dohertj2/scadaproj
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: record Auth 0.1.5 consumer bumps + the pre-existing AngleSharp build break

Browse Source 
Closes out the security-fix rollout: mxaccessgw, ScadaBridge and HistorianGateway
are all on Auth 0.1.5 and pushed. Exposure was checked per repo rather than assumed --
only mxaccessgw and ScadaBridge actually resolved the vulnerable 2.1.11;
HistorianGateway already resolved 3.50.3, and OtOpcUa takes no ApiKeys/SQLite
dependency at all.

Also records two things worth not rediscovering: HistorianGateway's bump is
unverified by tests, and both it and ScadaBridge have a pre-existing AngleSharp
NU1902 error failing full-solution builds under TreatWarningsAsErrors.

Claude-Session: https://claude.ai/code/session_01BL2Vu1ESDQ9SCN4gVKkdts
This commit is contained in:
Joseph Doherty
2026-07-18 03:21:00 -04:00
parent 5e9cbd3ecf
commit e46060fada
2 changed files with 19 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/auth/GAPS.md
+12 -3
View File
@@ -8,9 +8,18 @@ reach the shared `ZB.MOM.WW.Auth` library. Status legend: ⛔ gap · 🟡 partia
> `SQLitePCLRaw.lib.e_sqlite3 2.1.11` (GHSA-2m69-gcr7-jv3q). `0.1.5` pins the patched `2.1.12`
> (same approach as `ZB.MOM.WW.LocalDb`); the `.nuspec` declares it directly, so consumers get
> the fix on bump without pinning themselves. **No API change** — `0.1.5` is `0.1.4` plus the pin.
> **All three ApiKeys consumers are still on vulnerable versions** (mxaccessgw `0.1.4`,
> HistorianGateway `0.1.4`, ScadaBridge `0.1.3`) → bump to `0.1.5`. Note ScadaBridge's
> `0.1.3`→`0.1.5` jump also crosses the `0.1.4` `ExpiresUtc` verifier change.
> **All three consumers bumped to `0.1.5` the same day** (mxaccessgw `e107019`, ScadaBridge
> `50d79ed1`, HistorianGateway `df211ee` — all pushed). Exposure was verified per repo rather
> than assumed: mxaccessgw and ScadaBridge genuinely resolved the vulnerable `2.1.11` and now
> resolve `2.1.12`; **HistorianGateway was never exposed** (already resolved `3.50.3` via another
> dependency), so its bump is consistency-only. ScadaBridge's `0.1.3`→`0.1.5` jump crosses the
> `0.1.4` `ExpiresUtc` change, but that was additive — no source changes were needed and its
> suites match baseline exactly (Security 181, InboundAPI 269). **OtOpcUa stays at `0.1.1`** and
> was never exposed: it takes no `ApiKeys`/SQLite dependency.
>
> ⚠️ **Caveat:** HistorianGateway's bump could NOT be test-verified — a pre-existing, unrelated
> `AngleSharp` NU1902 error blocks its test project under `TreatWarningsAsErrors` (ScadaBridge's
> `CentralUI.Tests` has the same break). Both confirmed present on clean trees beforehand.
>
> **Current state (verified 2026-07-18):** feed carries `0.1.0`–`0.1.5`; consumer pins are
> OtOpcUa `0.1.1`, ScadaBridge `0.1.3`, MxAccessGateway `0.1.4`, **HistorianGateway `0.1.4`**