Skip to content

Bump version to 1.17.0 - #397

Merged
erikdarlingdata merged 2 commits into
devfrom
release/v1.17.0
Jul 25, 2026
Merged

Bump version to 1.17.0#397
erikdarlingdata merged 2 commits into
devfrom
release/v1.17.0

Conversation

@erikdarlingdata

Copy link
Copy Markdown
Owner

Bumps the version to 1.17.0 ahead of the dev -> main release merge.

Bumped in all three places, since PlanViewer.Ssms is a legacy non-SDK project not covered by Directory.Build.props (these have drifted on past releases):

  • src/Directory.Build.props -> 1.17.0
  • src/PlanViewer.Ssms/source.extension.vsixmanifest -> 1.17.0
  • src/PlanViewer.Ssms/Properties/AssemblyInfo.cs -> 1.17.0.0 (both AssemblyVersion and AssemblyFileVersion)

Keeping the vsixmanifest in sync also means the "Build SSMS extension" step in release.yml will not emit its version-mismatch warning.

What 1.17.0 contains

#395 - quarterly maintenance

  • CVE-2025-6965 (High) fixed: server/PlanShare pulled a vulnerable SQLite transitively; pinned SQLitePCLRaw.bundle_e_sqlite3 2.1.12
  • MCP DNS-rebinding guard - ListenLocalhost alone did not prevent a malicious page from rebinding a DNS name to 127.0.0.1 and reading saved server names, query text, and plan XML. Runtime-verified: rebound Host and hostile Origin both 403, legitimate loopback handshake 200
  • Generated T-SQL hardened - untrusted plan XML could splice statements into the executed sp_executesql batch; DDL identifier escaping did not double ]
  • 9 dependency bumps, removal of the unused deprecated Avalonia.Diagnostics, zero-warning build restored (drag/drop migrated to Avalonia's DataTransfer API), 5 GitHub Actions bumped
  • Tests 182 -> 202

#396 - Claude Code PR review workflows. Note these only become active once they land on main, which this release accomplishes: the action refuses to run unless the workflow file is byte-identical on the default branch.

Test plan

  • Clean Release build of the merged result: 0 warnings
  • 202/202 tests pass in Release
  • All three version strings verified at 1.17.0
  • release.yml confirmed to trigger only on a merged PR to main with head ref dev, so the follow-up merge is what cuts the release

🤖 Generated with Claude Code

erikdarlingdata and others added 2 commits July 25, 2026 11:11
All three version sources, kept in sync:
- src/Directory.Build.props (single source for SDK-style projects)
- src/PlanViewer.Ssms/source.extension.vsixmanifest
- src/PlanViewer.Ssms/Properties/AssemblyInfo.cs

The two SSMS files are not covered by Directory.Build.props because
PlanViewer.Ssms is a legacy non-SDK project; they have drifted on past
releases, so they are bumped by hand here.

Verified: clean Release build 0 warnings, 202/202 tests pass.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Its software `version` had been left at 1.2.0 since the file was added
in #111 (2026-03-18), 15 minor versions behind. It likely went unnoticed
because it happened to match the `cff-version: 1.2.0` schema version on
line 1, which is a different field and correctly stays at 1.2.0.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@erikdarlingdata
erikdarlingdata merged commit 13151dd into dev Jul 25, 2026
3 checks passed
@erikdarlingdata
erikdarlingdata deleted the release/v1.17.0 branch July 25, 2026 15:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant