chore(deps): bump .NET, EF Core and library patch versions to fix ASP.NET Core CVEs

Ouverte
  • Quelque chose ne va pas ?
#587 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Personne n'a encore pris cette issue.

Évaluation

Difficulté
3/5
Temps estimé
1-2 jours
Accessibilité débutants
45/100
Type d'issue
Bug
Clarté
Clairement spécifiée
Activité
Active
Stack technique
csharp
Domaine
build-system, security

Piste de recherche

Start with the root Directory.Packages.props and check for hard-coded versions in src and tests as directed in the issue. Verify the listed package versions on NuGet, then restore, build, and test Datasync.Toolkit.sln; Docker and an optional Cosmos connection string affect live test coverage. Done means the package pins and comments match the acceptance criteria, vulnerability checks are clear, and build-library.yml succeeds on the fork.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

Client dependencies Server

Part 1 of the outdated-package sweep (found with dotnet-outdated 4.8.1 on 2026-11-05). This is the security-relevant patch bump for the main library solution (Datasync.Toolkit.sln). Related: #584 (Dependabot alert 9, samples only).

Scope (this PR only)

Patch-level bumps only, in the root Directory.Packages.props. No source changes are expected.

Property / package Current Target Notes
<DotNetVersion> 10.0.9 10.0.14 Drives Microsoft.AspNetCore.Mvc.Testing, Microsoft.AspNetCore.OpenApi, Microsoft.Extensions.* (Caching.Memory, DependencyInjection.Abstractions, Http, Logging.Abstractions), System.Formats.Asn1, System.Text.Json, System.Threading.Tasks.Dataflow. 10.0.9 is in the range affected by ASP.NET Core RCE advisories GHSA-qjpx-jqm5-h2c4 (fixed 10.0.13) and GHSA-g27p-qf6j-c96c (fixed 10.0.14).
<EFCoreVersion> 10.0.9 10.0.14 Drives all Microsoft.EntityFrameworkCore.* packages.
Npgsql.EntityFrameworkCore.PostgreSQL 10.0.2 10.0.3
Microsoft.SourceLink.GitHub 10.0.300 10.0.403
SQLitePCLRaw.bundle_e_sqlite3 3.0.3 3.0.5 Deliberate NU1903 pin (GHSA-2m69-gcr7-jv3q). Keep the explanatory XML comment. Must stay on the 3.x line.
System.Linq.Async 7.0.0 7.0.1 Only used by CommunityToolkit.Datasync.Client.Test.
<ODataVersion> and Microsoft.Spatial 8.4.3 8.4.4 Microsoft.Spatial is pinned separately from <ODataVersion> (line ~43): update both. 8.4.4 exists on NuGet for Core, Edm and Spatial. Microsoft.AspNetCore.OData 9.4.1 depends on [8.4.0, 9.0.0) so this is compatible. Do not go to 9.0.0 (see the separate OData 9 issue).

Verify each target version exists with curl -s https://api.nuget.org/v3-flatcontainer/<lowercase-id>/index.json before editing; if a newer patch of the same line has shipped, use it.

Out of scope: samples, minor/major bumps, test tooling.

Steps

  1. Edit Directory.Packages.props as above. Do not touch any .csproj unless a version is hard-coded there (check with grep -rn 'Version="' src tests --include=*.csproj).
  2. dotnet restore && dotnet build && dotnet test from the repo root. Docker is needed for the Testcontainers-based suites (MongoDB, SQL Server, PostgreSQL); Cosmos tests need COSMOS_CONNECTION_STRING and are skipped otherwise (see README "Running Live Tests").
  3. Confirm no vulnerability warnings: dotnet restore must emit no NU1901-NU1904, and dotnet list Datasync.Toolkit.sln package --vulnerable --include-transitive should be empty.
  4. Re-run dotnet-outdated Datasync.Toolkit.sln (dotnet tool install -g dotnet-outdated-tool); the packages above should no longer be reported.
  5. Dispatch build-library.yml on the fork with --ref <branch> and wait for success.

Acceptance criteria

  • All packages in the table are at target versions; comments in the props file preserved.
  • Local build and tests pass; no NU190x warnings.
  • build-library.yml passes on the fork.
  • PR is a single commit-scoped change: chore(deps): bump .NET, EF Core and library patch versions.
Langage dominant
C#
Étoiles
184
Forks
48
Merge moyen
21 min
PR mergées (30 j)
7

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de CommunityToolkit/Datasync

Toutes les issues de CommunityToolkit/Datasync

Issues similaires

Plus d'issues C#

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.