chore(auth): bump ZB.MOM.WW.Auth 0.1.1 -> 0.1.5 (family alignment) #484

2026-07-20T06:03:38-04:00

dohertj2 commented

2026-07-20 06:03:38 -04:00

Summary

Aligns OtOpcUa with the rest of the family on ZB.MOM.WW.Auth 0.1.5. mxgw, HistorianGateway and ScadaBridge have all been on 0.1.5; OtOpcUa was four versions behind and the only outlier.

The bump is functionally inert here, and that is the point. OtOpcUa consumes Abstractions + Ldap + AspNetCore, not ApiKeys — and every intervening change was in ApiKeys:

Version	Change	Reaches OtOpcUa?
0.1.2	ApiKeys schema-version stamp	No
0.1.3	`IApiKeyAdminStore.SetScopes/SetEnabled`	No
0.1.4	`ApiKeyRecord.ExpiresUtc` + verifier enforcement	No
0.1.5	Patched SQLitePCLRaw pin (GHSA-2m69-gcr7-jv3q)	Already covered

The 0.1.5 security pin was not an open exposure here: this repo already carries its own surgical transitive pin for SQLitePCLRaw.bundle_e_sqlite3 2.1.12 at Directory.Packages.props:105.

So the value is removing a false signal. A repo sitting four versions behind reads as "missing something" every time someone audits the family, and the next real Auth change would have arrived as a four-version jump rather than one.

Test Plan

Build 861 warnings / 0 errors — byte-identical to the master baseline. Measured, not assumed: master was built separately to compare, so the pre-existing warning count is not being attributed to this change.
Security 84 pass
AdminUI 665 pass
Configuration 121 pass
ControlPlane 78 pass

Auth-relevant offline suites only; integration suites needing live fixtures were not run.

Context

Found while surveying shared-library drift across the family after publishing ZB.MOM.WW.LocalDb 0.1.1. Full survey result: Auth was the only real drift. Everything else is already aligned — Audit 0.1.0, Configuration 0.1.0, Health 0.1.0, Telemetry 0.1.0, Theme 0.3.1, Secrets 0.2.3 across all four apps.

https://claude.ai/code/session_01BL2Vu1ESDQ9SCN4gVKkdts

## Summary Aligns OtOpcUa with the rest of the family on `ZB.MOM.WW.Auth` **0.1.5**. mxgw, HistorianGateway and ScadaBridge have all been on 0.1.5; OtOpcUa was four versions behind and the only outlier. **The bump is functionally inert here, and that is the point.** OtOpcUa consumes Abstractions + Ldap + AspNetCore, *not* ApiKeys — and every intervening change was in ApiKeys: | Version | Change | Reaches OtOpcUa? | |---|---|---| | 0.1.2 | ApiKeys schema-version stamp | No | | 0.1.3 | `IApiKeyAdminStore.SetScopes/SetEnabled` | No | | 0.1.4 | `ApiKeyRecord.ExpiresUtc` + verifier enforcement | No | | 0.1.5 | Patched SQLitePCLRaw pin (GHSA-2m69-gcr7-jv3q) | Already covered | The 0.1.5 security pin was **not** an open exposure here: this repo already carries its own surgical transitive pin for `SQLitePCLRaw.bundle_e_sqlite3` 2.1.12 at `Directory.Packages.props:105`. So the value is removing a false signal. A repo sitting four versions behind reads as "missing something" every time someone audits the family, and the next *real* Auth change would have arrived as a four-version jump rather than one. ## Test Plan - [x] Build **861 warnings / 0 errors** — byte-identical to the `master` baseline. Measured, not assumed: `master` was built separately to compare, so the pre-existing warning count is not being attributed to this change. - [x] `Security` 84 pass - [x] `AdminUI` 665 pass - [x] `Configuration` 121 pass - [x] `ControlPlane` 78 pass Auth-relevant offline suites only; integration suites needing live fixtures were not run. ## Context Found while surveying shared-library drift across the family after publishing `ZB.MOM.WW.LocalDb` 0.1.1. Full survey result: Auth was the **only** real drift. Everything else is already aligned — Audit 0.1.0, Configuration 0.1.0, Health 0.1.0, Telemetry 0.1.0, Theme 0.3.1, Secrets 0.2.3 across all four apps. https://claude.ai/code/session_01BL2Vu1ESDQ9SCN4gVKkdts

dohertj2 added 1 commit 2026-07-20 06:03:39 -04:00

chore(auth): bump ZB.MOM.WW.Auth 0.1.1 -> 0.1.5

v2-ci / build (pull_request) Successful in 3m56s

Details

v2-ci / unit-tests (pull_request) Failing after 11m26s

Details

a5eac3ec78

Aligns OtOpcUa with the rest of the family — mxgw, HistorianGateway and
ScadaBridge have all been on 0.1.5; OtOpcUa was four versions behind and the
only outlier.

The bump is functionally inert here, deliberately so. OtOpcUa consumes
Abstractions + Ldap + AspNetCore, NOT ApiKeys, and every intervening change was
in ApiKeys: 0.1.2 stamped its schema version, 0.1.3 added SetScopes/SetEnabled,
0.1.4 added ExpiresUtc. 0.1.5 is the patched-SQLitePCLRaw pin
(GHSA-2m69-gcr7-jv3q), which this repo already carries independently as its own
surgical transitive pin at Directory.Packages.props:105 — so no vulnerability
was open here either.

The value is removing a false signal: a repo sitting four versions behind reads
as "missing something" every time someone audits the family, and the next real
Auth change would have arrived as a four-version jump instead of one.

Verified: build 861 warnings / 0 errors, byte-identical to the master baseline
(measured, not assumed — master was built to compare). Security 84, AdminUI
665, Configuration 121, ControlPlane 78 — all pass, 0 failures.

Claude-Session: https://claude.ai/code/session_01BL2Vu1ESDQ9SCN4gVKkdts

dohertj2 merged commit 1adaa2fc01 into master

2026-07-20 06:06:13 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: dohertj2/lmxopcua#484