chore(deps): bump .NET, EF Core and library patch versions to fix ASP.NET Core CVEs

Aperta
  • Qualcosa non va?
#587 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
45/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
csharp
Ambito
build-system, security

Direzione di ricerca

Start with the root Directory.Packages.props and check for hard-coded versions in src and tests as directed in the issue. Verify the listed package versions on NuGet, then restore, build, and test Datasync.Toolkit.sln; Docker and an optional Cosmos connection string affect live test coverage. Done means the package pins and comments match the acceptance criteria, vulnerability checks are clear, and build-library.yml succeeds on the fork.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Client dependencies Server

Part 1 of the outdated-package sweep (found with dotnet-outdated 4.8.1 on 2026-11-05). This is the security-relevant patch bump for the main library solution (Datasync.Toolkit.sln). Related: #584 (Dependabot alert 9, samples only).

Scope (this PR only)

Patch-level bumps only, in the root Directory.Packages.props. No source changes are expected.

Property / package Current Target Notes
<DotNetVersion> 10.0.9 10.0.14 Drives Microsoft.AspNetCore.Mvc.Testing, Microsoft.AspNetCore.OpenApi, Microsoft.Extensions.* (Caching.Memory, DependencyInjection.Abstractions, Http, Logging.Abstractions), System.Formats.Asn1, System.Text.Json, System.Threading.Tasks.Dataflow. 10.0.9 is in the range affected by ASP.NET Core RCE advisories GHSA-qjpx-jqm5-h2c4 (fixed 10.0.13) and GHSA-g27p-qf6j-c96c (fixed 10.0.14).
<EFCoreVersion> 10.0.9 10.0.14 Drives all Microsoft.EntityFrameworkCore.* packages.
Npgsql.EntityFrameworkCore.PostgreSQL 10.0.2 10.0.3
Microsoft.SourceLink.GitHub 10.0.300 10.0.403
SQLitePCLRaw.bundle_e_sqlite3 3.0.3 3.0.5 Deliberate NU1903 pin (GHSA-2m69-gcr7-jv3q). Keep the explanatory XML comment. Must stay on the 3.x line.
System.Linq.Async 7.0.0 7.0.1 Only used by CommunityToolkit.Datasync.Client.Test.
<ODataVersion> and Microsoft.Spatial 8.4.3 8.4.4 Microsoft.Spatial is pinned separately from <ODataVersion> (line ~43): update both. 8.4.4 exists on NuGet for Core, Edm and Spatial. Microsoft.AspNetCore.OData 9.4.1 depends on [8.4.0, 9.0.0) so this is compatible. Do not go to 9.0.0 (see the separate OData 9 issue).

Verify each target version exists with curl -s https://api.nuget.org/v3-flatcontainer/<lowercase-id>/index.json before editing; if a newer patch of the same line has shipped, use it.

Out of scope: samples, minor/major bumps, test tooling.

Steps

  1. Edit Directory.Packages.props as above. Do not touch any .csproj unless a version is hard-coded there (check with grep -rn 'Version="' src tests --include=*.csproj).
  2. dotnet restore && dotnet build && dotnet test from the repo root. Docker is needed for the Testcontainers-based suites (MongoDB, SQL Server, PostgreSQL); Cosmos tests need COSMOS_CONNECTION_STRING and are skipped otherwise (see README "Running Live Tests").
  3. Confirm no vulnerability warnings: dotnet restore must emit no NU1901-NU1904, and dotnet list Datasync.Toolkit.sln package --vulnerable --include-transitive should be empty.
  4. Re-run dotnet-outdated Datasync.Toolkit.sln (dotnet tool install -g dotnet-outdated-tool); the packages above should no longer be reported.
  5. Dispatch build-library.yml on the fork with --ref <branch> and wait for success.

Acceptance criteria

  • All packages in the table are at target versions; comments in the props file preserved.
  • Local build and tests pass; no NU190x warnings.
  • build-library.yml passes on the fork.
  • PR is a single commit-scoped change: chore(deps): bump .NET, EF Core and library patch versions.
Lingua principale
C#
Stelle
184
Fork
48
Merge medio
21m
PR unite (30g)
7

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di CommunityToolkit/Datasync

Tutte le issue di CommunityToolkit/Datasync

Issue simili

Altre issue su C#

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.