chore(deps): bump .NET, EF Core and library patch versions to fix ASP.NET Core CVEs

オープン
  • 何か問題がありますか？
#587 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

まだ誰も着手していません。

評価

難易度
3/5
見積もり時間
1〜2日
初心者へのやさしさ
45/100
issue の種類
バグ
明瞭さ
明確に書かれている
活発さ
活発
技術スタック
csharp
領域
build-system, security

調査の方向性

Start with the root Directory.Packages.props and check for hard-coded versions in src and tests as directed in the issue. Verify the listed package versions on NuGet, then restore, build, and test Datasync.Toolkit.sln; Docker and an optional Cosmos connection string affect live test coverage. Done means the package pins and comments match the acceptance criteria, vulnerability checks are clear, and build-library.yml succeeds on the fork.

索引モデルが issue の本文から書いたものです。

説明

Client dependencies Server

Part 1 of the outdated-package sweep (found with dotnet-outdated 4.8.1 on 2026-11-05). This is the security-relevant patch bump for the main library solution (Datasync.Toolkit.sln). Related: #584 (Dependabot alert 9, samples only).

Scope (this PR only)

Patch-level bumps only, in the root Directory.Packages.props. No source changes are expected.

Property / package Current Target Notes
<DotNetVersion> 10.0.9 10.0.14 Drives Microsoft.AspNetCore.Mvc.Testing, Microsoft.AspNetCore.OpenApi, Microsoft.Extensions.* (Caching.Memory, DependencyInjection.Abstractions, Http, Logging.Abstractions), System.Formats.Asn1, System.Text.Json, System.Threading.Tasks.Dataflow. 10.0.9 is in the range affected by ASP.NET Core RCE advisories GHSA-qjpx-jqm5-h2c4 (fixed 10.0.13) and GHSA-g27p-qf6j-c96c (fixed 10.0.14).
<EFCoreVersion> 10.0.9 10.0.14 Drives all Microsoft.EntityFrameworkCore.* packages.
Npgsql.EntityFrameworkCore.PostgreSQL 10.0.2 10.0.3
Microsoft.SourceLink.GitHub 10.0.300 10.0.403
SQLitePCLRaw.bundle_e_sqlite3 3.0.3 3.0.5 Deliberate NU1903 pin (GHSA-2m69-gcr7-jv3q). Keep the explanatory XML comment. Must stay on the 3.x line.
System.Linq.Async 7.0.0 7.0.1 Only used by CommunityToolkit.Datasync.Client.Test.
<ODataVersion> and Microsoft.Spatial 8.4.3 8.4.4 Microsoft.Spatial is pinned separately from <ODataVersion> (line ~43): update both. 8.4.4 exists on NuGet for Core, Edm and Spatial. Microsoft.AspNetCore.OData 9.4.1 depends on [8.4.0, 9.0.0) so this is compatible. Do not go to 9.0.0 (see the separate OData 9 issue).

Verify each target version exists with curl -s https://api.nuget.org/v3-flatcontainer/<lowercase-id>/index.json before editing; if a newer patch of the same line has shipped, use it.

Out of scope: samples, minor/major bumps, test tooling.

Steps

  1. Edit Directory.Packages.props as above. Do not touch any .csproj unless a version is hard-coded there (check with grep -rn 'Version="' src tests --include=*.csproj).
  2. dotnet restore && dotnet build && dotnet test from the repo root. Docker is needed for the Testcontainers-based suites (MongoDB, SQL Server, PostgreSQL); Cosmos tests need COSMOS_CONNECTION_STRING and are skipped otherwise (see README "Running Live Tests").
  3. Confirm no vulnerability warnings: dotnet restore must emit no NU1901-NU1904, and dotnet list Datasync.Toolkit.sln package --vulnerable --include-transitive should be empty.
  4. Re-run dotnet-outdated Datasync.Toolkit.sln (dotnet tool install -g dotnet-outdated-tool); the packages above should no longer be reported.
  5. Dispatch build-library.yml on the fork with --ref <branch> and wait for success.

Acceptance criteria

  • All packages in the table are at target versions; comments in the props file preserved.
  • Local build and tests pass; no NU190x warnings.
  • build-library.yml passes on the fork.
  • PR is a single commit-scoped change: chore(deps): bump .NET, EF Core and library patch versions.
主要言語
C#
スター
184
フォーク
48
平均マージ
21分
マージ済み PR（30日）
7

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

CommunityToolkit/Datasync のほかの issue

CommunityToolkit/Datasync の issue をすべて見る

似ている issue

C# の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。