v4.0.5 release

.azuredevops/pipelines/build-v2.yml

@@ -21,6 +21,12 @@
         include:
         - develop
         - main
+
+  - repository: shared-code-scanning
+    type: git
+    name: Common/shared-code-scanning
+    ref: refs/heads/main
+    trigger: none
 
 trigger:
   - develop
@@ -34,16 +40,26 @@
 
 variables:
 - group: artifacts
+- group: PT-Pipeline-Common
 - name: baseSourceDirectory
   value: $(Build.SourcesDirectory)/sb-mock-data-holder/Source
 
 pool:
-  vmImage: ubuntu-latest
+ name: mdp-mgmt-shared
+ demands:
+   - ImageOverride -equals $(PipelineHostLinuxImage)
 
 jobs:
   - job: Build
     timeoutInMinutes: 120
     steps:
+
+      - script: | 
+            echo "Cleaning auth-server folder in temp"
+            ls $(Agent.BuildDirectory)/s/sb-mock-data-holder/Source/DockerCompose/_temp/mock-data-holder-* 2>/dev/null || "No matching folders found"
+            sudo rm -rf $(Agent.BuildDirectory)/s/sb-mock-data-holder/Source/DockerCompose/_temp/mock-data-holder-* 2> /dev/null  
+        displayName: Clean temp auth-server folders
+        condition: always()
 
       ###################################################################################################
       # Checkout repositories
@@ -112,17 +128,25 @@
           $branchRef = ""      
           $authServerBranch = ""
           $AuthServerFeatureBranch = "$(AuthServerFeatureBranch)"
           $SourcebranchName = "$(Build.SourceBranch)" -replace 'refs/heads/', ''
-          
+
           if ($SourcebranchName -match "releases/") {
             $authServerBranch = "$(AuthServerReleaseBranchName)"
             $branchRef = "refs/heads/$authServerBranch"
             echo "Release Branch detected. Using  $branchRef."
           }
           elseif ($SourcebranchName -eq "main" -or $branchName -eq "develop") {
-            $authServerBranch = $branchName
-            $branchRef = "$(Build.SourceBranch)"
-            echo "Main or Develop Branch detected. Using  $branchRef."
+            if ($AuthServerFeatureBranch -ne "") {
+            $authServerBranch = $AuthServerFeatureBranch
+            $branchRef = "refs/heads/$authServerBranch"
+            echo "Feature Branch variable exists. Using  $branchRef."
+            }
+            else
+            {
+              $authServerBranch = $branchName
+              $branchRef = "$(Build.SourceBranch)"
+              echo "Main or Develop Branch detected. Using  $branchRef."
+            }            
           }
           elseif ($AuthServerFeatureBranch -ne "") {
             $authServerBranch = $AuthServerFeatureBranch
@@ -166,6 +190,11 @@
           docker build --file $(baseSourceDirectory)/Dockerfile --target Banking -t mock-data-holder:latest $(baseSourceDirectory)
         displayName: Create Banking Image
         condition: always()
+
+      - template: templates/scan-image.yml@shared-code-scanning
+        parameters:
+          Repository: mock-data-holder
+          Tag: latest
 
       - script: |
           docker build --file $(baseSourceDirectory)/Dockerfile --target Energy -t mock-data-holder-energy:latest $(baseSourceDirectory)
@@ -196,7 +225,7 @@
         inputs:
           targetType: inline
           script: |
             echo "SourceBranchName = $(Build.SourceBranchName) mockRegisterContainerTag=$(RegisterTag)"
 
             docker pull $(SharedAcrBaseUrl).azurecr.io/mock-register:$(RegisterTag)
             docker tag $(SharedAcrBaseUrl).azurecr.io/mock-register:$(RegisterTag) mock-register:latest
@@ -329,7 +358,7 @@
       - task: PublishPipelineArtifact@1
         displayName: Publish container images
         inputs:
-          path: $(Build.ArtifactStagingDirectory)
+          path: $(Build.ArtifactStagingDirectory)/mock-data-holder.image.tar
           artifact: Container Images
 
