NET 10 Package Pruning Warning NU1510 Can Break CI Builds on SDK Upgrade

·9 views

Starting with .NET 10, NuGet's package pruning feature is enabled by default for projects targeting .NET 10 or later, raising a NU1510 warning when a direct package reference is redundant because the SDK already supplies the same assembly. In repositories that treat warnings as errors, this causes restore to fail with a non-zero exit code, effectively breaking CI pipelines after an SDK upgrade. For single-target net10.0 applications, the fix is straightforward — removing the redundant PackageReference entirely — since the framework itself provides the assembly. However, multi-target libraries that still support older targets like netstandard2.0 must conditionally retain the reference for those frameworks to avoid breaking the dependency contract for package consumers. Microsoft recommends evaluating each target individually rather than deleting the reference globally, and verifying the packaged output to ensure downstream consumers receive correct dependency metadata.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Most Security Teams Lack Detection Rules for Cloud IAM Attacks, Experts Warn

Security teams with mature endpoint detection capabilities are often blind to cloud-native attacks because their rules assume a process tree exists, which IAM-based attacks do not have. A stolen AWS access key can enable full account reconnaissance through a burst of IAM API calls that leave no trace in EDR or host-based tools, only in CloudTrail logs. Attackers can escalate privileges by chaining legitimate permissions such as iam:PassRole with lambda:CreateFunction and lambda:InvokeFunction, a well-documented AWS escalation path that triggers no traditional alerts. Experts say effective cloud detection requires understanding normal API behavior per identity and flagging unusual permission combinations across providers including Azure, GCP, and Kubernetes. The same detection engineering discipline used for host and network threats can be applied to audit logs, but that translation must be deliberately built rather than assumed.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Capgo's Capacitor Updater auto-rolls back broken OTA bundles in 10 seconds

The open-source @capgo/capacitor-updater plugin uses a native handshake mechanism to detect and recover from failed over-the-air JavaScript bundle updates on mobile devices. When a new bundle is deployed, the native layer starts a 10-second timer and waits for the app's JavaScript to call notifyAppReady(), confirming a successful boot. If the call is never made — due to a crash or hang — the timer expires and the plugin automatically restores the last known working bundle without any cloud dashboard intervention. Developers can monitor rollback events via the updateFailed listener and retrieve details of the failed bundle using getFailedUpdate(). Testing is recommended on an isolated channel with a single device before any changes reach the production build.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

One Stopped Container Can Prevent nginx From Starting — Here Is the Fix

A single stopped Docker container can prevent nginx from starting entirely, taking down all proxied services including frontends and APIs. This happens because nginx resolves hostnames literally at config-parse time, making every upstream a hard startup dependency. The fix involves using a variable for proxy_pass targets along with Docker's internal DNS resolver, which defers resolution to request time and limits failures to a 502 on the affected route only. However, switching to variable-based proxy_pass breaks nginx's automatic URI prefix stripping, requiring manual rewrites for location blocks with trailing slashes. A further side effect involves CORS preflight handling, where the interaction between rewrite and if directives can cause subtle, hard-to-diagnose failures.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Timeline Studio: Open-Source AI Video Editor That Runs Entirely in the Browser

A developer has built Timeline Studio, an open-source, local-first AI video editor that processes media directly in the browser rather than uploading footage to remote servers. The tool supports multi-track timelines, captions, voiceovers, visual effects, and offline export, using WebGPU and WebAssembly for AI inference. To manage large AI models efficiently, the editor lazy-loads them only when a feature is first used, caches them via a service worker, and mirrors files across Hugging Face and ModelScope for reliability. Models are pinned to specific versions so upstream changes cannot silently affect editing workflows, and a shared cache identity ensures fallback downloads do not duplicate files on the user's device. Export quality is kept consistent by treating the timeline as declarative state and using a dedicated offline rendering path, rather than simply recording live on-screen playback.

0 comments Read more at DEV Community