fix(serialization): Remove legacy BinaryFormatter support

The `[Serializable]` attribute and corresponding `[OnDeserialized]` methods have been removed from various breakdown classes. This eliminates reliance on `BinaryFormatter`, which is a deprecated and insecure serialization mechanism in modern .NET.

This change also resolves SonarQube rule S5766 warnings by removing the context in which they apply, leading to cleaner and more secure code.

src/Strata.SqlTools.LinqToSql/Breakdowns/LinqQueryBreakdown.cs

@@ -14,7 +14,6 @@ namespace Strata.SqlTools.Breakdowns.LinqToSql;
 /// SELECT, WHERE, JOIN, GROUP BY, and ORDER BY clauses, making them accessible
 /// through the QueryBreakdown interface.
 /// </remarks>
-[Serializable]
 public class LinqQueryBreakdown : QueryBreakdown
 {
     /// <summary>

src/Strata.SqlTools.PostgreSql/Breakdowns/QueryBreakdown.cs

@@ -1,5 +1,4 @@
 using System.Collections;
-using System.Runtime.Serialization;
 using Strata.SqlTools.SqlBreakdown.Expressions;
 using Strata.SqlTools.SqlBreakdown.Interfaces.Core;
 using CommandVisitor = Strata.SqlTools.Visitors.PostgreSql.CommandVisitor;
@@ -15,7 +14,6 @@ namespace Strata.SqlTools.Breakdowns.PostgreSql;
 /// Represents a PostgreSQL query breakdown with all clauses, following PostgreSQL SQL standards.
 /// Handles positional parameters using $1, $2, ... syntax for parameterized queries.
 /// </summary>
-[Serializable]
 public class QueryBreakdown : SqlServerQueryBreakdown
 {
     private const string ExpressionNullErrorMessage = "Expression cannot be null.";
@@ -89,14 +87,6 @@ public class QueryBreakdown : SqlServerQueryBreakdown
         }
     }
 
-    /// <summary>
-    /// Re-establishes invariants after deserialization, since deserialization bypasses the
-    /// constructors that normally initialize the breakdown's clause state (SonarQube rule S5766).
-    /// </summary>
-    /// <param name="context">The streaming context for the deserialization operation.</param>
-    [OnDeserialized]
-    private void OnDeserialized(StreamingContext context) => RevalidateBreakdownState();
-
     /// <summary>
     /// Adds a parameter to the query using PostgreSQL's positional parameter format ($1, $2, ...).
     /// </summary>

src/Strata.SqlTools.PostgreSql/Breakdowns/QueryBreakdownCollection.cs

@@ -1,4 +1,3 @@
-using System.Runtime.Serialization;
 using System.Text;
 using Strata.SqlTools.SqlBreakdown.Classes;
 using Strata.SqlTools.SqlBreakdown.Interfaces;
@@ -13,7 +12,6 @@ namespace Strata.SqlTools.Breakdowns.PostgreSql;
 /// including support for PostgreSQL features like schema-qualified identifiers,
 /// LIMIT/OFFSET clauses, parameterized queries using $1, $2 syntax, and CTEs.
 /// </remarks>
-[Serializable]
 public class QueryBreakdownCollection : SqlBreakdownCollection
 {
     private readonly List<QueryBreakdown> _queryBreakdowns;
@@ -36,20 +34,6 @@ public class QueryBreakdownCollection : SqlBreakdownCollection
         _queryBreakdowns = queryBreakdowns?.ToList() ?? new List<QueryBreakdown>();
     }
 
-    /// <summary>
-    /// Validates that the backing list survived deserialization, since deserialization bypasses
-    /// the constructors that normally initialize it (SonarQube rule S5766).
-    /// </summary>
-    /// <param name="context">The streaming context for the deserialization operation.</param>
-    [OnDeserialized]
-    private void OnDeserialized(StreamingContext context)
-    {
-        if (_queryBreakdowns is null)
-        {
-            throw new SerializationException("Deserialized QueryBreakdownCollection is missing its backing list.");
-        }
-    }
-
     /// <summary>
     /// Gets the collection of QueryBreakdown objects.
     /// </summary>