       ###################################################################################################
@@ -464,7 +493,7 @@
         inputs:
           targetType: inline
           script: |
             echo Tagging mock-data-holder with Source Branch Name: $(Build.SourceBranchName)
             docker tag mock-data-holder $(SharedAcrBaseUrl).azurecr.io/mock-data-holder:$(Build.SourceBranchName)
 
             echo Tagging mock-data-holder-energy with Source Branch Name: $(Build.SourceBranchName)
@@ -488,7 +517,7 @@
             echo Tagging mock-data-holder-energy with latest tag
             docker tag mock-data-holder-energy $(SharedAcrBaseUrl).azurecr.io/mock-data-holder-energy:latest
 
             echo Tagging mock-data-holder with Source Branch Name-latest: $(Build.SourceBranchName)-latest
             docker tag mock-data-holder $(SharedAcrBaseUrl).azurecr.io/mock-data-holder:$(Build.SourceBranchName)-latest
 
             echo Tagging mock-data-holder-energy with Source Branch Name-latest: $(Build.SourceBranchName)-latest

.azuredevops/pipelines/code-scanning.yml

@@ -17,8 +17,13 @@ schedules:
 # Disable standard CI build
 trigger: none
 
+variables:
+- group: PT-Pipeline-Common
+
 pool:
-  vmImage: 'ubuntu-latest'
+ name: mdp-mgmt-shared
+ demands:
+   - ImageOverride -equals $(PipelineHostLinuxImage)
 
 extends:
   template: pipeline-templates/code-scanning.yml@shared-code-scanning

.azuredevops/pipelines/dependabot.yml

@@ -6,11 +6,16 @@ schedules:
     - refs/heads/develop
   always: true
 
+variables:
+- group: PT-Pipeline-Common
+
 jobs:
 - job: dependabot
   displayName: Dependabot
   pool:
-    vmImage: ubuntu-latest
+    name: mdp-mgmt-shared
+    demands:
+      - ImageOverride -equals $(PipelineHostLinuxImage)
   steps:
   - task: CmdLine@2
     displayName: clone dependabot repo

CHANGELOG.md

@@ -5,6 +5,13 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+## [4.0.5] - 2026-07-08
+### Changed
+- Updated NuGet packages
+
+## [4.0.4] - 2026-03-18 
+### Changed
+- Rebuild project to fix vulnerabilities in base image
 
 ## [4.0.3] - 2025-12-10 
 ### Changed

Source/Banking/CDR.DataHolder.Banking.Domain/CDR.DataHolder.Banking.Domain.csproj

@@ -22,4 +22,8 @@
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
   </ItemGroup>
+  <ItemGroup>
+      <!-- Whitelist Package Advisories where we cannot upgrade to the latest package due to licensing terms (tech debt) but have implemented a workaround or analyzed the impact and accepted the risk -->
+      <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-rvv3-g6hj-g44x" />
+  </ItemGroup>  
 </Project>

Source/Banking/CDR.DataHolder.Banking.Repository/CDR.DataHolder.Banking.Repository.csproj

@@ -26,6 +26,10 @@
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
   </ItemGroup>
+<ItemGroup>
+    <!-- Whitelist Package Advisories where we cannot upgrade to the latest package due to licensing terms (tech debt) but have implemented a workaround or analyzed the impact and accepted the risk -->
+    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-rvv3-g6hj-g44x" />
+</ItemGroup>
   <ItemGroup>
     <ProjectReference Include="..\..\Shared\CDR.DataHolder.Shared.Repository\CDR.DataHolder.Shared.Repository.csproj" />
     <ProjectReference Include="..\CDR.DataHolder.Banking.Domain\CDR.DataHolder.Banking.Domain.csproj" />

Source/Banking/CDR.DataHolder.Banking.Repository/Infrastructure/MappingProfile.cs

@@ -6,13 +6,17 @@ namespace CDR.DataHolder.Banking.Repository.Infrastructure
 {
     public class MappingProfile : Profile
     {
+        private const int AutoMapperMaxDepth = 32;
+
         public MappingProfile()
         {
             CreateMap<Transaction, DomainEntities.AccountTransaction>()
-                .ReverseMap();
+                .ReverseMap()
+                 .MaxDepth(AutoMapperMaxDepth);
 
