Repository navigation
Fix NuGet audit failures blocking CI restore - #3870
Merged
RubenCerna2079 merged 1 commit intoOct 20, 2026
Merged
Conversation
New advisories make the implicit restore in the Unit Tests pipeline's "Check formatting" step fail (NuGet audit warnings are errors): - System.Security.Cryptography.Pkcs 9.0.11 (via Microsoft.Data.SqlClient 6.1.5) and 9.0.4 (via Aspire.Hosting.SqlServer -> Microsoft.Data.SqlClient 6.1.1): GHSA-2fmv-rv2c-59x7, GHSA-846f-f764-76mx. Pin 9.0.21. - MessagePack 2.5.301 (Aspire.AppHost): GHSA-qhrr-8q5h-9q3h. Bump to 2.5.307. - Microsoft.OpenApi.Readers 1.6.14 (Service.Tests): GHSA-7pxr-59rr-hqj2. Bump Microsoft.OpenApi and Microsoft.OpenApi.Readers to 1.6.31 together. Pkcs is only a transitive dependency and central package management does not pin transitive versions without a reference, so reference it from Config and Core (where SqlClient enters the product graph; Core also so the packed library declares it) and from Aspire.AppHost, whose restore graph does not include its project references. No audit warnings are suppressed.
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
Package availability and an audit-clean restore still require CI confirmation.
No open issues 🎉
What changed in this PR
Updates dependency pins and references to address NuGet security audit failures blocking CI restore, without suppressing audit warnings.
Changes:
- Updates MessagePack and both OpenAPI packages to the specified patched versions.
- Pins Pkcs centrally and adds direct references for product, packaging, and Aspire restore coverage.
| File | Description |
|---|---|
| src/Directory.Packages.props | Updates security-related package pins and explanatory comments. |
| src/Core/Azure.DataApiBuilder.Core.csproj | Adds Pkcs as an explicit packed-library dependency. |
| src/Config/Azure.DataApiBuilder.Config.csproj | Adds Pkcs to override the SqlClient transitive dependency. |
| src/Aspire.AppHost/Aspire.AppHost.csproj | Adds Pkcs for Aspire’s separate restore graph. |
Review effort: Balanced
Mohit G (gmohit21)
approved these changes
Oct 20, 2026
RubenCerna2079
approved these changes
Oct 20, 2026
RubenCerna2079
deleted the
dev/aaronburtle/fix-nuget-audit-vulnerabilities
branch
October 20, 2026 18:32
github-project-automation
Bot
moved this from Review In Progress
to Done
in Data API builder
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why make this change?
main.What is this change?
Directory.Packages.props: pinSystem.Security.Cryptography.Pkcs9.0.21, bumpMessagePack2.5.301 -> 2.5.307, and bumpMicrosoft.OpenApiandMicrosoft.OpenApi.Readers1.6.14 -> 1.6.31 together.ConfigandCore, whereMicrosoft.Data.SqlCliententers the graph (Corealso so the packed library declares it), and fromAspire.AppHost, whose restore graph does not include its project references.How was this tested?
Locally with the CI SDK (10.0.402) and real NuGet vulnerability data: replaying CI's restore and
dotnet format --verify-no-changesreproduces the 22 errors onmainand passes on this branch (0 audit errors, 0 of 791 files changed). Full solution Release and Debug builds, including Aspire.AppHost, have 0 warnings; the Release pack succeeds; the CI unit test filter passes (Service.Tests 3254/3254, Cli.Tests 629 passed, 3 ignored in source).Sample Request(s)