src/Strata.SqlTools.Snowflake/Breakdowns/DeleteBreakdown.cs

@@ -1,5 +1,4 @@
 using System.Collections;
-using System.Runtime.Serialization;
 using System.Text;
 using SqlServerDeleteBreakdown = Strata.SqlTools.Breakdowns.SqlServer.DeleteBreakdown;
 using StatementParser = Strata.SqlTools.Statements.Snowflake.StatementParser;
@@ -9,7 +8,6 @@ namespace Strata.SqlTools.Breakdowns.Snowflake;
 /// <summary>
 /// Represents a DELETE SQL statement breakdown with FROM and WHERE clauses for Snowflake.
 /// </summary>
-[Serializable]
 public class DeleteBreakdown : SqlServerDeleteBreakdown
 {
     private static readonly StatementParser SnowflakeParserInstance = new StatementParser();
@@ -41,14 +39,6 @@ public class DeleteBreakdown : SqlServerDeleteBreakdown
         WhereClause.Comment = whereComments.Count > 0 ? string.Join(" ", whereComments) : null;
     }
 
-    /// <summary>
-    /// Re-establishes invariants after deserialization, since deserialization bypasses the
-    /// constructors that normally initialize the breakdown's clause state (SonarQube rule S5766).
-    /// </summary>
-    /// <param name="context">The streaming context for the deserialization operation.</param>
-    [OnDeserialized]
-    private void OnDeserialized(StreamingContext context) => RevalidateBreakdownState();
-
     /// <summary>
     /// Gets the SQL breakdown as a string for Snowflake.
     /// </summary>

src/Strata.SqlTools.Snowflake/Breakdowns/InsertBreakdown.cs

@@ -1,5 +1,4 @@
 using System.Collections;
-using System.Runtime.Serialization;
 using Strata.SqlTools.SqlBreakdown.Utilities;
 using SqlServerInsertBreakdown = Strata.SqlTools.Breakdowns.SqlServer.InsertBreakdown;
 using StatementParser = Strata.SqlTools.Statements.Snowflake.StatementParser;
@@ -9,7 +8,6 @@ namespace Strata.SqlTools.Breakdowns.Snowflake;
 /// <summary>
 /// Represents an INSERT SQL statement breakdown with column and value clauses for Snowflake.
 /// </summary>
-[Serializable]
 public class InsertBreakdown : SqlServerInsertBreakdown
 {
     private static readonly StatementParser SnowflakeParserInstance = new StatementParser();
@@ -66,14 +64,6 @@ public class InsertBreakdown : SqlServerInsertBreakdown
         ValuesClause.Clause = string.Join(",", valuesList);
     }
 
-    /// <summary>
-    /// Re-establishes invariants after deserialization, since deserialization bypasses the
-    /// constructors that normally initialize the breakdown's clause state (SonarQube rule S5766).
-    /// </summary>
-    /// <param name="context">The streaming context for the deserialization operation.</param>
-    [OnDeserialized]
-    private void OnDeserialized(StreamingContext context) => RevalidateBreakdownState();
-
     #region Parse Methods
 
     /// <summary>

src/Strata.SqlTools.Snowflake/Breakdowns/ProcedureBreakdown.cs

@@ -1,5 +1,4 @@
 using System.Collections;
-using System.Runtime.Serialization;
 using System.Text;
 using SqlServerProcedureBreakdown = Strata.SqlTools.Breakdowns.SqlServer.ProcedureBreakdown;
 using StatementParser = Strata.SqlTools.Statements.Snowflake.StatementParser;
@@ -9,7 +8,6 @@ namespace Strata.SqlTools.Breakdowns.Snowflake;
 /// <summary>
 /// Represents a Snowflake stored procedure call breakdown with procedure name and parameters.
 /// </summary>
-[Serializable]
 public class ProcedureBreakdown : SqlServerProcedureBreakdown
 {
     private static readonly StatementParser SnowflakeParserInstance = new StatementParser();
@@ -47,15 +45,6 @@ public class ProcedureBreakdown : SqlServerProcedureBreakdown
         Parameters = parameters ?? new Dictionary<string, string>();
     }
 
