From b2232d5980106fb1993201ac6ef9a46c0a7c2c93 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 13 Jul 2026 03:37:38 +0000 Subject: [PATCH 1/2] Bump the nuget-dependencies group with 1 update Bumps SonarAnalyzer.CSharp from 10.28.0.143324 to 10.29.0.143774 --- updated-dependencies: - dependency-name: SonarAnalyzer.CSharp dependency-version: 10.29.0.143774 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-dependencies - dependency-name: SonarAnalyzer.CSharp dependency-version: 10.29.0.143774 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-dependencies ... Signed-off-by: dependabot[bot] --- .../DemaConsulting.NuGet.CacheTool.csproj | 2 +- .../DemaConsulting.NuGet.CacheTool.Tests.csproj | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/DemaConsulting.NuGet.CacheTool/DemaConsulting.NuGet.CacheTool.csproj b/src/DemaConsulting.NuGet.CacheTool/DemaConsulting.NuGet.CacheTool.csproj index c82ef93..b8b7fb4 100644 --- a/src/DemaConsulting.NuGet.CacheTool/DemaConsulting.NuGet.CacheTool.csproj +++ b/src/DemaConsulting.NuGet.CacheTool/DemaConsulting.NuGet.CacheTool.csproj @@ -70,7 +70,7 @@ all runtime; build; native; contentfiles; analyzers; buildtransitive - + all runtime; build; native; contentfiles; analyzers; buildtransitive diff --git a/test/DemaConsulting.NuGet.CacheTool.Tests/DemaConsulting.NuGet.CacheTool.Tests.csproj b/test/DemaConsulting.NuGet.CacheTool.Tests/DemaConsulting.NuGet.CacheTool.Tests.csproj index a443aa1..4d933d0 100644 --- a/test/DemaConsulting.NuGet.CacheTool.Tests/DemaConsulting.NuGet.CacheTool.Tests.csproj +++ b/test/DemaConsulting.NuGet.CacheTool.Tests/DemaConsulting.NuGet.CacheTool.Tests.csproj @@ -54,7 +54,7 @@ all runtime; build; native; contentfiles; analyzers; buildtransitive - + all runtime; build; native; contentfiles; analyzers; buildtransitive From d9b47ee948f1e492be50a2aec405c2e02ff32539 Mon Sep 17 00:00:00 2001 From: Malcolm Nixon Date: Sun, 12 Jul 2026 23:44:51 -0400 Subject: [PATCH 2/2] Fix S6444: pass timeout to Regex.IsMatch in Validation self-test SonarAnalyzer.CSharp 10.29.0 introduces rule S6444 requiring regex methods to specify a timeout to prevent ReDoS. Updated the version-display self-test to pass a 1-second timeout. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- src/DemaConsulting.NuGet.CacheTool/SelfTest/Validation.cs | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/DemaConsulting.NuGet.CacheTool/SelfTest/Validation.cs b/src/DemaConsulting.NuGet.CacheTool/SelfTest/Validation.cs index bba0a92..c267534 100644 --- a/src/DemaConsulting.NuGet.CacheTool/SelfTest/Validation.cs +++ b/src/DemaConsulting.NuGet.CacheTool/SelfTest/Validation.cs @@ -112,7 +112,11 @@ private static void RunVersionTest(Context context, DemaConsulting.TestResults.T logContent => { // Verify version string is in log (version matches semantic version pattern) - if (System.Text.RegularExpressions.Regex.IsMatch(logContent.Trim(), @"\d+\.\d+\.\d+")) + if (System.Text.RegularExpressions.Regex.IsMatch( + logContent.Trim(), + @"\d+\.\d+\.\d+", + System.Text.RegularExpressions.RegexOptions.None, + TimeSpan.FromSeconds(1))) { return null; }