             CreateMap<Account, DomainEntities.Account>()
-                .ReverseMap();
+                .ReverseMap()
+                .MaxDepth(AutoMapperMaxDepth);
 
             CreateMap<Person, DomainEntities.Person>()
                 .ForMember(
@@ -22,7 +26,8 @@ public MappingProfile()
                 .ForMember(dest => dest.CustomerId, source => source.MapFrom(s => s.Customer.CustomerId))
                 .ForMember(dest => dest.LoginId, source => source.MapFrom(s => s.Customer.LoginId))
                 .ForMember(dest => dest.CustomerUType, source => source.MapFrom(s => s.Customer.CustomerUType))
-                .ReverseMap();
+                .ReverseMap()
+                .MaxDepth(AutoMapperMaxDepth);
 
             CreateMap<Organisation, DomainEntities.Organisation>()
                 .ForMember(
@@ -32,19 +37,23 @@ public MappingProfile()
                 .ForMember(dest => dest.CustomerId, source => source.MapFrom(s => s.Customer.CustomerId))
                 .ForMember(dest => dest.LoginId, source => source.MapFrom(s => s.Customer.LoginId))
                 .ForMember(dest => dest.CustomerUType, source => source.MapFrom(s => s.Customer.CustomerUType))
-                .ReverseMap();
+                .ReverseMap()
+                .MaxDepth(AutoMapperMaxDepth);
 
             CreateMap<Customer, DomainEntities.Customer>()
                 .ForMember(dest => dest.Accounts, source => source.MapFrom(source => source.Accounts))
-                .ReverseMap();
+                .ReverseMap()
+                .MaxDepth(AutoMapperMaxDepth);
 
             CreateMap<Customer, DomainEntities.Person>()
                 .IncludeMembers(source => source.Person, source => source)
-                .ReverseMap();
+                .ReverseMap()
+                .MaxDepth(AutoMapperMaxDepth);
 
             CreateMap<Customer, DomainEntities.Organisation>()
                 .IncludeMembers(source => source.Organisation)
-                .ReverseMap();
+                .ReverseMap()
+                .MaxDepth(AutoMapperMaxDepth);
         }
     }
 }

Source/Banking/CDR.DataHolder.Banking.Resource.API.UnitTests/CDR.DataHolder.Banking.Resource.API.UnitTests.csproj

@@ -70,4 +70,8 @@
       <CopyToOutputDirectory>Always</CopyToOutputDirectory>
     </None>
   </ItemGroup>
+  <ItemGroup>
+    <!-- Whitelist Package Advisories where we cannot upgrade to the latest package due to licensing terms (tech debt) but have implemented a workaround or analyzed the impact and accepted the risk -->
+    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-rvv3-g6hj-g44x" />
+</ItemGroup>
 </Project>

Source/Banking/CDR.DataHolder.Banking.Resource.API/Business/MappingProfile.cs

@@ -9,37 +9,45 @@ namespace CDR.DataHolder.Banking.Resource.API.Business
 {
     public class MappingProfile : Profile
     {
+        private const int AutoMapperMaxDepth = 32;
+
         public MappingProfile()
         {
-            CreateMap<RequestAccountTransactions, AccountTransactionsFilter>();
+            CreateMap<RequestAccountTransactions, AccountTransactionsFilter>().MaxDepth(AutoMapperMaxDepth);
 
-            CreateMap<AccountTransaction, AccountTransaction>();
+            CreateMap<AccountTransaction, AccountTransaction>().MaxDepth(AutoMapperMaxDepth);
 
             CreateMap<AccountTransaction, AccountTransactionModel>()
                 .ForMember(d => d.Type, s => s.MapFrom(src => src.TransactionType))
-                .ForMember(d => d.Amount, s => s.MapFrom(src => src.Amount.ToString("F2")));
+                .ForMember(d => d.Amount, s => s.MapFrom(src => src.Amount.ToString("F2")))
+                .MaxDepth(AutoMapperMaxDepth);
 
             CreateMap<AccountTransaction[], AccountTransactionsCollectionModel>()
-                .ForMember(d => d.Transactions, s => s.MapFrom(src => src));
+                .ForMember(d => d.Transactions, s => s.MapFrom(src => src))
+                .MaxDepth(AutoMapperMaxDepth);
 
