Repository navigation
4.0 dependency upgrades and vulnerability fixes - #381
Merged
Merged
Conversation
Shipped packages keep 8.0.x Microsoft floors: Logging.Abstractions 8.0.3, Bcl.HashCode 6.0.0, Registry 5.0.0, CodeDom 8.0.0, NHibernate 5.7.1, Quartz 3.22.9, Mvc/WebApi.WebHost 5.3.0. Spring.Core no longer references ConfigurationManager, CodeDom and Registry on .NET Framework; Spring.Messaging uses the framework System.Messaging there. Spring.Aop drops Antlr3.Runtime. Test, example and build packages go to latest; the build project pins System.Security.Cryptography.Pkcs/Xml 10.0.14. Quartz 3.22 obsoletes DirtyFlagMap.Put/PutAll, so the Quartz3 integration uses the indexer. The NUnitAspEx web.config binding redirects follow the new System.Memory, System.Buffers and Unsafe assembly versions. BreakingChanges.txt items 5-7. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Marko Lahma <marko.lahma@gmail.com>
Microsoft.Extensions.Logging and Log4Net.AspNetCore are used only by examples. They stay on the 8.0 line that matches Spring.Core's Logging.Abstractions floor, because the net472 web examples have no binding redirects for a 10.x closure. Spring.Mvc5QuickStart's OData v3 package caps WebApi.Core below 5.3.0. That example project now suppresses NU1608 and says why. BreakingChanges items 5 and 6 now list the assembly versions that moved and the redirects .NET Framework applications need. They no longer describe the Messaging package drop as a type change. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Marko Lahma <marko.lahma@gmail.com>
The examples reference the built Spring assemblies by HintPath, so NuGet doesn't see that Spring.Core needs Logging.Abstractions 8.0.3. Microsoft.Extensions.Logging 8.0.1 alone resolves 8.0.2, and CompileExamples failed with CS1705. With transitive pinning, the examples get the same versions as the libraries. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LGkLQuAuUjvRjrU1AcTsmk Signed-off-by: Marko Lahma <marko.lahma@gmail.com>
OData 5.7.0 caps WebApi.Core below 5.3.0, and WebApi 5.3.0 needs 5.3.0, so restore failed with NU1107. A direct reference makes 5.3.0 win and leaves only the NU1608 warning the project already suppresses. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LGkLQuAuUjvRjrU1AcTsmk Signed-off-by: Marko Lahma <marko.lahma@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR clears every vulnerable package in the dependency graph and brings dependencies up to date for 4.0. Packages that consumers inherit stay on the agreed 8.0.x Microsoft floor: NuGet lifts them when an application references something newer, while higher floors would trigger downgrade errors in apps pinned to 8.x.
Vulnerabilities fixed
System.Drawing.Common4.7.0 (critical, GHSA-rxg9-xrhp-64gj): no longer reachable, since Start 4.0: .NET Framework 4.7.2 floor, .NET 10 tests, preview version and agent definitions #376'sConfigurationManager8.0.1 bump and .NET Framework now uses the framework's ownSystem.Configuration.Newtonsoft.Json6.0.4 (high): pulled in through Mvc and WebApi 5.2.7, gone with Mvc and WebApi 5.3.0.System.Security.Cryptography.Pkcsand.Xml10.0.10 (five highs): pulled into the build project by Fallout 10.4.0, which is still the latest release; both are pinned to 10.0.14.dotnet list package --vulnerable --include-transitiveis now clean for every project in the solution and for the build project.Packages consumers inherit
Microsoft.Extensions.Logging.AbstractionsMicrosoft.Bcl.HashCodeMicrosoft.Win32.RegistrySystem.CodeDomSystem.Configuration.ConfigurationManagerNHibernateQuartzMicrosoft.AspNet.Mvc/Microsoft.AspNet.WebApi.WebHostAntlr3.RuntimeExperimental.System.Messaging.SignedSystem.MessagingTFM conditions use
TargetFrameworkIdentifier, so they stay correct when thenet10.0library target arrives.Quartz 3.22 marks
DirtyFlagMap.PutandPutAllobsolete. Five Quartz3 files now use the indexer instead; the review compared it with the Quartz v3.22.9 source and found identical behaviour.Test, example and build packages
Spring.Mvc5QuickStartsuppresses NU1608, with a comment: its OData v3 package caps WebApi.Core below 5.3.0.Notes
BreakingChanges.txtitems 5–7 list the floors and the moved assembly versions, with the binding redirects .NET Framework applications need.Verification
Packsucceeds, and the nuspec dependency groups were checked.Supersedes #379.
🤖 Generated with Claude Code
https://claude.ai/code/session_01LGkLQuAuUjvRjrU1AcTsmk