From 8c09666b5f4fd662496050a2d7b7d4d22ac914b3 Mon Sep 17 00:00:00 2001 From: Marko Lahma Date: Tue, 3 Nov 2026 14:22:19 +0200 Subject: [PATCH 1/4] Packet C: 4.0 dependency upgrades and vulnerability fixes Shipped packages keep 8.0.x Microsoft floors: Logging.Abstractions 8.0.3, Bcl.HashCode 6.0.0, Registry 5.0.0, CodeDom 8.0.0, NHibernate 5.7.1, Quartz 3.22.9, Mvc/WebApi.WebHost 5.3.0. Spring.Core no longer references ConfigurationManager, CodeDom and Registry on .NET Framework; Spring.Messaging uses the framework System.Messaging there. Spring.Aop drops Antlr3.Runtime. Test, example and build packages go to latest; the build project pins System.Security.Cryptography.Pkcs/Xml 10.0.14. Quartz 3.22 obsoletes DirtyFlagMap.Put/PutAll, so the Quartz3 integration uses the indexer. The NUnitAspEx web.config binding redirects follow the new System.Memory, System.Buffers and Unsafe assembly versions. BreakingChanges.txt items 5-7. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Marko Lahma --- BreakingChanges.txt | 17 +++++++++ Directory.Packages.props | 37 ++++++++++--------- build-support/build/_build.csproj | 2 + .../Spring.Mvc5QuickStart.csproj | 4 +- .../Spring.Mvc5QuickStart/Web.config | 10 ++--- src/Spring/Spring.Aop/Spring.Aop.csproj | 4 -- src/Spring/Spring.Core/Spring.Core.csproj | 11 ++++-- .../Spring.Messaging/Spring.Messaging.csproj | 4 +- .../Scheduling/Quartz/CronTriggerObject.cs | 2 +- .../Scheduling/Quartz/JobDetailObject.cs | 4 +- .../MethodInvokingJobDetailFactoryObject.cs | 2 +- .../Quartz/SchedulerFactoryObject.cs | 9 +++-- .../Scheduling/Quartz/SimpleTriggerObject.cs | 2 +- .../WebApplicationContextTests/Web.Config | 8 +++- .../Spring/Objects/Factory/Support/web.config | 8 +++- .../LocalResourceManagerTests/Web.Config | 8 +++- .../PageHandlerFactoryTests/web.config | 8 +++- 17 files changed, 88 insertions(+), 52 deletions(-) diff --git a/BreakingChanges.txt b/BreakingChanges.txt index 5f9eced68..dd87296a6 100644 --- a/BreakingChanges.txt +++ b/BreakingChanges.txt @@ -31,6 +31,23 @@ Changes (3.1 to 4.0) 4.0." The matching examples (Calculator, EmsQuickStart, WcfQuickStart and Web.Extensions.Example) were removed too. +5. Dependency floors were raised: Microsoft.Extensions.Logging.Abstractions 8.0.3, + Microsoft.Bcl.HashCode 6.0.0, Microsoft.Win32.Registry 5.0.0, System.CodeDom 8.0.0, + NHibernate 5.7.1, Quartz 3.22.9, and Microsoft.AspNet.Mvc and Microsoft.AspNet.WebApi.WebHost + 5.3.0. On .NET Framework, applications that use Spring.Web.Mvc5 need the standard binding + redirects for System.Web.Mvc, System.Web.Http, System.Web.Http.WebHost and + System.Net.Http.Formatting to the 5.3 assemblies (Visual Studio generates these for projects + with AutoGenerateBindingRedirects, and the Mvc/WebApi NuGet packages add them to web.config). + +6. On .NET Framework, Spring.Core no longer depends on the System.Configuration.ConfigurationManager, + System.CodeDom and Microsoft.Win32.Registry packages (nor on Microsoft.CSharp and + System.Reflection.Emit, which were already netstandard2.0-only). The framework provides those + APIs. Spring.Messaging likewise uses the framework's System.Messaging on .NET Framework + instead of Experimental.System.Messaging.Signed. The packages are still referenced for the + netstandard2.0 target. + +7. Spring.Aop no longer depends on Antlr3.Runtime. + Changes (3.0.x to 3.1) ======================== diff --git a/Directory.Packages.props b/Directory.Packages.props index 722c9497c..dbc6450da 100644 --- a/Directory.Packages.props +++ b/Directory.Packages.props @@ -3,39 +3,40 @@ true - - - + + - + - - - + + + - - - + + + - - + + - - + + - + - - - + + + + + \ No newline at end of file diff --git a/build-support/build/_build.csproj b/build-support/build/_build.csproj index 5ce96c526..2a5f6c9d9 100644 --- a/build-support/build/_build.csproj +++ b/build-support/build/_build.csproj @@ -11,6 +11,8 @@ + + diff --git a/examples/Spring/Spring.Mvc5QuickStart/Spring.Mvc5QuickStart/Spring.Mvc5QuickStart.csproj b/examples/Spring/Spring.Mvc5QuickStart/Spring.Mvc5QuickStart/Spring.Mvc5QuickStart.csproj index b928615c5..24c956ebe 100644 --- a/examples/Spring/Spring.Mvc5QuickStart/Spring.Mvc5QuickStart/Spring.Mvc5QuickStart.csproj +++ b/examples/Spring/Spring.Mvc5QuickStart/Spring.Mvc5QuickStart/Spring.Mvc5QuickStart.csproj @@ -48,8 +48,8 @@ - - + + diff --git a/examples/Spring/Spring.Mvc5QuickStart/Spring.Mvc5QuickStart/Web.config b/examples/Spring/Spring.Mvc5QuickStart/Spring.Mvc5QuickStart/Web.config index 4b9ee969b..7a66d92df 100644 --- a/examples/Spring/Spring.Mvc5QuickStart/Spring.Mvc5QuickStart/Web.config +++ b/examples/Spring/Spring.Mvc5QuickStart/Spring.Mvc5QuickStart/Web.config @@ -86,19 +86,19 @@ - + - + - + - + @@ -106,7 +106,7 @@ - + diff --git a/src/Spring/Spring.Aop/Spring.Aop.csproj b/src/Spring/Spring.Aop/Spring.Aop.csproj index 4518c9452..9e4e96b16 100644 --- a/src/Spring/Spring.Aop/Spring.Aop.csproj +++ b/src/Spring/Spring.Aop/Spring.Aop.csproj @@ -5,10 +5,6 @@ Interfaces and classes that provide AOP support in Spring.Net - - - - diff --git a/src/Spring/Spring.Core/Spring.Core.csproj b/src/Spring/Spring.Core/Spring.Core.csproj index b5da943c1..bdb8e950b 100644 --- a/src/Spring/Spring.Core/Spring.Core.csproj +++ b/src/Spring/Spring.Core/Spring.Core.csproj @@ -6,7 +6,7 @@ 219, 162, 618, 1591 - + @@ -22,17 +22,20 @@ + - - - + + + + + diff --git a/src/Spring/Spring.Messaging/Spring.Messaging.csproj b/src/Spring/Spring.Messaging/Spring.Messaging.csproj index 13a92b734..fa7ef3aa6 100644 --- a/src/Spring/Spring.Messaging/Spring.Messaging.csproj +++ b/src/Spring/Spring.Messaging/Spring.Messaging.csproj @@ -3,14 +3,14 @@ netstandard2.0;$(TargetFullFrameworkVersion) Interfaces and classes that provide MSMQ 3.0 support in Spring.Net - + - + diff --git a/src/Spring/Spring.Scheduling.Quartz3/Scheduling/Quartz/CronTriggerObject.cs b/src/Spring/Spring.Scheduling.Quartz3/Scheduling/Quartz/CronTriggerObject.cs index 53b78079b..d78201c31 100644 --- a/src/Spring/Spring.Scheduling.Quartz3/Scheduling/Quartz/CronTriggerObject.cs +++ b/src/Spring/Spring.Scheduling.Quartz3/Scheduling/Quartz/CronTriggerObject.cs @@ -73,7 +73,7 @@ public virtual IDictionary JobDataAsMap { foreach (DictionaryEntry entry in value) { - JobDataMap.Put((string) entry.Key, entry.Value); + JobDataMap[(string) entry.Key] = entry.Value; } } } diff --git a/src/Spring/Spring.Scheduling.Quartz3/Scheduling/Quartz/JobDetailObject.cs b/src/Spring/Spring.Scheduling.Quartz3/Scheduling/Quartz/JobDetailObject.cs index 98dcd0851..1d97a7398 100644 --- a/src/Spring/Spring.Scheduling.Quartz3/Scheduling/Quartz/JobDetailObject.cs +++ b/src/Spring/Spring.Scheduling.Quartz3/Scheduling/Quartz/JobDetailObject.cs @@ -88,7 +88,7 @@ public virtual IDictionary JobDataAsMap foreach (DictionaryEntry entry in value) { - JobDataMap.Put((string) entry.Key, entry.Value); + JobDataMap[(string) entry.Key] = entry.Value; } } } @@ -216,7 +216,7 @@ public virtual void AfterPropertiesSet() "to be able to handle an 'applicationContextJobDataKey'"); } - JobDataMap.Put(applicationContextJobDataKey, applicationContext); + JobDataMap[applicationContextJobDataKey] = applicationContext; } } } diff --git