             CreateMap<Shared.Domain.ValueObjects.Page<AccountTransaction[]>, PageModel<AccountTransactionsCollectionModel>>()
                 .ForMember(d => d.Meta, s => s.MapFrom(src => new MetaPaginated { TotalRecords = src.TotalRecords, TotalPages = src.TotalPages }))
-                .ForMember(d => d.Data, s => s.MapFrom(src => src.Data));
+                .ForMember(d => d.Data, s => s.MapFrom(src => src.Data))
+                .MaxDepth(AutoMapperMaxDepth);
 
             CreateMap(typeof(Shared.Domain.ValueObjects.Page<>), typeof(MetaPaginated))
-                .ReverseMap();
+                .ReverseMap()
+                .MaxDepth(AutoMapperMaxDepth);
 
             CreateMap<Account, BankingAccountV2>()
                .ForMember(dest => dest.MaskedNumber, source => source.MapFrom(source => source.MaskedName))
                .ForMember(dest => dest.CreationDate, source => source.MapFrom(source =>
                    source.CreationDate.HasValue ? source.CreationDate.Value.ToString("yyyy-MM-dd") : null))
                .ForMember(dest => dest.IsOwned, source => source.MapFrom(source => true))
-               .ReverseMap();
+               .ReverseMap()
+               .MaxDepth(AutoMapperMaxDepth);
 
             CreateMap<Shared.Domain.ValueObjects.Page<Account[]>, ResponseBankingAccountListV2>()
                 .ForPath(dest => dest.Data.Accounts, source => source.MapFrom(source => source.Data))
                 .ForMember(dest => dest.Meta, source => source.MapFrom(source => source))
-                .ReverseMap();
+                .ReverseMap()
+                .MaxDepth(AutoMapperMaxDepth);
         }
     }
 }

Source/Banking/CDR.DataHolder.Banking.Resource.API/CDR.DataHolder.Banking.Resource.API.csproj

@@ -41,6 +41,10 @@
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
   </ItemGroup>
+    <ItemGroup>
+        <!-- Whitelist Package Advisories where we cannot upgrade to the latest package due to licensing terms (tech debt) but have implemented a workaround or analyzed the impact and accepted the risk -->
+        <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-rvv3-g6hj-g44x" />
+    </ItemGroup>
   <ItemGroup>
     <ProjectReference Include="..\..\Shared\CDR.DataHolder.Shared.API.Infrastructure\CDR.DataHolder.Shared.API.Infrastructure.csproj" />
     <ProjectReference Include="..\..\Shared\CDR.DataHolder.Shared.API.Logger\CDR.DataHolder.Shared.API.Logger.csproj" />

Source/Banking/CDR.DataHolder.Banking.Tests.IntegrationTests/CDR.DataHolder.Banking.Tests.IntegrationTests.csproj

@@ -70,6 +70,10 @@
     <ProjectReference Include="..\..\Shared\CDR.DataHolder.Shared.API.Infrastructure\CDR.DataHolder.Shared.API.Infrastructure.csproj" />
     <ProjectReference Include="..\..\Shared\CDR.DataHolder.Shared.Domain\CDR.DataHolder.Shared.Domain.csproj" />
   </ItemGroup>
+  <ItemGroup>
+    <!-- Whitelist Package Advisories where we cannot upgrade to the latest package due to licensing terms (tech debt) but have implemented a workaround or analyzed the impact and accepted the risk -->
+    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-rvv3-g6hj-g44x" />
+</ItemGroup>
   <ItemGroup>
     <None Update="Certificates\ca.pfx">
       <CopyToOutputDirectory>Always</CopyToOutputDirectory>

Source/Common/CDR.DataHolder.Common.API/Business/MappingProfile.cs

@@ -7,57 +7,67 @@ namespace CDR.DataHolder.Common.API.Business
 {
     public class MappingProfile : Profile
     {
+        private const int AutoMapperMaxDepth = 32;
+
         public MappingProfile()
         {
             // Mappings for banking industry
-            CreateMap<Banking.Domain.Entities.Person, CommonPerson>();
+            CreateMap<Banking.Domain.Entities.Person, CommonPerson>().MaxDepth(AutoMapperMaxDepth);
 
