Patch dependency CVEs, add CI, and attribute the upstream fork

[ralfbecher]

Closes all four open Dependabot advisories and adds the CI and Dependabot configuration this repository had none of. Supersedes #2 and #3.

Why this rather than merging #2 and #3

Dependabot's PRs between them cover three of the four alerts — #3 bumps log4net in TDSProtocol and TDSProxy but not in TDSProtocolTests, leaving one advisory open. This bumps all three, and carries the rest of the work alongside it.

Security

log4net 2.0.15 → 3.3.0	CVE-2026-40021, all three referencing projects
Microsoft.Data.SqlClient 5.1.2 → 5.1.3	CVE-2024-0056

Neither is exploitable here, which is worth stating so the urgency isn't misremembered later:

• The log4net issue is in XmlLayout / XmlLayoutSchemaLog4J. src/TDSProxy/log4net.config configures PatternLayout, three times, and nothing else.
• Microsoft.Data.SqlClient is referenced only by TestConnection, a manual smoke test. The Dockerfile publishes TDSProxy.csproj alone, so it never ships in the image.

The log4net bump crosses a major version, so it was verified rather than assumed — built and tested on net6.0 (0 warnings, 0 errors, 25/25 tests). The API surface used is LogManager.GetLogger, ILog and XmlConfigurator.ConfigureAndWatch, all unchanged in 3.x.

Hardcoded credential removed

TestConnection/Program.cs carried a connection string inherited from upstream, naming an internal host, a domain user and a password, in a public repo. It now reads TDSPROXY_TEST_CONNECTION_STRING from the environment.

CI and Dependabot

ci.yml adds pins and build. pins runs first and build needs it — running it alongside would be too late, since a parallel job has already executed its own uses: before the check could fail. Actions are SHA-pinned with the release in a comment, and scripts/check-action-pins.sh verifies the two agree, so a hash swapped for one taken from a fork stops looking like a routine bump.

dependabot.yml covers NuGet, Actions and Docker, with version and security updates in separate groups — a group covers version updates only unless it says so, which is why four advisories arrived as separate PRs.

Attribution

The README now states this is a fork of tech-software/TDSProxy and what this fork changed. LICENSE already retained the original copyright — which is what MIT requires — but the repo read as original work.

The licensing section also records why there is no third-party notice file: those attribution clauses attach on distribution, and nothing here publishes an image. It says what would have to change if one were ever pushed.

Follow-up

main currently has 0 required status checks, because requiring a context before its workflow has ever run blocks every PR. Once this merges and CI runs, add Action pins and build to the required list.