Syntrony.Mapping.AutoMapper 1.1.0

Syntrony.Mapping.AutoMapper

The v1 engine for Syntrony.Mapping — implements its contracts on top of AutoMapper 14.x. Syntrony.Mapping itself has zero dependency on AutoMapper; this package is what actually maps anything, and it can be swapped for a different engine later without touching consumer code.

Self-contained — does not require the Syntrony core package. Registers directly on IServiceCollection, like every other Syntrony capability package (see Syntrony.HttpClient). If your service also uses Syntrony for its DI conventions or ICurrentUser, this package works alongside it with no extra wiring; if it doesn't, this is all you need:

services.AddSyntronyMapping(options => options
    .AddAssemblyContaining<Startup>()
    .UseFluentConfiguration(DtoMappings.Map));

The MapperConfiguration is built and validated by a small IHostedService this package registers — it runs once the host starts, after every AddSyntronyMapping call and fluent configurator has already registered, so a misconfigured mapping fails the deployment, not the first request that hits it.

Supported subset (v1)

• IObjectMapper: Map<TDestination>(object), Map<TSource,TDestination>(source, destination), ProjectTo<TDestination>(IQueryable)
• Attributes: [AutoMapFrom], [AutoMapTo], [AutoMap], [IgnoreMap]
• Fluent: CreateMap, ForMember (MapFrom with expression or delegate, Ignore, UseValue, Condition, NullSubstitute), ReverseMap, ConvertUsing

Not supported in v1: ForPath, ForAllMembers, IValueResolver/ITypeConverter on the public contract, AutoMapKeyAttribute. See the HDU in the vault for the reasoning behind each.

Known risk: AutoMapper 14.x is pinned deliberately

AutoMapper 15.0.1+ requires a commercial or Community License (Lucky Penny Software). Version 14.0.0 is the last MIT release, but it carries an unpatched denial-of-service vulnerability (CVE-2026-32933 / GHSA-rvv3-g6hj-g44x): mapping a deeply self-referencing object graph can exhaust the stack and crash the process. There is no fix in the 14.x line and no way to guard against it from this adapter — the recursion happens inside AutoMapper itself.

Mitigate by not mapping untrusted, unbounded object graphs (e.g. deserialized external payloads) directly through IObjectMapper. This will be resolved when Syntrony's own mapping engine replaces AutoMapper as the v1 engine.

Credit

The attribute-to-pair resolution (AttributeMappingScanner, in Syntrony.Mapping) and the startup wiring in UseAutoMapper reproduce the pattern in ASP.NET Boilerplate's AbpAutoMapperModule (src/Abp.AutoMapper/AutoMapper/AbpAutoMapperModule.cs): scan for the mapping attributes, register every pair, then build and validate the whole configuration once, after every consumer has had a chance to register its own maps — the same reason ABP does this in PostInitialize rather than eagerly. See Syntrony.Mapping's README for the full list of ABP sources this package's shape is derived from.