-9r3c-p9vr.3.0.0-beta1
SARIF Package Release History (SDK, Driver, Converters, and Multitool)
3.0.0-beta1 Sdk | Driver | Converters | Multitool | Multitool Library
JsonConvert.Defaultsis not already configured) to address GitHub advisory GHSA-5crp-9r3c-p9vr.Commits viewable in compare view.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)