Skip to content

fix: resolve build warnings and vulnerable transitive package versions - #33

Merged
panesofglass merged 2 commits into
masterfrom
fix/build-warnings-vuln-deps
Jul 28, 2026
Merged

fix: resolve build warnings and vulnerable transitive package versions#33
panesofglass merged 2 commits into
masterfrom
fix/build-warnings-vuln-deps

Conversation

@panesofglass

@panesofglass panesofglass commented Jul 28, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • Suppress FS0044 in JsonSchema.fs with line-scoped #nowarn/#warnon "44" pragmas around each of the 5 sites where a deprecated processor type's member calls its own (also deprecated) member - not a blanket file-level suppression, so unrelated future obsolete-API misuse in this file still warns
  • Drop redundant upcasts (FS0066) in JsonSchema.fs
  • Pin System.Text.Json and Newtonsoft.Json above versions flagged by NU1903 (GHSA-8g4q-xg66-9fp4, GHSA-5crp-9r3c-p9vr)
  • Bump Expecto 9.0.2 -> 9.0.4 to clear the NU1605 downgrade warning against Verify.Expecto's floor
  • Bump Microsoft.NET.Test.Sdk 16.8.0 -> 17.14.1 across test projects, removing its vulnerable transitive Newtonsoft.Json 9.0.1

Known tradeoffs

  • netcoreapp3.1 (EOL) stays pinned to System.Text.Json 6.0.10 since 8.x dropped that TFM
  • Newtonsoft.Json forced to 13.0.3, above what NJsonSchema itself was tested against

Test plan

  • dotnet build FSharp.Data.JsonSchema.sln — zero warnings besides pre-existing NETSDK1188 locale noise
  • dotnet test FSharp.Data.JsonSchema.sln — 573/573 passing across net8.0/net9.0/net10.0

🤖 Generated with Claude Code

panesofglass and others added 2 commits July 27, 2026 22:13
- Suppress FS0044 self-calls in deprecated schema-processor types and
  drop redundant upcasts (FS0066) in JsonSchema.fs
- Pin System.Text.Json and Newtonsoft.Json above versions flagged by
  NU1903 (GHSA-8g4q-xg66-9fp4, GHSA-5crp-9r3c-p9vr)
- Bump Expecto to 9.0.4 to clear the NU1605 downgrade warning against
  Verify.Expecto's floor
- Bump Microsoft.NET.Test.Sdk 16.8.0 -> 17.14.1 across test projects,
  removing its vulnerable transitive Newtonsoft.Json 9.0.1

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Marking each interface-impl member [<Obsolete>] doesn't suppress the
warning for calling another Obsolete member in F# (unlike C#'s
CS0618 behavior) - verified it still fired at all 5 sites. Use
line-scoped #nowarn/#warnon "44" pragmas instead, bounded to each
call, so unrelated future obsolete-API misuse in this file still
warns.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
@panesofglass
panesofglass merged commit 48a24e8 into master Jul 28, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant