Skip to content

Fix NuGet audit failures blocking CI restore #3870

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
RubenCerna2079 merged 1 commit into from
Oct 20, 2026
+15 −4
Merged

Fix NuGet audit failures blocking CI restore #3870

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions src/Aspire.AppHost/Aspire.AppHost.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,8 @@
<!-- Force the transitive MessagePack (via Aspire.Hosting/KubernetesClient) up to a
patched version to resolve NU1903 (GHSA-hv8m-jj95-wg3x). -->
<PackageReference Include="MessagePack" />
<!-- Aspire.Hosting.SqlServer brings its own Microsoft.Data.SqlClient; force its transitive Pkcs to the patched version. -->
<PackageReference Include="System.Security.Cryptography.Pkcs" />
</ItemGroup>

<ItemGroup>
Expand Down
2 changes: 2 additions & 0 deletions src/Config/Azure.DataApiBuilder.Config.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,8 @@
<PackageReference Include="System.IO.Abstractions" />
<PackageReference Include="System.Drawing.Common" />
<PackageReference Include="Microsoft.Data.SqlClient" />
<!-- Override the vulnerable Pkcs pulled in by Microsoft.Data.SqlClient (see Directory.Packages.props). -->
<PackageReference Include="System.Security.Cryptography.Pkcs" />
<PackageReference Include="Microsoft.IdentityModel.JsonWebTokens" />
<PackageReference Include="System.IdentityModel.Tokens.Jwt" />
<PackageReference Include="Humanizer" />
Expand Down
2 changes: 2 additions & 0 deletions src/Core/Azure.DataApiBuilder.Core.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,8 @@
<PackageReference Include="Microsoft.IdentityModel.Protocols.OpenIdConnect" />
<PackageReference Include="Microsoft.Azure.Cosmos" />
<PackageReference Include="Microsoft.Data.SqlClient" />
<!-- Repeated from Config so the packed Core library still depends on the patched Pkcs when project references are privatized. -->
<PackageReference Include="System.Security.Cryptography.Pkcs" />
<PackageReference Include="Microsoft.Extensions.Configuration.Binder" />
<PackageReference Include="Microsoft.Extensions.Configuration.Json" />
<PackageReference Include="Microsoft.OData.Core" />
Expand Down
13 changes: 9 additions & 4 deletions src/Directory.Packages.props
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,8 +33,9 @@
<PackageVersion Include="Microsoft.Azure.Cosmos" Version="3.38.1" />
<PackageVersion Include="Microsoft.Azure.StackExchangeRedis" Version="3.3.1" />
<!-- Pinned to override the vulnerable MessagePack 2.5.192 pulled in transitively
by Aspire.Hosting (KubernetesClient). 2.5.301 patches GHSA-hv8m-jj95-wg3x / CVE-2026-48109. -->
<PackageVersion Include="MessagePack" Version="2.5.301" />
by Aspire.Hosting (KubernetesClient). 2.5.307 patches GHSA-hv8m-jj95-wg3x / CVE-2026-48109
and GHSA-qhrr-8q5h-9q3h / CVE-2026-92707. -->
<PackageVersion Include="MessagePack" Version="2.5.307" />
<PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="10.0.0" />
<PackageVersion Include="Microsoft.Extensions.Caching.Abstractions" Version="10.0.0" />
<PackageVersion Include="Microsoft.Extensions.Primitives" Version="10.0.0" />
Expand All @@ -58,8 +59,9 @@
<PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.9.0" />
<PackageVersion Include="Microsoft.OData.Edm" Version="7.20.0" />
<PackageVersion Include="Microsoft.OData.Core" Version="7.20.0" />
<PackageVersion Include="Microsoft.OpenApi" Version="1.6.14" />
<PackageVersion Include="Microsoft.OpenApi.Readers" Version="1.6.14" />
<!-- Readers < 1.6.30 is vulnerable (GHSA-7pxr-59rr-hqj2); keep both packages on the same version. -->
<PackageVersion Include="Microsoft.OpenApi" Version="1.6.31" />
<PackageVersion Include="Microsoft.OpenApi.Readers" Version="1.6.31" />
<PackageVersion Include="Moq" Version="4.18.2" />
<PackageVersion Include="MSTest.TestAdapter" Version="3.3.1" />
<PackageVersion Include="MSTest.TestFramework" Version="3.3.1" />
Expand All @@ -80,6 +82,9 @@
<PackageVersion Include="System.IdentityModel.Tokens.Jwt" Version="8.1.2" />
<PackageVersion Include="System.IO.Abstractions" Version="21.0.2" />
<PackageVersion Include="System.IO.Abstractions.TestingHelpers" Version="21.0.2" />
<!-- Pinned to override the vulnerable Pkcs 9.0.11/9.0.4 pulled in transitively by Microsoft.Data.SqlClient
(including Aspire.Hosting.SqlServer). 9.0.21 patches GHSA-2fmv-rv2c-59x7 and GHSA-846f-f764-76mx. -->
<PackageVersion Include="System.Security.Cryptography.Pkcs" Version="9.0.21" />
<PackageVersion Include="Verify.MsTest" Version="23.6.0" />
<PackageVersion Include="Verify.DiffPlex" Version="2.3.0" />
<PackageVersion Include="ZiggyCreatures.FusionCache" Version="2.1.0" />
Expand Down
Loading