chore(deps): update dependency automapper to v15 [security] - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
AutoMapper (source)	12.0.1 → 15.1.3

GitHub Vulnerability Alerts

CVE-2026-32933

Summary

AutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a StackOverflowException and causing the entire application process to terminate.

Description

The vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level.

Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since StackOverflowException cannot be caught in modern .NET runtimes, the application cannot recover and will crash immediately.

Impact

• Availability: An attacker can crash the application server, leading to a complete Denial of Service.
• Process Termination: Unlike standard exceptions, this terminates the entire process, not just the individual request thread.

Proof of Concept (PoC)

The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it:

class Circular { public Circular Self { get; set; } }

// Setup configuration
var config = new MapperConfiguration(cfg => {
    cfg.CreateMap<Circular, Circular>();
});
var mapper = config.CreateMapper();

// Create a deeply nested object (28,000+ levels)
var root = new Circular();
var current = root;
for (int i = 0; i < 30000; i++) {
    current.Self = new Circular();
    current = current.Self;
}

// This call triggers the StackOverflowException and crashes the process
mapper.Map<Circular>(root);

Recommended Mitigation

1. Secure Defaults: Implement a default MaxDepth (e.g., 32 or 64) for all mapping operations.
2. Configurable Limit: Allow users to increase this limit if necessary, but ensure it is enabled by default to protect unsuspecting developers.

---

Release Notes

LuckyPennySoftware/AutoMapper (AutoMapper)

v15.1.3

What's Changed

• Fix GHSA-rvv3-g6hj-g44x: default MaxDepth of 64 for self-referential types (15.x backport) by @​jbogard in #​4619

Security

Fixed an issue where certain cyclic or self-referential object graphs could trigger uncontrolled recursion during mapping, potentially resulting in stack exhaustion and denial of service.

Applications that process untrusted or attacker-controlled object graphs through affected mapping paths may be impacted.

Users should upgrade to this release.

Security advisory: GHSA-rvv3-g6hj-g44x

Thanks to @​skdishansachin for responsibly disclosing this issue.

Full Changelog: LuckyPennySoftware/AutoMapper@v15.1.0...v15.1.3

v15.1.2

What's Changed

• docs: Document duplicate license message behavior and fixes by @​Copilot in #​4617

Security

Fixed an issue where certain cyclic or self-referential object graphs could trigger uncontrolled recursion during mapping, potentially resulting in stack exhaustion and denial of service.

Applications that process untrusted or attacker-controlled object graphs through affected mapping paths may be impacted.

Users should upgrade to this release.

Security advisory: GHSA-rvv3-g6hj-g44x

Thanks to @​skdishansachin for responsibly disclosing this issue.

Full Changelog: LuckyPennySoftware/AutoMapper@v16.1.1...v15.1.2

v15.1.1

What's Changed

• docs: Document duplicate license message behavior and fixes by @​Copilot in #​4617

Security

Fixed an issue where certain cyclic or self-referential object graphs could trigger uncontrolled recursion during mapping, potentially resulting in stack exhaustion and denial of service.

Applications that process untrusted or attacker-controlled object graphs through affected mapping paths may be impacted.

Users should upgrade to this release.

Security advisory: GHSA-rvv3-g6hj-g44x

Thanks to @​skdishansachin for responsibly disclosing this issue.

Full Changelog: LuckyPennySoftware/AutoMapper@v16.1.1...v15.1.1

v15.1.0

What's Changed

• remove Microsoft.SourceLink.GitHub by @​SimonCropp in #​4555
• Direct .NET 4.x support by @​jbogard in #​4569
• Bumping the JsonWebTokens because of GHSA-8g4q-xg66-9fp4; fixes #​4575 by @​jbogard in #​4576
• Provide better exceptions for errors when building the mapping plan by @​jbogard in #​4577
• Adding docs for license configuration by @​jbogard in #​4581
• Updating refs to fix missing method issue by @​jbogard in #​4582

New Contributors

• @​SimonCropp made their first contribution in #​4555

Full Changelog: LuckyPennySoftware/AutoMapper@v15.0.1...v15.1.0

v15.0.1

What's Changed

• Removing public signing; fixes #​4545 by @​jbogard in #​4552
• Adding back missing overloads and reverting registering behavior by @​jbogard in #​4554

Full Changelog: LuckyPennySoftware/AutoMapper@v15.0.0...v15.0.1

This release supersedes the 15.0.0 release, reverting behavior and overloads so that the AddAutoMapper overloads separate the "scanning for maps" from the "scanning for dependencies". Unfortunately it's not really possible to combine these two together.

