chore(deps): update dependency naudio.winmm to v3

revert(ci): security-scan wieder ueber den reusable workflow
Rueckbau des Inline-Workarounds. Der Runner konnte den reusable workflow nicht mehr laden, weil git fetch gegen die Forge crashte. Ursache war kein Bug, sondern eine Kompromittierung ueber CVE-2026-59774: ein injizierter packObjectsHook ersetzte git pack-objects durch einen Malware-Dropper. Gitea laeuft jetzt auf 1.27.2, der Hook ist entfernt, fetch funktioniert wieder. Die Scan-Definition liegt damit wieder an einer Stelle statt in sieben Dateien. Details: Obsidian "Projekte/Hellion Forge/Forge Security-Incident 2026-08-15.md".
2026-08-17 00:32:16 +00:00 · 2026-08-15 21:17:43 +00:00 · 2026-08-15 17:26:51 +00:00 · 2026-06-03 06:07:06 +00:00 · 2026-06-03 06:06:55 +00:00 · 2026-06-03 06:06:11 +00:00
5 changed files with 39 additions and 22 deletions
@@ -35,7 +35,7 @@ jobs:
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Setup .NET 10
-        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5
+        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5
        with:
          dotnet-version: 10.0.x

@@ -54,7 +54,7 @@ jobs:
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Setup .NET 10
-        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5
+        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5
        with:
          dotnet-version: 10.0.x

@@ -1,4 +1,8 @@
 name: Security
+
+# Ruft den zentralen Scan-Workflow in security-workflows auf
+# (Semgrep SAST + Trivy filesystem scan).
+
 on:
  push:
    branches: [main, master]
@@ -11,10 +15,6 @@ jobs:
  scan:
    uses: JonKazama-Hellion/security-workflows/.gitea/workflows/security-scan.yml@main
    with:
-      # MessageStore.cs uses string-interpolation in CommandText for table
-      # names and clause-joins that come from internal code constants, not
-      # user input. Values are bound via SqlParameter, the SQL surface is
-      # local-only inside a Dalamud plugin. Semgrep matches the pattern
-      # without dataflow, so it flags those eight call sites; CodeQL
-      # would not. Suppressed for this repo only.
+      # MessageStore.cs interpoliert SQL-Strings, die plugin-lokal sicher sind;
+      # Semgrep matcht das Pattern, CodeQL mit Datenflussanalyse nicht.
      semgrep-exclude-rules: 'csharp.lang.security.sqli.csharp-sqli.csharp-sqli'
@@ -14,7 +14,7 @@
    <ItemGroup>
        <!-- Closed ranges prevent surprise major bumps during lock file regeneration -->
        <PackageReference Include="MessagePack" Version="[3.1.4, 4.0.0)" />
-        <PackageReference Include="Microsoft.Data.Sqlite" Version="10.0.7" />
+        <PackageReference Include="Microsoft.Data.Sqlite" Version="10.0.8" />
        <!-- v1.5.0 DI-container foundation; matches Lightless pin (Hosting 10.0.7) -->
        <PackageReference
            Include="Microsoft.Extensions.DependencyInjection"
@@ -30,7 +30,7 @@
             Media-Foundation-based codecs do not). Using the sub-package avoids pulling in
             NAudio.WinForms (which requires WindowsDesktop and does not build on Linux hosts).