-    /// <summary>
-    /// Re-establishes invariants after deserialization, since deserialization bypasses the
-    /// constructors that normally initialize the procedure name and parameter collection
-    /// (SonarQube rule S5766).
-    /// </summary>
-    /// <param name="context">The streaming context for the deserialization operation.</param>
-    [OnDeserialized]
-    private void OnDeserialized(StreamingContext context) => RevalidateBreakdownState();
-
     /// <summary>
     /// Gets the SQL breakdown as a string for Snowflake.
     /// </summary>

src/Strata.SqlTools.Snowflake/Breakdowns/QueryBreakdown.cs

@@ -1,5 +1,4 @@
 using System.Collections;
-using System.Runtime.Serialization;
 using System.Text;
 using Strata.SqlTools.SqlBreakdown.Classes;
 using Strata.SqlTools.SqlBreakdown.Expressions;
@@ -19,7 +18,6 @@ namespace Strata.SqlTools.Breakdowns.Snowflake;
 /// Represents a Snowflake SQL query breakdown with all clauses, following Snowflake SQL standards.
 /// Handles both :parameter and @parameter syntax for Snowflake compatibility.
 /// </summary>
-[Serializable]
 public class QueryBreakdown : SqlServerQueryBreakdown
 {
     private const string ExpressionNullErrorMessage = "Expression cannot be null.";
@@ -86,14 +84,6 @@ public class QueryBreakdown : SqlServerQueryBreakdown
         OrderByClause.Comment = orderByComments.Count > 0 ? string.Join(" ", orderByComments) : null;
     }
 
-    /// <summary>
-    /// Re-establishes invariants after deserialization, since deserialization bypasses the
-    /// constructors that normally initialize the breakdown's clause state (SonarQube rule S5766).
-    /// </summary>
-    /// <param name="context">The streaming context for the deserialization operation.</param>
-    [OnDeserialized]
-    private void OnDeserialized(StreamingContext context) => RevalidateBreakdownState();
-
     /// <summary>
     /// Adds a parameter to the query using Snowflake's :param format.
     /// Also adds @param format for compatibility.

src/Strata.SqlTools.Snowflake/Breakdowns/QueryBreakdownCollection.cs

@@ -1,4 +1,3 @@
-using System.Runtime.Serialization;
 using System.Text;
 using Strata.SqlTools.SqlBreakdown.Classes;
 using Strata.SqlTools.SqlBreakdown.Interfaces;
@@ -14,7 +13,6 @@ namespace Strata.SqlTools.Breakdowns.Snowflake;
 /// time travel, snowflake-specific parameters (:parameter and @parameter syntax),
 /// and proper batch handling.
 /// </remarks>
-[Serializable]
 public class QueryBreakdownCollection : SqlBreakdownCollection
 {
     private readonly List<QueryBreakdown> _queryBreakdowns;
@@ -37,20 +35,6 @@ public class QueryBreakdownCollection : SqlBreakdownCollection
         _queryBreakdowns = new List<QueryBreakdown>(queryBreakdowns ?? Enumerable.Empty<QueryBreakdown>());
     }
 
-    /// <summary>
-    /// Validates that the backing list survived deserialization, since deserialization bypasses
-    /// the constructors that normally initialize it (SonarQube rule S5766).
-    /// </summary>
-    /// <param name="context">The streaming context for the deserialization operation.</param>
-    [OnDeserialized]
-    private void OnDeserialized(StreamingContext context)
-    {
-        if (_queryBreakdowns is null)
-        {
-            throw new SerializationException("Deserialized QueryBreakdownCollection is missing its backing list.");
-        }
-    }
-
     /// <summary>
     /// Gets the collection of QueryBreakdown objects.
     /// </summary>

src/Strata.SqlTools.Snowflake/Breakdowns/UpdateBreakdown.cs

@@ -1,5 +1,4 @@
 using System.Collections;
-using System.Runtime.Serialization;
 using System.Text;
 using SqlServerUpdateBreakdown = Strata.SqlTools.Breakdowns.SqlServer.UpdateBreakdown;
 using StatementParser = Strata.SqlTools.Statements.Snowflake.StatementParser;
@@ -9,7 +8,6 @@ namespace Strata.SqlTools.Breakdowns.Snowflake;
 /// <summary>
 /// Represents an UPDATE SQL statement breakdown with SET, FROM, and WHERE clauses for Snowflake.
 /// </summary>
-[Serializable]
 public class UpdateBreakdown : SqlServerUpdateBreakdown
 {
     private static readonly StatementParser SnowflakeParserInstance = new StatementParser();
@@ -46,14 +44,6 @@ public class UpdateBreakdown : SqlServerUpdateBreakdown
         WhereClause.Comment = whereComments.Count > 0 ? string.Join(" ", whereComments) : null;
     }
 
