fix: Add UpdateService checksum tests, update Newtonsoft.Json refere…

.editorconfig

@@ -29,6 +29,7 @@ dotnet_diagnostic.CA1867.severity = none   # Use 'string.Contains(char)'
 
 # Performance suggestions that might be overkill or incompatible
 dotnet_diagnostic.CA1822.severity = none   # Mark members as static
+dotnet_diagnostic.CA1850.severity = none   # Prefer static HashData method (not in .NET Framework 4.8)
 dotnet_diagnostic.CA1861.severity = none   # Prefer 'static readonly' fields over constant array arguments
 
 # ===================================================================

CHANGELOG.md

@@ -7,14 +7,36 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- **Tests**: Added comprehensive unit tests for `UpdateService` SHA256 checksum validation, including tests for
+  checksum extraction, file verification, and invalid format handling.
+- **Tests**: Enhanced `UpdateServiceTests` with whitespace-only checksum test cases (space, tab, mixed whitespace)
+  to ensure edge cases are properly handled.
+
+### Changed
+
+- **Code Quality**: Updated `ValidateChecksum` to use `IsNullOrWhiteSpace` instead of `IsNullOrEmpty`,
+  ensuring whitespace-only checksums are treated the same as null/empty (allow update with warning).
+- **Code Quality**: Narrowed `#pragma warning disable` scope in `UpdateServiceTests.cs` to only affect
+  the specific lines that need suppression, improving code maintainability and making it easier to spot new issues.
+
+- **Build**: Updated `StreamerBot.csproj` to conditionally use Newtonsoft.Json NuGet package for CI builds
+  (when local Streamer.bot DLL is unavailable) while maintaining local reference for development builds.
+
+### Infrastructure
+
+- **Code Analysis**: Disabled CA1850 diagnostic ("Prefer static HashData method") in `.editorconfig` as the
+  recommended `HashData` method is not available in .NET Framework 4.8.
+
 ## [1.5.10] - 2026-02-08
 
 ### Added
 
 - **Security**: implemented strict SHA256 checksum validation for downloaded updates. The bot now extracts the checksum
-from release notes and verifies file integrity before saving.
+  from release notes and verifies file integrity before saving.
 - **CI**: Updated `release.yml` workflow to automatically calculate the SHA256 checksum of `GiveawayBot.cs` and append
-it to the release body.
+  it to the release body.
 
 ### Documentation
 

GiveawayBot.cs

@@ -1,3 +1,3 @@
 // Suppress "modernization" suggestions to maintain compatibility with Streamer.bot's internal compiler
 // Streamer.bot uses .NET Framework 4.8 / C# 7.3
 // CI Verification Trigger environment)
@@ -9303,7 +9303,7 @@
         /// <returns>True if valid (or no checksum provided), False if mismatch.</returns>
         public static bool ValidateChecksum(string content, string expectedChecksum, CPHAdapter adapter = null)
         {
-            if (string.IsNullOrEmpty(expectedChecksum))
+            if (string.IsNullOrWhiteSpace(expectedChecksum))
             {
                 adapter?.LogWarn("[UpdateService] [Validation] ⚠ No checksum provided. Skipping validation.");
                 return true;

StreamerBot.csproj

@@ -50,9 +50,12 @@
     <Reference Include="$(StreamerBotPath)\Wpf*.dll">
       <Private>true</Private>
     </Reference>
-    <Reference Include="$(StreamerBotPath)\Newtonsoft.Json.dll">
+    <!-- Newtonsoft.Json: Use NuGet package for CI builds, local reference for Streamer.bot development -->
+    <PackageReference Include="Newtonsoft.Json" Version="13.0.3" Condition="!Exists('$(StreamerBotPath)\Newtonsoft.Json.dll')" />
+    <Reference Include="$(StreamerBotPath)\Newtonsoft.Json.dll" Condition="Exists('$(StreamerBotPath)\Newtonsoft.Json.dll')">
       <Private>true</Private>
     </Reference>
+
     <Reference Include="$(StreamerBotPath)\System.*.dll">
       <Private>true</Private>
     </Reference>

_tests/UpdateServiceTests.cs

@@ -1,7 +1,9 @@
+// Streamer.bot uses .NET Framework 4.8 / C# 7.3
 using System;
 using System.Threading.Tasks;
 using StreamerBot;
 
+#pragma warning disable IDE0130 // Namespace does not match folder structure
 namespace StreamerBot.Tests
 {
     public static class UpdateServiceTests
@@ -64,14 +66,24 @@ private static Task TestValidateChecksum_Invalid()
 
         private static Task TestValidateChecksum_NoChecksum()
         {
-             // Should return true (allow update with warning)
-             if (!UpdateService.ValidateChecksum("Content", null))
+            // Should return true (allow update with warning)
+            if (!UpdateService.ValidateChecksum("Content", null))
                 throw new Exception("TestValidateChecksum_NoChecksum failed: Null checksum should pass (warn only)");
 
-             if (!UpdateService.ValidateChecksum("Content", ""))
+            if (!UpdateService.ValidateChecksum("Content", ""))
                 throw new Exception("TestValidateChecksum_NoChecksum failed: Empty checksum should pass (warn only)");
 
-             return Task.CompletedTask;
+            // Whitespace-only checksums should behave the same as no checksum (warn only, but allow update)
+            if (!UpdateService.ValidateChecksum("Content", " "))
+                throw new Exception("TestValidateChecksum_NoChecksum failed: Single-space checksum should pass (warn only)");
+
+            if (!UpdateService.ValidateChecksum("Content", "\t"))
+                throw new Exception("TestValidateChecksum_NoChecksum failed: Tab checksum should pass (warn only)");
+
+            if (!UpdateService.ValidateChecksum("Content", " \t "))
+                throw new Exception("TestValidateChecksum_NoChecksum failed: Mixed whitespace checksum should pass (warn only)");
+
+            return Task.CompletedTask;
         }
     }
 }