Release v4.0.2: .NET 10 Support & MessagePack CVE Fix

[engineering87]

Description

This release adds official .NET 10 support through multi-targeting while maintaining .NET 9 compatibility. Additionally, it addresses a known vulnerability in the transitive MessagePack dependency by promoting and pinning it to a safe version.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• Security fix (vulnerability remediation)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)

Changes Made

1. Multi-target Support (net9.0;net10.0)

• Updated SharpConnector.csproj to target both .NET 9.0 and 10.0
• Updated SharpConnector.Api.csproj to target both .NET 9.0 and 10.0
• Updated SharpConnector.Tests.csproj to target both .NET 9.0 and 10.0
• Enables consumers on .NET 10 to adopt SharpConnector while preserving compatibility with .NET 9 users

2. Version Bump & Alignment

• Package Version: 4.0.1 → 4.0.2
• AssemblyVersion: 3.3.0 → 4.0.2 (realigned, was stale)
• FileVersion: 3.3.0 → 4.0.2 (realigned, was stale)

3. Security Fix: MessagePack CVE Remediation

• Issue: MessagePack 3.1.4 (transitive via EnyimMemcachedCore 3.5.1) contains a known vulnerability
• Solution: Promoted transitive dependency with explicit PackageReference pinned to 3.1.7
• Rationale: EnyimMemcachedCore is a required backend; cannot be removed; pinning the safe version at consumer level ensures all .NET 9 and 10 builds use the secure version

Testing

• ✅ Unit tests: 86/86 passed on .NET 9.0
• ✅ Unit tests: 86/86 passed on .NET 10.0
• ✅ Build: Clean on both target frameworks
• ⚠️ Pre-existing: 31 warnings (CS0618 on deprecated sync API methods; addressed in future async migration)

Breaking Changes

None. All changes are additive or internal realignments.

Backward Compatibility

• ✅ .NET 9 consumers: No breaking changes; can upgrade safely
• ✅ .NET 10 consumers: Now supported via multi-targeting
• ✅ MessagePack security fix: Transparent to consumers; no API changes

Checklist

• Code compiles without errors
• Tests pass on all target frameworks
• Version numbers are aligned and incremented
• Security vulnerability is mitigated
• No breaking changes introduced
• Documentation (this PR) is clear and complete

Related Issues

• Closes: #[CVE-MessagePack] (if tracked in issues)

Notes for Reviewers

1. The explicit MessagePack PackageReference can be safely removed in a future version once EnyimMemcachedCore updates its dependency to ≥3.1.7.
2. Consider addressing CS0618 warnings in a future minor release by migrating test and API code to async variants (GetAsync, InsertAsync, etc.).

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.