-    /// <summary>
-    /// Re-establishes invariants after deserialization, since deserialization bypasses the
-    /// constructors that normally initialize the breakdown's clause state (SonarQube rule S5766).
-    /// </summary>
-    /// <param name="context">The streaming context for the deserialization operation.</param>
-    [OnDeserialized]
-    private void OnDeserialized(StreamingContext context) => RevalidateBreakdownState();
-
     /// <summary>
     /// Gets the SQL breakdown as a string for Snowflake.
     /// </summary>

src/Strata.SqlTools.SqlBreakdown/Classes/QueryParam.cs

@@ -5,7 +5,6 @@ namespace Strata.SqlTools.SqlBreakdown.Classes;
 /// <summary>
 /// Represents a query parameter with a name and value.
 /// </summary>
-[Serializable]
 public sealed class QueryParam : IQueryParam
 {
     /// <summary>

src/Strata.SqlTools.SqlBreakdown/Classes/RawSqlBreakdown.cs

@@ -10,7 +10,6 @@ namespace Strata.SqlTools.SqlBreakdown.Classes;
 /// This class is primarily used for batch SQL parsing where raw statements need to be stored
 /// without detailed clause breakdown. Actual clause parsing can be performed separately.
 /// </remarks>
-[Serializable]
 public class RawSqlBreakdown : ISqlBreakdown
 {
     /// <summary>

src/Strata.SqlTools.SqlBreakdown/Classes/SqlBreakdownBase.cs

@@ -7,7 +7,6 @@ namespace Strata.SqlTools.SqlBreakdown.Classes;
 /// <summary>
 /// Base class for SQL query breakdowns that provides common setup/finish clause handling and cloning.
 /// </summary>
-[Serializable]
 public abstract class SqlBreakdownBase : ISqlBreakdown
 {
     /// <summary>
@@ -48,18 +47,6 @@ public abstract class SqlBreakdownBase : ISqlBreakdown
     /// </summary>
     public bool IsUsingFinishClause => FinishClauses.Count > 0;
 
-    /// <summary>
-    /// Re-establishes the invariants normally guaranteed by the constructors after the object
-    /// is reconstructed by deserialization. Deserialization bypasses constructors, so the
-    /// collection state must be re-validated to avoid a partially-initialized object
-    /// (SonarQube rule S5766).
-    /// </summary>
-    protected void RevalidateBreakdownState()
-    {
-        SetupClauses ??= new List<string>();
-        FinishClauses ??= new ArrayList();
-    }
-
     /// <summary>
     /// Gets the SQL breakdown as a string. Must be implemented by derived classes.
     /// </summary>

src/Strata.SqlTools.SqlBreakdown/Classes/SqlBreakdownCollection.cs

@@ -1,4 +1,3 @@
-using System.Runtime.Serialization;
 using System.Text;
 using Strata.SqlTools.SqlBreakdown.Interfaces;
 using Strata.SqlTools.SqlBreakdown.Interfaces.QueryEngine;
@@ -13,7 +12,6 @@ namespace Strata.SqlTools.SqlBreakdown.Classes;
 /// allowing efficient management and retrieval of multiple SQL breakdowns as a unified collection.
 /// Implements ICollection<ISqlBreakdown> to provide standard collection semantics and LINQ support.
 /// </remarks>
-[Serializable]
 public class SqlBreakdownCollection : ICollection<ISqlBreakdown>
 {
     private readonly List<ISqlBreakdown> _breakdowns;
@@ -36,20 +34,6 @@ public class SqlBreakdownCollection : ICollection<ISqlBreakdown>
         _breakdowns = new List<ISqlBreakdown>(breakdowns ?? Enumerable.Empty<ISqlBreakdown>());
     }
 