             WaveOutEvent and WaveFileReader both live in NAudio.WinMM + NAudio.Core. -->
-        <PackageReference Include="NAudio.WinMM" Version="2.2.1" />
+        <PackageReference Include="NAudio.WinMM" Version="3.0.0" />
        <PackageReference Include="Pidgin" Version="[3.5.1, 4.0.0)" />
        <PackageReference Include="SixLabors.ImageSharp" Version="[3.1.12, 4.0.0)" />
    </ItemGroup>
@@ -27,11 +27,11 @@
      },
      "Microsoft.Data.Sqlite": {
        "type": "Direct",
-        "requested": "[10.0.7, )",
-        "resolved": "10.0.7",
-        "contentHash": "DZ6G2QuyPrsh5VS+wfiZbNBtYT6p+CkxXjD0aZHF04xso7QsG/uk0JpG30hzYlK6u/wtTzta1Dqfgbc/Sl2sDA==",
+        "requested": "[10.0.8, )",
+        "resolved": "10.0.8",
+        "contentHash": "iyDWyD6r/SnqgoYYQIlLhxL1ZIGZr+SByMXrJKSA1w7sOt7bPMJmN3h2laqwKqyQkjh/lUPJ7LTXwpvqzhggOQ==",
        "dependencies": {
-          "Microsoft.Data.Sqlite.Core": "10.0.7",
+          "Microsoft.Data.Sqlite.Core": "10.0.8",
          "SQLitePCLRaw.bundle_e_sqlite3": "2.1.11",
          "SQLitePCLRaw.core": "2.1.11"
        }
@@ -104,11 +104,12 @@
      },
      "NAudio.WinMM": {
        "type": "Direct",
-        "requested": "[2.2.1, )",
-        "resolved": "2.2.1",
-        "contentHash": "xFHRFwH4x6aq3IxRbewvO33ugJRvZFEOfO62i7uQJRUNW2cnu6BeBTHUS0JD5KBucZbHZaYqxQG8dwZ47ezQuQ==",
+        "requested": "[3.0.0, )",
+        "resolved": "3.0.0",
+        "contentHash": "RfBlBk0KPNQx3OUcZtxbqhaz0sKMVTcntBtIHZYfePMA7CjawePHR4xpH+lKoVnWxppPxoAk0Bf8k1fE30RuAQ==",
        "dependencies": {
-          "NAudio.Core": "2.2.1"
+          "NAudio.Core": "3.0.0",
+          "NAudio.Midi": "3.0.0"
        }
      },
      "Pidgin": {
@@ -141,8 +142,8 @@
      },
      "Microsoft.Data.Sqlite.Core": {
        "type": "Transitive",
-        "resolved": "10.0.7",
-        "contentHash": "xVrtBg3M1wJlBDkoT0dXEYB/wSc8bIHJPYtw/bu1AqpWgF79uPSs87DAhERR/Ilumre6TKZa1cjMg3VUUObVLA==",
+        "resolved": "10.0.8",
+        "contentHash": "26t7WDiEjjAls/sFpWvVEFDxt+7Q5VPt6+blU2Lafuj9L8PzAv/GtGV4cqVPtrhWbfD2BX/z2v8hD1qXYtK6Aw==",
        "dependencies": {
          "SQLitePCLRaw.core": "2.1.11"
        }
@@ -377,8 +378,19 @@
      },
      "NAudio.Core": {
        "type": "Transitive",
-        "resolved": "2.2.1",
-        "contentHash": "GgkdP6K/7FqXFo7uHvoqGZTJvW4z8g2IffhOO4JHaLzKCdDOUEzVKtveoZkCuUX8eV2HAINqi7VFqlFndrnz/g=="
+        "resolved": "3.0.0",
+        "contentHash": "uEX5xkjbUQ3w8XVuqcX1iMRr0avhOdn2WFiPL2X/kF72anSJSgdLhpkxCxr6N1hQr+hWx1L5lNJJeg0sh6xBiw==",
+        "dependencies": {
+          "System.Numerics.Tensors": "9.0.0"
+        }
+      },
+      "NAudio.Midi": {
+        "type": "Transitive",
+        "resolved": "3.0.0",
+        "contentHash": "h3VjMTBoBAOw63W7mMrv1kHdRQZkuayTpYrUsusUolORkmgfFiMg8eM4VHwgMBcOgm14997B/r7EojavMBu6CQ==",
+        "dependencies": {
+          "NAudio.Core": "3.0.0"
+        }
      },
      "SQLitePCLRaw.bundle_e_sqlite3": {
        "type": "Transitive",
@@ -406,6 +418,11 @@
        "type": "Transitive",
        "resolved": "10.0.7",
        "contentHash": "WbmDLeTPYhEzXhvYVioTVn/D1XX6bovyny9n5p8Zxtf03+eY385RB818teZm6n+fA63iZNvng0/Np4tLuhkMhQ=="
+      },
+      "System.Numerics.Tensors": {
+        "type": "Transitive",
+        "resolved": "9.0.0",
+        "contentHash": "hyJB4UlpAi19Xr9AXzu2NuagKC4lPfHObNMEAA0HmqFz2rX7wKgzeYzO/jM/eBHDhnUGFFEjk5cOoJaxqg5J4A=="
      }
    }
  }
Author	SHA1	Message	Date
renovate-bot	912e91b8cb	chore(deps): update dependency naudio.winmm to v3 Security Scan (reusable) / Security Scan (pull_request) Failing after 28s Details Security / scan (pull_request) Failing after 28s Details Build / Build (Release) (pull_request) Successful in 37s Details	2026-08-17 00:32:16 +00:00
JonKazama-Hellion	fd8e5a1a17	revert(ci): security-scan wieder ueber den reusable workflow Security Scan (reusable) / Security Scan (push) Failing after 27s Details Security / scan (push) Failing after 27s Details Build / Build (Release) (push) Successful in 36s Details Rueckbau des Inline-Workarounds. Der Runner konnte den reusable workflow nicht mehr laden, weil git fetch gegen die Forge crashte. Ursache war kein Bug, sondern eine Kompromittierung ueber CVE-2026-59774: ein injizierter packObjectsHook ersetzte git pack-objects durch einen Malware-Dropper. Gitea laeuft jetzt auf 1.27.2, der Hook ist entfernt, fetch funktioniert wieder. Die Scan-Definition liegt damit wieder an einer Stelle statt in sieben Dateien. Details: Obsidian "Projekte/Hellion Forge/Forge Security-Incident 2026-08-15.md".	2026-08-15 21:17:43 +00:00
JonKazama-Hellion	d50f2cea90	fix(ci): security-scan inline statt reusable workflow Security / Security Scan (push) Failing after 21s Details Build / Build (Release) (push) Failing after 34s Details act_runner laedt reusable workflows per git-clone ueber HTTPS. Dieser Pfad ist auf der Forge seit 2026-08-12 defekt (git upload-pack --stateless-rpc bricht mit BUG "packfile_uris requires sideband-all" ab). Die Scans liefen bisher nur ueber eine im Juni gecachte Kopie im Runner. Der Scan steht jetzt vollstaendig in dieser Datei, der Quellstand kommt als tar-Archiv statt ueber actions/checkout. Zurueckbauen, sobald git fetch ueber HTTPS wieder funktioniert.	2026-08-15 17:26:51 +00:00
JonKazama-Hellion	99901b64ed	Merge pull request 'chore(deps): update minor and patch updates (nuget)' (#17 ) from renovate/minor-and-patch-updates-(nuget) into main Security / scan (push) Successful in 21s Details Build / Build (Release) (push) Successful in 30s Details Reviewed-on: #17	2026-06-03 06:07:06 +00:00
renovate-bot	7ef1337ea0	chore(deps): update minor and patch updates (nuget) Security / scan (pull_request) Successful in 20s Details Build / Build (Release) (pull_request) Successful in 26s Details	2026-06-03 06:06:55 +00:00
JonKazama-Hellion	a13713752e	Merge pull request 'chore(deps): update actions/setup-dotnet digest to 9a946fd' (#19 ) from renovate/actions-setup-dotnet-digest into main Security / scan (push) Successful in 21s Details Build / Build (Release) (push) Successful in 27s Details Reviewed-on: #19	2026-06-03 06:06:11 +00:00
renovate-bot	a9f42e32c5	chore(deps): update actions/setup-dotnet digest to 9a946fd Security / scan (pull_request) Successful in 29s Details Build / Build (Release) (pull_request) Successful in 45s Details	2026-06-01 00:32:04 +00:00