This also fixes a critical bug in #​4545 that does not work with .NET 4.x applications (as intended).

Because of this, the 15.0.0 will be delisted because of the breaking changes there.

v15.0.0

Full Changelog: LuckyPennySoftware/AutoMapper@v14.0.0...v15.0.0

• Added support for .NET Standard 2.0
• Requiring license key
• Moving from MIT license to dual commercial/OSS license

To set your license key:

services.AddAutoMapper(cfg => {
    cfg.LicenseKey = "<License key here>";
});

This also introduced a breaking change with MapperConfiguration requiring an ILoggerFactory for logging purposes:

public MapperConfiguration(MapperConfigurationExpression configurationExpression, ILoggerFactory loggerFactory)

Registering AutoMapper with services.AddAutoMapper will automatically supply this parameter. Otherwise you'll need to supply the logger factory.

You can obtain your license key at AutoMapper.io

v14.0.0

What's Changed

• Reverted the nullable annotations by @​lbargaoanu in AutoMapper#4390
• Fix polymorphic mapping when some derived types have explicit mappings and others do not by @​kev-andrews in AutoMapper#4402
• The default naming conventions for a profile should come from the glo… by @​lbargaoanu in AutoMapper#4428
• Fix Issue #​4502 - Confusing exception when trying to map types with … by @​Biotronic in AutoMapper#4503
• Target .net 8 and seal more classes by @​lbargaoanu in AutoMapper#4474
• Target .Net 9 in tests by @​lbargaoanu in AutoMapper#4507
• Changed lock-threads parameters by @​lbargaoanu in AutoMapper#4516
• Don't throw and catch on validation by @​lbargaoanu in AutoMapper#4526

New Contributors

• @​kev-andrews made their first contribution in AutoMapper#4402
• @​Biotronic made their first contribution in AutoMapper#4503

Full Changelog: LuckyPennySoftware/AutoMapper@v13.0.1...v14.0.0

v13.0.1

What's Changed

• Updating to latest template from readthedocs.io by @​jbogard in AutoMapper#4380
• Remove Microsoft.CSharp nuget dependency by @​Romfos in AutoMapper#4381
• We build for .net 6 now by @​lbargaoanu in AutoMapper#4382
• Revert "nullable annotations for the runtime public API" by @​jbogard in AutoMapper#4388

New Contributors

• @​Romfos made their first contribution in AutoMapper#4381

Full Changelog: LuckyPennySoftware/AutoMapper@v13.0.0...v13.0.1

v13.0.0

What's Changed

• Emphasized the ProjectTo method call location by @​jbogard in AutoMapper#4105
• Target .NET 6 by @​lbargaoanu in AutoMapper#4202
• Add the DI code by @​lbargaoanu in AutoMapper#4278
• Support mapping of polymorphic collection with abstract parent type by @​kvpt in AutoMapper#4304
• Constructor mapping inheritance by @​rubengonzalezlodeiro in AutoMapper#4314
• Add integration test case by @​kvpt in AutoMapper#4320
• add options to disable and override ExplicitExpansion by @​Angelinsky7 in AutoMapper#4327
• ProjectTo runtime polymorphic mapping with Include/IncludeBase by @​lbargaoanu in AutoMapper#4280

New Contributors

• @​kvpt made their first contribution in AutoMapper#4304
• @​rubengonzalezlodeiro made their first contribution in AutoMapper#4314
• @​Angelinsky7 made their first contribution in AutoMapper#4327

Full Changelog: LuckyPennySoftware/AutoMapper@v12.0.1...v13.0.0

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Thank you for your contribution! 🙏 We will review it as soon as possible.