-    /// <summary>
-    /// Validates that the backing list survived deserialization, since deserialization bypasses
-    /// the constructors that normally initialize it (SonarQube rule S5766).
-    /// </summary>
-    /// <param name="context">The streaming context for the deserialization operation.</param>
-    [OnDeserialized]
-    private void OnDeserialized(StreamingContext context)
-    {
-        if (_breakdowns is null)
-        {
-            throw new SerializationException("Deserialized SqlBreakdownCollection is missing its backing list.");
-        }
-    }
-
     /// <summary>
     /// Gets the collection of SQL breakdowns.
     /// </summary>

src/Strata.SqlTools.SqlBreakdown/Classes/SqlFilter.cs

@@ -1,4 +1,3 @@
-using System.Runtime.Serialization;
 using System.Text;
 using Strata.SqlTools.SqlBreakdown.Interfaces.Core;
 
@@ -8,7 +7,6 @@ namespace Strata.SqlTools.SqlBreakdown.Classes;
 /// Represents a SQL filter with an expression and parameters.
 /// Implements SQL appendable and SQL interfaces for query building.
 /// </summary>
-[Serializable]
 public class SqlFilter : ISqlAppendable
 {
     private readonly StringBuilder _sqlExpression;
@@ -59,21 +57,6 @@ public class SqlFilter : ISqlAppendable
         }
     }
 
-    /// <summary>
-    /// Validates that the expression and parameter state survived deserialization, since
-    /// deserialization bypasses the constructors that normally initialize them and enforce the
-    /// even parameter-name/value pairing (SonarQube rule S5766).
-    /// </summary>
-    /// <param name="context">The streaming context for the deserialization operation.</param>
-    [OnDeserialized]
-    private void OnDeserialized(StreamingContext context)
-    {
-        if (_sqlExpression is null || _parameterValues is null)
-        {
-            throw new SerializationException("Deserialized SqlFilter is missing its expression or parameter state.");
-        }
-    }
-
     /// <summary>
     /// Gets or sets the SQL expression.
     /// </summary>

src/Strata.SqlTools.SqlServer/Breakdowns/DeleteBreakdown.cs

@@ -8,7 +8,6 @@ namespace Strata.SqlTools.Breakdowns.SqlServer;
 /// <summary>
 /// Represents a DELETE SQL statement breakdown with FROM and WHERE clauses for SQL Server.
 /// </summary>
-[Serializable]
 public class DeleteBreakdown : SqlBreakdownBase
 {
     protected readonly StatementParser Parser;

src/Strata.SqlTools.SqlServer/Breakdowns/InsertBreakdown.cs

@@ -9,7 +9,6 @@ namespace Strata.SqlTools.Breakdowns.SqlServer;
 /// <summary>
 /// Represents an INSERT SQL statement breakdown with column and value clauses for SQL Server.
 /// </summary>
-[Serializable]
 public class InsertBreakdown : SqlBreakdownBase
 {
     protected readonly StatementParser Parser;

src/Strata.SqlTools.SqlServer/Breakdowns/ProcedureBreakdown.cs

@@ -1,5 +1,4 @@
 using System.Collections;
-using System.Runtime.Serialization;
 using System.Text;
 using System.Text.RegularExpressions;
 using Strata.SqlTools.SqlBreakdown.Classes;
@@ -10,7 +9,6 @@ namespace Strata.SqlTools.Breakdowns.SqlServer;
 /// <summary>
 /// Represents a SQL Server stored procedure call breakdown with procedure name and parameters.
 /// </summary>
-[Serializable]
 public class ProcedureBreakdown : SqlBreakdownBase
 {
     protected readonly StatementParser Parser;
@@ -46,20 +44,6 @@ public class ProcedureBreakdown : SqlBreakdownBase
         Parameters = parameters ?? new Dictionary<string, string>();
     }
 
-    /// <summary>
-    /// Re-establishes invariants after deserialization, since deserialization bypasses the
-    /// constructors that normally initialize the procedure name and parameter collection
-    /// (SonarQube rule S5766).
-    /// </summary>
-    /// <param name="context">The streaming context for the deserialization operation.</param>
-    [OnDeserialized]
-    private void OnDeserialized(StreamingContext context)
-    {
-        RevalidateBreakdownState();
-        ProcedureName ??= new SqlClause();
-        Parameters ??= new Dictionary<string, string>();
-    }
-
     /// <summary>
     /// Gets or sets the stored procedure name.
     /// </summary>

