Bump Testcontainers.MsSql to 4.14.0 to clear NU1903 - #4652
Merged
Merged
Conversation
Testcontainers.MsSql 4.8.1 pulls SSH.NET 2024.2.0 transitively, which is covered by GHSA-q939-rpr3-3284 (high severity, patched in 2026.0.0). NuGet audit treats it as an error, so restore fails for the whole solution and no build can complete. Testcontainers 4.14.0 depends on SSH.NET 2026.0.0. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Wm2m61jXrAs4FheXR5TufH
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The change is a targeted dependency bump in the test project to resolve a restore-blocking vulnerability warning, with no additional code changes introduced.
Pull request overview
This PR updates the IntegrationTests project’s Testcontainers.MsSql dependency to eliminate a transitive dependency vulnerability (NU1903) that is currently failing restore in CI due to warnings being treated as errors across the repo.
Changes:
- Bump
Testcontainers.MsSqlfrom4.8.1to4.14.0inAutoMapper.IntegrationTeststo clear the transitiveSSH.NETvulnerability warning that is blocking restores.
File summaries
| File | Description |
|---|---|
| src/IntegrationTests/AutoMapper.IntegrationTests.csproj | Updates Testcontainers.MsSql package version to unblock restore/CI by resolving the vulnerable transitive dependency. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CI currently fails on every PR and on
mainduring restore, before anything compiles:Testcontainers.MsSql4.8.1 pullsSSH.NET2024.2.0 transitively. The advisory coversSSH.NET <= 2025.1.0and is patched in 2026.0.0, so it started breaking builds when it was published —mainlast built green on 2026-07-01, and restore failures block the whole solution.Testcontainers4.14.0 depends onSSH.NET2026.0.0, so bumpingTestcontainers.MsSqlto 4.14.0 clears it. 4.13.0 and earlier still resolve to 2025.1.0 and stay vulnerable.Verified locally: restore is clean and
AutoMapper.IntegrationTestsbuilds with 0 warnings and 0 errors. The integration tests themselves need Docker and were not run locally — leaving that to CI.🤖 Generated with Claude Code
https://claude.ai/code/session_01Wm2m61jXrAs4FheXR5TufH