Merge 5.4.9 into 5.5.x

appveyor.yml

@@ -71,8 +71,8 @@ before_test:
       'Odbc' { Start-Service 'MSSQL$SQL2017' }
       'PostgreSQL' {
         # Enable prepared transactions
-        Add-Content -Path 'C:\Program Files\PostgreSQL\10\data\postgresql.conf' -Value "`r`nmax_prepared_transactions = 100"
-        Start-Service 'postgresql-x64-10'
+        Add-Content -Path 'C:\Program Files\PostgreSQL\13\data\postgresql.conf' -Value "`r`nmax_prepared_transactions = 100"
+        Start-Service 'postgresql-x64-13'
       }
       'SqlServer2008' { Start-Service 'MSSQL$SQL2017' }
       'SqlServer2008-MicrosoftDataSqlClientDriver' { Start-Service 'MSSQL$SQL2017' }

build-common/NHibernate.props

@@ -16,6 +16,7 @@
 
     <NhAppTargetFrameworks Condition ="$(NhAppTargetFrameworks) == ''">net48;net6.0</NhAppTargetFrameworks>
     <NhLibTargetFrameworks Condition ="$(NhLibTargetFrameworks) == ''">net461;net48;netcoreapp2.0;netstandard2.0;netstandard2.1;net6.0</NhLibTargetFrameworks>
+    <RuntimeFrameworkVersion Condition="'$(TargetFramework)' == 'netcoreapp2.0'">2.0.3</RuntimeFrameworkVersion>
     <NhNetFx>false</NhNetFx>
     <NhNetFx Condition="$(TargetFramework.StartsWith('net4'))">true</NhNetFx>
     <!-- Visual Basic requires to use coma (,) as a separator, other project types - semicolon (;) -->

doc/reference/modules/configuration.xml

@@ -871,6 +871,20 @@ var session = sessions.OpenSession(conn);
                             </para>
                         </entry>
                     </row>
+                    <row>
+                        <entry>
+                            <literal>escape_backslash_in_strings</literal>
+                        </entry>
+                        <entry>
+                            Indicates if the database needs to have backslash escaped in string literals.
+                            The default value is dialect dependant. That is <literal>false</literal> for
+                            most dialects.
+                            <para>
+                                <emphasis role="strong">eg.</emphasis> 
+                                <literal>true</literal> | <literal>false</literal>
+                            </para>
+                        </entry>
+                    </row>
                     <row>
                         <entry>
                             <literal>show_sql</literal>
@@ -1515,12 +1529,6 @@ in the parameter binding.</programlisting>
                             <entry><literal>NHibernate.Dialect.PostgreSQLDialect</literal></entry>
                             <entry></entry>
                         </row>
-                        <row>
-                            <entry>PostgreSQL</entry>
-                            <entry><literal>NHibernate.Dialect.PostgreSQLDialect</literal></entry>
-                            <entry>
-                            </entry>
-                        </row>
                         <row>
                             <entry>PostgreSQL 8.1</entry>
                             <entry><literal>NHibernate.Dialect.PostgreSQL81Dialect</literal></entry>

lib/teamcity/postgresql/postgresql_installation.txt

@@ -1,7 +1,7 @@
 
 Installation steps for PostgreSQL for NH TeamCity:
 
-1.  Download PostgreSQL (postgresql-9.0.3-1-windows_x64.exe):  http://www.enterprisedb.com/products-services-training/pgdownload#windows;
+1.  Download PostgreSQL: https://www.enterprisedb.com/downloads/postgres-postgresql-downloads;
 2.  Run the installer ... when prompted to make a password for the service account, make it 'password';
 3.  Leave the port number at the default (5432), and leave the default locale;
 4.  The setup should install PostgreSQL on the machine;
@@ -12,8 +12,8 @@ Installation steps for PostgreSQL for NH TeamCity:
 
 Creating the NH user:
 
-a.  Open pgAdmin III (start -> programs -> PostgreSQL 9.0 -> pgAdmin III);
-b.  right-click the PostgreSQL 9.0 database, select connect, and enter the password from step 2 above;
-c.  right-clilck the Login Roles, and select "New Login Role ...";
-d.  create a login with "Role name=nhibernate", "Password=nhibernate", and select Superuser on the Role privileges tab.
+a.  Open pgAdmin 4;
+b.  Right-click the PostgreSQL database, select connect, and enter the password from step 2 above;
+c.  Right-clilck the Login Roles, and select "New Login Role ...";
+d.  Create a login with "Role name=nhibernate", "Password=nhibernate", and select Superuser on the Role privileges tab.
 

releasenotes.txt

@@ -105,6 +105,26 @@ Release notes - NHibernate - Version 5.5.0
    * #3412 Revive hql ParsingFixture
 
 
+Build 5.4.9
+=============================
+
+Release notes - NHibernate - Version 5.4.9
+
+6 issues were resolved in this release, including CVE-2024-39677.
+
+** Bug
+
+   * #3547 Handle SQL injection vulnerabilities within ObjectToSQLString
+
+** Task
+
+   * #3576 Release 5.4.9
+   * #3558 Migrate AppVeyor & TC builds to PostgreSQL 13
+   * #3545 Upgrade Npgsql to a non vulnerable version
+   * #3544 Upgrade vulnerable test dependencies
+   * #3517 Obsolete vulnerable literal AddColumn
+
+
 Build 5.4.8
 =============================
 

src/NHibernate.Config.Templates/SapSQLAnywhere.cfg.xml

@@ -15,7 +15,7 @@ for your own use before compiling tests in Visual Studio.
 		<property name="connection.connection_string">
 			UID=DBA;PWD=sql;Server=localhost;DBN=nhibernate;DBF=c:\nhibernate.db;ASTOP=No;Enlist=false;
 		</property>
-		<property name="dialect">NHibernate.Dialect.SybaseSQLAnywhere12Dialect</property>
+		<property name="dialect">NHibernate.Dialect.SapSQLAnywhere17Dialect</property>
 		<property name="query.substitutions">true=1;false=0</property>
 	</session-factory>
 </hibernate-configuration>