src/Strata.SqlTools.SqlServer/Breakdowns/QueryBreakdown.cs

@@ -1,5 +1,4 @@
 using System.Collections;
-using System.Runtime.Serialization;
 using System.Text;
 using Strata.SqlTools.SqlBreakdown.Classes;
 using Strata.SqlTools.SqlBreakdown.Expressions;
@@ -14,7 +13,6 @@ namespace Strata.SqlTools.Breakdowns.SqlServer;
 /// <summary>
 /// Represents a SELECT query breakdown with all clauses (SELECT, FROM, WHERE, GROUP BY, HAVING, ORDER BY).
 /// </summary>
-[Serializable]
 #pragma warning disable S2325 // Methods and properties that don't access instance data should be static - False positive: These members access instance fields
 public class QueryBreakdown : SqlBreakdownBase, IQueryBreakdown
 {
@@ -108,28 +106,6 @@ public class QueryBreakdown : SqlBreakdownBase, IQueryBreakdown
         }
     }
 
-    /// <summary>
-    /// Re-establishes invariants after deserialization, since deserialization bypasses the
-    /// constructors that normally initialize the parameter, WITH-clause, and clause backing
-    /// fields (SonarQube rule S5766).
-    /// </summary>
-    /// <param name="context">The streaming context for the deserialization operation.</param>
-    [OnDeserialized]
-    private void OnDeserialized(StreamingContext context)
-    {
-        RevalidateBreakdownState();
-
-        _parameterList ??= new List<IQueryParam>();
-        _withClauses ??= new List<IWithClause>();
-        _selectClause ??= new SqlExpressionClause(splitOnComma: true);
-        _fromClause ??= new SqlClause();
-        _whereClause ??= new SqlExpressionClause(splitOnComma: false);
-        _groupByClause ??= new SqlExpressionClause(splitOnComma: true);
-        _havingClause ??= new SqlExpressionClause(splitOnComma: false);
-        _orderByClause ??= new SqlExpressionClause(splitOnComma: true);
-        _clausesCacheDirty = true;
-    }
-
     #region Properties
 
     /// <summary>

src/Strata.SqlTools.SqlServer/Breakdowns/QueryBreakdownCollection.cs

@@ -1,4 +1,3 @@
-using System.Runtime.Serialization;
 using System.Text;
 using Strata.SqlTools.SqlBreakdown.Classes;
 using Strata.SqlTools.SqlBreakdown.Interfaces;
@@ -12,7 +11,6 @@ namespace Strata.SqlTools.Breakdowns.SqlServer;
 /// This class extends SqlBreakdownCollection with SQL Server-specific functionality,
 /// including support for T-SQL features like batches (GO), temporary tables, stored procedures, and CTEs.
 /// </remarks>
-[Serializable]
 public class QueryBreakdownCollection : SqlBreakdownCollection
 {
     private readonly List<QueryBreakdown> _queryBreakdowns;
@@ -34,20 +32,6 @@ public class QueryBreakdownCollection : SqlBreakdownCollection
         _queryBreakdowns = new List<QueryBreakdown>(queryBreakdowns ?? Enumerable.Empty<QueryBreakdown>());
     }
 
-    /// <summary>
-    /// Validates that the backing list survived deserialization, since deserialization bypasses
-    /// the constructors that normally initialize it (SonarQube rule S5766).
-    /// </summary>
-    /// <param name="context">The streaming context for the deserialization operation.</param>
-    [OnDeserialized]
-    private void OnDeserialized(StreamingContext context)
-    {
-        if (_queryBreakdowns is null)
-        {
-            throw new SerializationException("Deserialized QueryBreakdownCollection is missing its backing list.");
-        }
-    }
-
     /// <summary>
     /// Gets the collection of QueryBreakdown objects.
     /// </summary>

src/Strata.SqlTools.SqlServer/Breakdowns/UpdateBreakdown.cs

@@ -9,7 +9,6 @@ namespace Strata.SqlTools.Breakdowns.SqlServer;
 /// <summary>
 /// Represents an UPDATE SQL statement breakdown with SET, FROM, and WHERE clauses for SQL Server.
 /// </summary>
-[Serializable]
 public class UpdateBreakdown : SqlBreakdownBase
 {
     protected readonly StatementParser Parser;