satellite-provider/_docs/02_tasks/done/AZ-1132_fluentvalidation_bump.md

Bump FluentValidation 12.0.0 → 12.1.1

Task: AZ-1132_fluentvalidation_bump Name: Bump FluentValidation 12.0.0 → 12.1.1 Description: Coordinated patch bump of FluentValidation and FluentValidation.DependencyInjectionExtensions from 12.0.0 to 12.1.1 in SatelliteProvider.Api. Closes security finding D-AZ795-1 — sole remaining Low production dependency carry-over from cycle 13. Complexity: 1 point Dependencies: AZ-795 (shared validation infra — already shipped) Component: SatelliteProvider.Api — dependency upgrade only Tracker: AZ-1132 Epic: AZ-795

Problem

Cycle-13 dependency scan (_docs/05_security/dependency_scan_cycle13.md) carries D-AZ795-1 (Low): production FluentValidation packages remain pinned at 12.0.0 while 12.1.1 is available. The finding is the last open Low-severity production dependency item from the AZ-795 validation-hardening epic footprint.

Leaving the pin stale keeps cumulative security posture at PASS_WITH_WARNINGS and defers a one-line manifest fix that should ride with the validation stack the epic introduced.

Outcome

• Both FluentValidation and FluentValidation.DependencyInjectionExtensions resolve to 12.1.1 (or latest 12.1.x patch at implementation time if higher).
• All existing validator unit tests and validation integration tests pass unchanged.
• dotnet list SatelliteProvider.sln package --vulnerable reports no production FluentValidation finding.
• D-AZ795-1 marked Resolved in the cycle-15 security artifacts.

Scope

Included

• Edit SatelliteProvider.Api/SatelliteProvider.Api.csproj:
  • FluentValidation 12.0.0 → 12.1.1
  • FluentValidation.DependencyInjectionExtensions 12.0.0 → 12.1.1
• Run full test suite (./scripts/run-tests.sh) — all green required.
• Update cycle-15 security scan/report artifacts: mark D-AZ795-1 Resolved.
• Update _docs/02_document/modules/api_program.md and _docs/02_document/modules/tests_unit.md version pins if they reference 12.0.0.

Excluded

• Bumping unrelated packages (D2-cy4 JWT test packages, ImageSharp, etc.).
• Any validator rule, contract, or API behavior change.
• error-shape.md contract version bump — no wire-format change.

Acceptance Criteria

AC-1: Both FluentValidation packages pinned to 12.1.1 Given the post-task SatelliteProvider.Api.csproj When package versions are inspected Then both FluentValidation and FluentValidation.DependencyInjectionExtensions resolve to Version="12.1.1" (or latest 12.1.x if 12.1.1 is superseded).

AC-2: Validator unit tests pass Given the bumped repository When the validator unit test classes under SatelliteProvider.Tests/Validators/ run Then all tests pass with no changes to expected error keys or messages.

AC-3: Validation integration tests pass Given the bumped repository When validation-focused integration tests run (inventory, region, route, upload, latlon) Then all pass with no new failures vs. the pre-bump baseline.

AC-4: Vulnerable package scan clean for production FluentValidation Given the bumped repository When dotnet list SatelliteProvider.sln package --vulnerable is run Then no production-project finding references FluentValidation 12.0.0.

AC-5: Security finding D-AZ795-1 resolved Given the post-task _docs/05_security/ cycle-15 artifacts When dependency scan and security report are read Then D-AZ795-1 status is Resolved with a reference to this task's tracker ID.

Non-Functional Requirements

Compatibility

• Patch-level bump within FluentValidation 12.x — no public API contract changes expected.

Reliability

• Full test suite is the regression gate; smoke-only is insufficient for a validation-stack dependency.

Unit Tests

AC Ref	What to Test	Required Outcome
AC-2	All SatelliteProvider.Tests/Validators/* classes	PASS unchanged

Blackbox Tests

AC Ref	Initial Data/Conditions	What to Test	Expected Behavior	NFR References
AC-3	Existing validation integration fixtures	Inventory, region, route, upload, latlon validation suites	HTTP 400 shapes unchanged for known bad payloads	Compatibility

Constraints

• Both FluentValidation packages must bump in lockstep (same version line).
• No production code changes unless required by a breaking change in 12.1.1 (unlikely for patch).

Risks & Mitigation

Risk 1: Patch changes validator behavior

• Risk: FluentValidation 12.1.x alters rule evaluation or error message formatting.
• Mitigation: Full validator unit + integration test run; revert pin if unexpected diffs appear.

Risk 2: Transitive version conflict

• Risk: Another package pins FluentValidation to 12.0.0.
• Mitigation: Inspect dotnet list package --include-transitive after bump; align any direct pins.