-            CreateMap<Banking.Domain.Entities.Organisation, CommonOrganisation>();
+            CreateMap<Banking.Domain.Entities.Organisation, CommonOrganisation>().MaxDepth(AutoMapperMaxDepth);
 
             // Mapping from Person to CustomerModel
             CreateMap<Banking.Domain.Entities.Person, CustomerModel>()
                 .ForMember(dest => dest.Person, source => source.MapFrom(source => source))
-                .ForMember(dest => dest.Organisation, opt => opt.Ignore());
+                .ForMember(dest => dest.Organisation, opt => opt.Ignore())
+                .MaxDepth(AutoMapperMaxDepth);
 
             // Mapping from Organisation to CustomerModel
             CreateMap<Banking.Domain.Entities.Organisation, CustomerModel>()
                 .ForMember(dest => dest.Organisation, source => source.MapFrom(source => source))
-                .ForMember(dest => dest.Person, opt => opt.Ignore());
+                .ForMember(dest => dest.Person, opt => opt.Ignore())
+                .MaxDepth(AutoMapperMaxDepth);
 
             // Mapping from Person to ResponseCommonCustomer
             CreateMap<Banking.Domain.Entities.Person, ResponseCommonCustomer>()
                 .IgnoreAllMembers()
-                .ForMember(dest => dest.Data, source => source.MapFrom(source => source));
+                .ForMember(dest => dest.Data, source => source.MapFrom(source => source))
+                .MaxDepth(AutoMapperMaxDepth);
 
             // Mapping from Organisation to ResponseCommonCustomer
             CreateMap<Banking.Domain.Entities.Organisation, ResponseCommonCustomer>()
                 .IgnoreAllMembers()
-                .ForMember(dest => dest.Data, source => source.MapFrom(source => source));
+                .ForMember(dest => dest.Data, source => source.MapFrom(source => source))
+                .MaxDepth(AutoMapperMaxDepth);
 
             // Mappings for energy industry
-            CreateMap<Energy.Domain.Entities.Person, CommonPerson>();
+            CreateMap<Energy.Domain.Entities.Person, CommonPerson>().MaxDepth(AutoMapperMaxDepth);
 
-            CreateMap<Energy.Domain.Entities.Organisation, CommonOrganisation>();
+            CreateMap<Energy.Domain.Entities.Organisation, CommonOrganisation>().MaxDepth(AutoMapperMaxDepth);
 
             // Mapping from Person to CustomerModel
             CreateMap<Energy.Domain.Entities.Person, CustomerModel>()
                 .ForMember(dest => dest.Person, source => source.MapFrom(source => source))
-                .ForMember(dest => dest.Organisation, opt => opt.Ignore());
+                .ForMember(dest => dest.Organisation, opt => opt.Ignore())
+                .MaxDepth(AutoMapperMaxDepth);
 
             // Mapping from Organisation to CustomerModel
             CreateMap<Energy.Domain.Entities.Organisation, CustomerModel>()
                 .ForMember(dest => dest.Organisation, source => source.MapFrom(source => source))
-                .ForMember(dest => dest.Person, opt => opt.Ignore());
+                .ForMember(dest => dest.Person, opt => opt.Ignore())
+                .MaxDepth(AutoMapperMaxDepth);
 
             // Mapping from Person to ResponseCommonCustomer
             CreateMap<Energy.Domain.Entities.Person, ResponseCommonCustomer>()
                 .IgnoreAllMembers()
-                .ForMember(dest => dest.Data, source => source.MapFrom(source => source));
+                .ForMember(dest => dest.Data, source => source.MapFrom(source => source))
+                .MaxDepth(AutoMapperMaxDepth);
 
             // Mapping from Organisation to ResponseCommonCustomer
             CreateMap<Energy.Domain.Entities.Organisation, ResponseCommonCustomer>()
                 .IgnoreAllMembers()
-                .ForMember(dest => dest.Data, source => source.MapFrom(source => source));
+                .ForMember(dest => dest.Data, source => source.MapFrom(source => source))
+                .MaxDepth(AutoMapperMaxDepth);
         }
     }
 }