diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml index 3fdaa42..77305f1 100644 --- a/.github/workflows/build-and-test.yml +++ b/.github/workflows/build-and-test.yml @@ -17,7 +17,7 @@ jobs: - name: Setup .NET uses: actions/setup-dotnet@v4 with: - dotnet-version: 9.0.x + dotnet-version: 10.0.x - name: Restore dependencies run: dotnet restore diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 2fce985..1295602 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -19,7 +19,7 @@ jobs: - name: Setup .NET uses: actions/setup-dotnet@v4 with: - dotnet-version: 9.0.x + dotnet-version: 10.0.x - name: Build Binaries run: | @@ -29,9 +29,13 @@ jobs: - name: Build Debian Package run: | chmod +x build_deb.sh - VERSION=${{ github.ref_name }} - VERSION=${VERSION#V.} - ./build_deb.sh $VERSION + # Accepts v1.1.0, V1.1.0, V.1.1.0 or 1.1.0. Debian versions must start + # with a digit, so the leading tag prefix has to go. + VERSION="${{ github.ref_name }}" + VERSION="${VERSION#[vV]}" + VERSION="${VERSION#.}" + echo "Packaging version: $VERSION" + ./build_deb.sh "$VERSION" - name: Pack NuGet Tool run: dotnet pack MTC/MTC.csproj -c Release -o nupkg diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 0000000..943be41 --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,131 @@ +# Changelog + +All notable changes to this project are documented here. + +The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), +and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). + +## [1.1.0] — unreleased + +Maintenance release after an eight-month pause. Everything now targets .NET 10, the +template engine vulnerability is closed, and the code MTC generates compiles without +warnings. + +### Security + +- Updated Scriban from 6.5.2 to 7.2.6, closing 14 known advisories — one critical + and eight high severity. Scriban renders every template, so this affected all + generated output. +- Generated Web/API projects now pin `Microsoft.OpenApi` 2.11.0. The version pulled in + transitively by `Microsoft.AspNetCore.OpenApi` carries a known advisory + (GHSA-v5pm-xwqc-g5wc). +- Rendered file and directory names can no longer escape the output directory. A name + such as `../Escaped` previously wrote files into the parent directory; it is now + refused with a clear error. + +### Added + +- **Generate commands no longer overwrite existing files.** Every command now checks its + targets before writing anything. If a file it would produce already exists, nothing is + written, the conflicting paths are listed, and the command exits with code 1. Pass + `--force` to replace them. Generation is all-or-nothing, so a conflict can no longer + leave a half-written feature behind. Applies to `new`, `add feature`, + `add value-object` and `add dto`, including the Clean Architecture path that renders + through a temporary directory. +- `mtc new