You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The package's DLLs carry their PDBs, with Source Link (#514, closes #513). Imposter.CodeGenerator.dll and Imposter.Abstractions.dll used to ship without symbols, so a debugger couldn't step into Imposter's runtime types or the generator. Both now embed their PDB, which points to the exact commit on GitHub through Source Link and embeds the sources git doesn't track. Imposter.Abstractions now also builds with deterministic source paths, as the generator already did, and a build from the same commit reproduces both DLLs byte for byte. The package grows from about 338 KB to 580 KB per Roslyn version.
Housekeeping
Runtime property helpers renamed (#499, closes #480). PropertyGetter<T>.EnableBaseImplementation is now UseBaseImplementation, matching the setter and the fluent setup API, and PropertySetter<T>.SetForInit is now RecordAndShouldCallBase. These members exist for generated code, which this release regenerates to match; behaviour is unchanged.
Documentation fixes in Imposter.Abstractions (#490, #493): wrong XML docs and comments in the runtime types, the generator and the argument matchers are corrected.
Generator cleanups with byte-identical output (#485, #486, #488, #489, #491, #492, #495–#498, #500, #501, #503–#508, #510–#512): duplicated builders, metadata and literals are consolidated, unused helpers removed, and member names read from the metadata that declares them.
The C# sources are normalized to UTF-8 with a BOM (#494), and a concurrency test's barrier has a timeout (#487).
Releases publish to nuget.org through trusted publishing instead of a stored API key (#516, closes #515). The expired key had stopped 1.0.11 from reaching NuGet, so this release carries its changes.
HIGH: X.509 certificate chain verification ignores name constraints.
pki.verifyCertificateChain() does not check the nameConstraints
extension (RFC 5280 4.2.1.10). A non-critical nameConstraints extension
in a CA certificate is ignored, so a name-constrained intermediate CA can
issue certificates for names outside its permitted subtrees, or inside
its excluded subtrees, and the chain verifies. Exploitation requires the
private key of a name-constrained CA that chains to a trusted root. A
critical nameConstraints extension is rejected as an unsupported critical
extension.
MODERATE: TLS client crash on a handshake record without a session.
A TLS client throws an uncaught TypeError from process() when it
receives a ServerHello while it has no session: after a close_notify
alert or a call to close(), or before handshake() is called. A
malicious server, or an on-path attacker, can terminate a Node.js process
that passes socket data to process() without catching exceptions.
Servers are not affected.
MODERATE: ReDoS in forge.http response header parsing.
forge.http trims response header and Set-Cookie values with a
regular expression that takes quadratic time on a long run of whitespace
followed by another character. A server, or an on-path attacker, can
block a forge.http client for minutes with one large header.
MODERATE: TLS client crash on an unsupported ServerHello compression
method.
A TLS client accepts any compression method in the ServerHello,
although it only offers no compression. An unknown method makes process() throw an uncaught Error at ServerHelloDone, before the
server is authenticated. A malicious server, or an on-path attacker, can
terminate a Node.js process that passes socket data to process()
without catching exceptions, including through forge.tls.wrapSocket.
Servers are not affected.
LOW: Ed25519 signature verification accepts small-order public keys.
ed25519.verify() does not reject public keys of small order, such as
the identity point. Under such a key, a signature with S = 0 and a
small-order R verifies for many or, with the identity key, all
messages, without any private key. Applications are affected only if
they verify signatures against a public key an attacker can choose and
rely on the signature being bound to the message. Signatures made with
keys from ed25519.generateKeyPair() or other honest key generation are
not affected.
[x509] Parse the nameConstraints extension (2.5.29.30) into permittedSubtrees, excludedSubtrees and unsupportedSubtreeRange. An
invalid value is left unparsed.
Fixed
[ed25519] Reject small-order public keys in ed25519.verify().
[x509] Enforce nameConstraints in verifyCertificateChain() for the
subject and subjectAltName rfc822Name, dNSName, directoryName,
uniformResourceIdentifier and iPAddress names of each certificate, using
the constraints of the CA certificates above it and of the trust anchor.
Violations fail with bad_certificate, and the error has nameType and nameValue. Critical nameConstraints are no longer rejected as
unsupported. As in OpenSSL:
The commonName values of an end-entity certificate without a dNSName
subjectAltName are checked as dNSNames when they look like host names.
directoryName values are compared ignoring ASCII case and extra
whitespace.
Constraints that can't be evaluated for a name of the same type, names
that can't be checked against a constraint of the same type, and more
than 2^20 name and subtree comparisons for a chain fail with unsupported_certificate.
NOTE: Chains with a non-critical nameConstraints extension that the
names below it violate now fail verification. Chains with a critical
nameConstraints extension now verify when the names are within the
constraints, instead of always failing. A verify callback can still
override any error.
[tls] Ignore handshake messages received by a client without a session
instead of throwing a TypeError.
[http] Trim header and cookie values in linear time.
[tls] Fail a client handshake with an illegal_parameter alert when the
ServerHello selects a compression method other than none.
Configuration
📅 Schedule: (UTC)
Branch creation
At any time (no schedule defined)
Automerge
At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
If you want to rebase/retry this PR, check this box
No actionable comments were generated in the recent review.
Walkthrough
The pull request updates the centrally managed Imposter version and the documentation package’s node-forge resolution. It also updates verified snapshots for generic property getters and generic test-instance factories.
Changes: Imposter package update
Layer / File(s)
Summary
Update Imposter version Directory.Packages.props
The centrally managed Imposter package version changes from 1.0.10 to 1.0.12.
node-forge resolution update
Layer / File(s)
Summary
Update node-forge resolution docs/package.json
The node-forge resolution changes from 1.4.2 to 1.4.3.
Generic property metadata snapshots
Layer / File(s)
Summary
Update generic test snapshots tests/TUnit.Core.SourceGenerator.Tests/ClassArgumentParameterTypesTests.Test.verified.txt, tests/TUnit.Core.SourceGenerator.Tests/GenericPropertyMetadataTests.GeneratesCachedAotCompatibleGetters.verified.txt
The snapshots record PropertyMetadataFactory.CreateGenericGetter for generic test properties. The test-instance factories cast supplied arguments with CastHelper.Cast<T> and call the closed generic constructors directly instead of using Activator.CreateInstance.
A rabbit checks the snapshots bright, Generic getters now sit right. Direct constructors greet each cast, Two package versions change at last. I nibble carrots, hop away.
Recent review info
Run configuration
Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: f19f743a-a462-424b-ab46-0be4545a1618
Commits
Reviewing files that changed from the base of the PR and between 2f456c4 and 68a24f7.
Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 4 remain after this review.
Fixed the CI failures in 68a24f7. Two generator snapshots were stale after the existing constructor-generation changes and #7524's cached generic property getters. Reviewed all five changed lines and updated only the .verified.txt baselines.
Validation: .NET SDK 10.0.403; full core generator snapshot suite on net10.0: 329 passed, 1 skipped, 0 failed. Other runtime legs remain for CI (only .NET 10 is installed locally).
Reviewed conversation comments, formal reviews, and review threads; no blocking findings. CodeRabbit's title suggestion is a nonblocking nit: retaining Renovate's configured grouped-update title. Disabled auto-merge before pushing; leaving this Renovate PR to Renovate's merge lifecycle, as repository guidance requires.
The current head 68a24f7459ac55cd53826ae0edc33216da58d160 has passed every applicable CI check; Claude review is intentionally skipped for Renovate. Codex reports no findings for this head, CodeRabbit and Greptile report no blockers, and there are no inline review threads. The snapshot fix for #7537 is included with a closing reference.
Merge handoff needs owner attention: GitHub auto-merge is currently disabled (the earlier repair unit disabled it before pushing). .agents/skills/issue-pr-loop/references/repository.md explicitly leaves Renovate PRs to Renovate and prohibits the loop's merge wrappers from merging them. There is no remaining code or CI repair to make in this PR.
