Repository navigation
Drop explicit Microsoft.SourceLink.GitHub reference - #3222
Merged
Merged
Conversation
The .NET SDK has included and enabled Source Link for GitHub-hosted repos by default since 8.0.100; our pinned SDK is well past that. Referencing the package explicitly overrides the SDK's own version with ours, which is why we had to hand-bump it for a CVE in Microsoft.Build.Tasks.Git (#3210) - a class of maintenance the SDK now handles for us if we get out of its way. Verified the generated *.sourcelink.json and the packed nuspec <repository> element are unchanged across all six TFMs. Closes #3218
This was referenced Sep 16, 2026
mgravell
added a commit
to protobuf-net/protobuf-net
that referenced
this pull request
Sep 16, 2026
The SDK has included Source Link by default since 8.0.100, so an explicit reference only overrides the SDK's version with a hand-managed one — a standing maintenance cost, and somewhere a transitive advisory has to be chased by hand. Verified rather than assumed, since this repo is multi-TFM: building `protobuf-net.Core` with and without produces a **byte-identical `*.sourcelink.json` on all four target frameworks** — `net462`, `netstandard2.0`, `netstandard2.1`, `net8.0` — and the same nuspec `<repository>` element, commit and all. Following [StackExchange.Redis#3222](StackExchange/StackExchange.Redis#3222). The same change is open as protobuf-net.Grpc#398 and is already in protobuf-net.Connect's 1.0 branch.
mgravell
added a commit
that referenced
this pull request
Nov 2, 2026
…he previous call's reply (#3329) (#3331) * Drop the explicit Microsoft.SourceLink.GitHub reference, as main did in #3222 Microsoft.SourceLink.GitHub 8.0.0 pulls Microsoft.Build.Tasks.Git 8.0.0, which carries CVE-2026-62900 with no patched 8.x; on the SDKs CI and the release workflow install, NuGet audit reports that as NU1902 and TreatWarningsAsErrors turns it into a failed restore, so nothing on this branch currently builds. The SDK has shipped and enabled Source Link for GitHub repos itself since 8.0.100, and the explicit package only overrode the SDK's copy with our older one. * The read loop stops matching replies once teardown owns the response queue; a close with commands in flight no longer completes a call with the previous call's reply RecordConnectionFailed drains _writtenAwaitingResponse one message at a time, completing each outside the lock, while the read loop can still be matching replies already in the pipe. Each reply the loop matched after the drain had taken a message went to the message *after* the one it answered: GET key N completed, successfully, with key N-1's value, and every reply behind it was off by one. Rarer here than on main (the pipe tears down faster): 7 wrong replies in 100,000 calls with the reporter's loop, but it only takes one. A shutdown flag, set under the queue's lock before the drain begins and checked under it before the read loop dequeues, closes the race: once teardown has started the loop never takes another message, a reply arriving late is dropped with the connection, and the message it answered is failed by the drain as before. The test re-creates the scenario against the real server (20 rounds of 500 in-flight GETs closed with allowCommandsToComplete: false) and asserts that no call completes with another call's value. See #3329
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Microsoft.SourceLink.GitHubreference insrc/Directory.Build.props(and its version pin inDirectory.Packages.props) is redundant.Microsoft.Build.Tasks.Git, Bump SourceLink past CVE-2026-62900, and System.IO.Hashing with it #3210) required a manual bump. Dropping the reference hands that maintenance back to the SDK.Test plan
dotnet build Build.csproj -c Release /p:CI=true- 0 warnings, 0 errors, all TFMs*.sourcelink.jsonis still generated correctly (mapping to the built commit) for bothStackExchange.RedisandRESPiteacross every target framework, including net461/netstandard2.0dotnet packonStackExchange.Redis- confirmed the packed nuspec still carries the correct<repository>element with commit metadataCloses #3218