a/src/Spring/Spring.Scheduling.Quartz3/Scheduling/Quartz/MethodInvokingJobDetailFactoryObject.cs b/src/Spring/Spring.Scheduling.Quartz3/Scheduling/Quartz/MethodInvokingJobDetailFactoryObject.cs index 04be82914..21bd57804 100644 --- a/src/Spring/Spring.Scheduling.Quartz3/Scheduling/Quartz/MethodInvokingJobDetailFactoryObject.cs +++ b/src/Spring/Spring.Scheduling.Quartz3/Scheduling/Quartz/MethodInvokingJobDetailFactoryObject.cs @@ -256,7 +256,7 @@ public virtual void AfterPropertiesSet() // Build JobDetail instance. jobDetail = new JobDetailImpl(jobDetailName, group, jobType); - jobDetail.JobDataMap.Put("methodInvoker", this); + jobDetail.JobDataMap["methodInvoker"] = this; jobDetail.Durable = true; // job listeners through configuration are no longer supported diff --git a/src/Spring/Spring.Scheduling.Quartz3/Scheduling/Quartz/SchedulerFactoryObject.cs b/src/Spring/Spring.Scheduling.Quartz3/Scheduling/Quartz/SchedulerFactoryObject.cs index 5439e877b..13d8c2a3e 100644 --- a/src/Spring/Spring.Scheduling.Quartz3/Scheduling/Quartz/SchedulerFactoryObject.cs +++ b/src/Spring/Spring.Scheduling.Quartz3/Scheduling/Quartz/SchedulerFactoryObject.cs @@ -730,9 +730,10 @@ private void PopulateSchedulerContext() // Put specified objects into Scheduler context. if (schedulerContextMap != null) { - var dictionary = schedulerContextMap.Cast() - .ToDictionary(entry => entry.Key.ToString(), entry => entry.Value); - scheduler.Context.PutAll(dictionary); + foreach (DictionaryEntry entry in schedulerContextMap) + { + scheduler.Context[entry.Key.ToString()] = entry.Value; + } } // Register IApplicationContext in Scheduler context. @@ -744,7 +745,7 @@ private void PopulateSchedulerContext() "to be able to handle an 'applicationContextSchedulerContextKey'"); } - scheduler.Context.Put(applicationContextSchedulerContextKey, applicationContext); + scheduler.Context[applicationContextSchedulerContextKey] = applicationContext; } } diff --git a/src/Spring/Spring.Scheduling.Quartz3/Scheduling/Quartz/SimpleTriggerObject.cs b/src/Spring/Spring.Scheduling.Quartz3/Scheduling/Quartz/SimpleTriggerObject.cs index 9e8795dab..017631927 100644 --- a/src/Spring/Spring.Scheduling.Quartz3/Scheduling/Quartz/SimpleTriggerObject.cs +++ b/src/Spring/Spring.Scheduling.Quartz3/Scheduling/Quartz/SimpleTriggerObject.cs @@ -80,7 +80,7 @@ public virtual IDictionary JobDataAsMap { foreach (DictionaryEntry entry in value) { - JobDataMap.Put((string) entry.Key, entry.Value); + JobDataMap[(string) entry.Key] = entry.Value; } } } diff --git a/test/Spring/Spring.Web.Tests/Data/Spring/Context/Support/WebApplicationContextTests/Web.Config b/test/Spring/Spring.Web.Tests/Data/Spring/Context/Support/WebApplicationContextTests/Web.Config index 6539ba3df..2e95c4faa 100644 --- a/test/Spring/Spring.Web.Tests/Data/Spring/Context/Support/WebApplicationContextTests/Web.Config +++ b/test/Spring/Spring.Web.Tests/Data/Spring/Context/Support/WebApplicationContextTests/Web.Config @@ -48,11 +48,15 @@ - + + + + + - + diff --git a/test/Spring/Spring.Web.Tests/Data/Spring/Objects/Factory/Support/web.config b/test/Spring/Spring.Web.Tests/Data/Spring/Objects/Factory/Support/web.config index 5f2a3e44f..becc0293e 100644 --- a/test/Spring/Spring.Web.Tests/Data/Spring/Objects/Factory/Support/web.config +++ b/test/Spring/Spring.Web.Tests/Data/Spring/Objects/Factory/Support/web.config @@ -10,11 +10,15 @@ - + + + + + - + diff --git a/test/Spring/Spring.Web.Tests/Data/Spring/Web/Support/LocalResourceManagerTests/Web.Config b/test/Spring/Spring.Web.Tests/Data/Spring/Web/Support/LocalResourceManagerTests/Web.Config index 6a984cf74..87ef6826f 100644 --- a/test/Spring/Spring.Web.Tests/Data/Spring/Web/Support/LocalResourceManagerTests/Web.Config +++ b/test/Spring/Spring.Web.Tests/Data/Spring/Web/Support/LocalResourceManagerTests/Web.Config @@ -50,11 +50,15 @@ - + + + + + - + diff --git a/test/Spring/Spring.Web.Tests/Data/Spring/Web/Support/PageHandlerFactoryTests/web.config b/test/Spring/Spring.Web.Tests/Data/Spring/Web/Support/PageHandlerFactoryTests/web.config index 5f2a3e44f..becc0293e 100644 --- a/test/Spring/Spring.Web.Tests/Data/Spring/Web/Support/PageHandlerFactoryTests/web.config +++ b/test/Spring/Spring.Web.Tests/Data/Spring/Web/Support/PageHandlerFactoryTests/web.config @@ -10,11 +10,15 @@ - + + + + + - + From 06d38b4f31eac7335e826fba4ac3c8267fde9655 Mon Sep 17 00:00:00 2001 From: Marko Lahma Date: Tue, 3 Nov 2026 14:33:20 +0200 Subject: [PATCH 2/4] Keep example logging on 8.0, allow OData's NU1608, document redirects Microsoft.Extensions.Logging and Log4Net.AspNetCore are used only by examples. They stay on the 8.0 line that matches Spring.Core's Logging.Abstractions floor, because the net472 web examples have no binding redirects for a 10.x closure. Spring.Mvc5QuickStart's OData v3 package caps WebApi.Core below 5.3.0. That example project now suppresses NU1608 and says why. BreakingChanges items 5 and 6 now list the assembly versions that moved and the redirects .NET Framework applications need. They no longer describe the Messaging package drop as a type change. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Marko Lahma --- BreakingChanges.txt | 32 +++++++++++++------ Directory.Packages.props | 6 ++-- .../Spring.Mvc5QuickStart.csproj | 3 ++ 3 files changed, 30 insertions(+), 11 deletions(-) diff --git a/BreakingChanges.txt b/BreakingChanges.txt index dd87296a6..35ab4666d 100644 --- a/BreakingChanges.txt +++ b/BreakingChanges.txt @@ -34,17 +34,31 @@ Changes (3.1 to 4.0) 5. Dependency floors were raised: Microsoft.Extensions.Logging.Abstractions 8.0.3, Microsoft.Bcl.HashCode 6.0.0, Microsoft.Win32.Registry 5.0.0, System.CodeDom 8.0.0, NHibernate 5.7.1, Quartz 3.22.9, and Microsoft.AspNet.Mvc and Microsoft.AspNet.WebApi.WebHost - 5.3.0. On .NET Framework, applications that use Spring.Web.Mvc5 need the standard binding - redirects for System.Web.Mvc, System.Web.Http, System.Web.Http.WebHost and - System.Net.Http.Formatting to the 5.3 assemblies (Visual Studio generates these for projects - with AutoGenerateBindingRedirects, and the Mvc/WebApi NuGet packages add them to web.config). + 5.3.0 (Mvc/WebApi 5.3.0 brings Newtonsoft.Json 13 in place of the vulnerable 6.0.4). + Several assembly versions moved with these floors: + + | Assembly | 3.1 | 4.0 | + |-------------------------------------------|----------|----------| + | Microsoft.Bcl.HashCode | 1.0.0.0 | 6.0.0.0 | + | Microsoft.Extensions.Logging.Abstractions | 8.0.0.0 | 8.0.0.3 | + | Quartz | 3.12.0.0 | 3.22.9.0 | + | NHibernate | 5.6.0.0 | 5.7.0.0 | + | System.Web.Mvc, System.Web.Http(.WebHost) | 5.2.7.0 | 5.3.0.0 | + | System.Net.Http.Formatting | 5.2.7.0 | 6.0.0.0 | + | Newtonsoft.Json (via WebApi) | 6.0.0.0 | 13.0.0.0 | + + On .NET Framework, an application or library compiled against an older version needs + binding redirects to these. SDK-style projects with AutoGenerateBindingRedirects get them + generated. Classic web.config applications must add them, and the Mvc/WebApi NuGet packages + add their own. Microsoft.AspNet.WebApi.OData 5.x (OData v3) caps WebApi.Core below 5.3.0, so + restoring it next to Spring.Web.Mvc5 reports NU1608. It still runs on 5.3 through the + System.Web.Http redirect. 6. On .NET Framework, Spring.Core no longer depends on the System.Configuration.ConfigurationManager, - System.CodeDom and Microsoft.Win32.Registry packages (nor on Microsoft.CSharp and - System.Reflection.Emit, which were already netstandard2.0-only). The framework provides those - APIs. Spring.Messaging likewise uses the framework's System.Messaging on .NET Framework - instead of Experimental.System.Messaging.Signed. The packages are still referenced for the - netstandard2.0 target. + System.CodeDom and Microsoft.Win32.Registry packages, because the framework provides those + APIs. Spring.Messaging's .NET Framework build drops the unused Experimental.System.Messaging.Signed + package; it always compiled against the framework's System.Messaging. The packages are still + referenced for the netstandard2.0 target. 7. Spring.Aop no longer depends on Antlr3.Runtime. diff --git a/Directory.Packages.props b/Directory.Packages.props index dbc6450da..17ef47e9e 100644 --- a/Directory.Packages.props +++ b/Directory.Packages.props @@ -17,9 +17,11 @@ - + + - + diff --git a/examples/Spring/Spring.Mvc5QuickStart/Spring.Mvc5QuickStart/Spring.Mvc5QuickStart.csproj b/examples/Spring/Spring.Mvc5QuickStart/Spring.Mvc5QuickStart/Spring.Mvc5QuickStart.csproj index 24c956ebe..d65840aa5 100644 --- a/examples/Spring/Spring.Mvc5QuickStart/Spring.Mvc5QuickStart/Spring.Mvc5QuickStart.csproj +++ b/examples/Spring/Spring.Mvc5QuickStart/Spring.Mvc5QuickStart/Spring.Mvc5QuickStart.csproj @@ -2,6 +2,9 @@ + + $(NoWarn);NU1608 Debug AnyCPU From 854cfd00d2bdac91658e87112b8fbabe16c119be Mon Sep 17 00:00:00 2001 From: Marko Lahma Date: Tue, 3 Nov 2026 16:04:38 +0200 Subject: [PATCH 3/4] Pin the examples' transitive packages to the central versions The examples reference the built Spring assemblies by HintPath, so NuGet doesn't see that Spring.Core needs Logging.Abstractions 8.0.3. Microsoft.Extensions.Logging 8.0.1 alone resolves 8.0.2, and CompileExamples failed with CS1705. With transitive pinning, the examples get the same versions as the libraries. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01LGkLQuAuUjvRjrU1AcTsmk Signed-off-by: Marko Lahma --- examples/Directory.Build.props | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/examples/Directory.Build.props b/examples/Directory.Build.props index d64db1d4d..cb79ecb3c 100644 --- a/examples/Directory.Build.props +++ b/examples/Directory.Build.props @@ -2,6 +2,12 @@ + + true + $(MSBuildProjectName.Replace('.2010', '')) $(CleanedProjectName) From 1350c3149d5727d4c214f921b4020a34b188a3f8 Mon Sep 17 00:00:00 2001 From: Marko Lahma Date: Tue, 3 Nov 2026 16:57:55 +0200 Subject: [PATCH 4/4] Reference WebApi.Core 5.3.0 directly in the Mvc5 example OData 5.7.0 caps WebApi.Core below 5.3.0, and WebApi 5.3.0 needs 5.3.0, so restore failed with NU1107. A direct reference makes 5.3.0 win and leaves only the NU1608 warning the project already suppresses. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01LGkLQuAuUjvRjrU1AcTsmk Signed-off-by: Marko Lahma --- .../Spring.Mvc5QuickStart/Spring.Mvc5QuickStart.csproj | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/examples/Spring/Spring.Mvc5QuickStart/Spring.Mvc5QuickStart/Spring.Mvc5QuickStart.csproj b/examples/Spring/Spring.Mvc5QuickStart/Spring.Mvc5QuickStart/Spring.Mvc5QuickStart.csproj index d65840aa5..fa5afa371 100644 --- a/examples/Spring/Spring.Mvc5QuickStart/Spring.Mvc5QuickStart/Spring.Mvc5QuickStart.csproj +++ b/examples/Spring/Spring.Mvc5QuickStart/Spring.Mvc5QuickStart/Spring.Mvc5QuickStart.csproj @@ -2,8 +2,9 @@ - + $(NoWarn);NU1608 Debug AnyCPU @@ -53,6 +54,8 @@ + +