Recommendation: restore this green PR's merge through Renovate or merge it as the owner. Alternatively, explicitly authorize a change to the loop's Renovate merge policy. Added needs-human to prevent repeated agent units on this unchanged policy gate; remove it once the merge handoff is resolved. #7537 remains open until this PR merges.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
thomhurst
added
dependencies
GitHub Actions
Failure
This PR contains the following updates:
1.0.10→1.0.121.4.2→1.4.3Release Notes
themidnightgospel/Imposter (Imposter)
v1.0.12: Debug symbols and Source Link in the packageCompare Source
Debugging
Imposter.CodeGenerator.dllandImposter.Abstractions.dllused to ship without symbols, so a debugger couldn't step into Imposter's runtime types or the generator. Both now embed their PDB, which points to the exact commit on GitHub through Source Link and embeds the sources git doesn't track.Imposter.Abstractionsnow also builds with deterministic source paths, as the generator already did, and a build from the same commit reproduces both DLLs byte for byte. The package grows from about 338 KB to 580 KB per Roslyn version.Housekeeping
PropertyGetter<T>.EnableBaseImplementationis nowUseBaseImplementation, matching the setter and the fluent setup API, andPropertySetter<T>.SetForInitis nowRecordAndShouldCallBase. These members exist for generated code, which this release regenerates to match; behaviour is unchanged.digitalbazaar/forge (node-forge)
v1.4.3Compare Source
Security
pki.verifyCertificateChain()does not check the nameConstraintsextension (RFC 5280 4.2.1.10). A non-critical nameConstraints extension
in a CA certificate is ignored, so a name-constrained intermediate CA can
issue certificates for names outside its permitted subtrees, or inside
its excluded subtrees, and the chain verifies. Exploitation requires the
private key of a name-constrained CA that chains to a trusted root. A
critical nameConstraints extension is rejected as an unsupported critical
extension.
TypeErrorfromprocess()when itreceives a ServerHello while it has no session: after a
close_notifyalert or a call to
close(), or beforehandshake()is called. Amalicious server, or an on-path attacker, can terminate a Node.js process
that passes socket data to
process()without catching exceptions.Servers are not affected.
forge.httpresponse header parsing.forge.httptrims response header andSet-Cookievalues with aregular expression that takes quadratic time on a long run of whitespace
followed by another character. A server, or an on-path attacker, can
block a
forge.httpclient for minutes with one large header.method.
although it only offers no compression. An unknown method makes
process()throw an uncaughtErrorat ServerHelloDone, before theserver is authenticated. A malicious server, or an on-path attacker, can
terminate a Node.js process that passes socket data to
process()without catching exceptions, including through
forge.tls.wrapSocket.Servers are not affected.
Ed25519signature verification accepts small-order public keys.ed25519.verify()does not reject public keys of small order, such asthe identity point. Under such a key, a signature with
S = 0and asmall-order
Rverifies for many or, with the identity key, allmessages, without any private key. Applications are affected only if
they verify signatures against a public key an attacker can choose and
rely on the signature being bound to the message. Signatures made with
keys from
ed25519.generateKeyPair()or other honest key generation arenot affected.
Added
2.5.29.30) intopermittedSubtrees,excludedSubtreesandunsupportedSubtreeRange. Aninvalid value is left unparsed.
Fixed
ed25519] Reject small-order public keys ined25519.verify().verifyCertificateChain()for thesubject and subjectAltName rfc822Name, dNSName, directoryName,
uniformResourceIdentifier and iPAddress names of each certificate, using
the constraints of the CA certificates above it and of the trust anchor.
Violations fail with
bad_certificate, and the error hasnameTypeandnameValue. Critical nameConstraints are no longer rejected asunsupported. As in OpenSSL:
subjectAltName are checked as dNSNames when they look like host names.
whitespace.
that can't be checked against a constraint of the same type, and more
than 2^20 name and subtree comparisons for a chain fail with
unsupported_certificate.names below it violate now fail verification. Chains with a critical
nameConstraints extension now verify when the names are within the
constraints, instead of always failing. A
verifycallback can stilloverride any error.
instead of throwing a
TypeError.illegal_parameteralert when theServerHello selects a compression method other than none.
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate CLI.
Summary by CodeRabbit
Closes #7537