chore(deps): bump .NET, EF Core and library patch versions to fix ASP.NET Core CVEs

Aberta
  • Algo errado?
#587 0 comentários 0 reações 0 responsáveis Ver no GitHub

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
3/5
Tempo estimado
1-2 dias
Facilidade para iniciantes
45/100
Tipo de issue
Bug
Clareza
Claramente especificada
Status de atividade
Ativa
Stack de tecnologia
csharp
Domínio
build-system, security

Direção de pesquisa

Start with the root Directory.Packages.props and check for hard-coded versions in src and tests as directed in the issue. Verify the listed package versions on NuGet, then restore, build, and test Datasync.Toolkit.sln; Docker and an optional Cosmos connection string affect live test coverage. Done means the package pins and comments match the acceptance criteria, vulnerability checks are clear, and build-library.yml succeeds on the fork.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

Client dependencies Server

Part 1 of the outdated-package sweep (found with dotnet-outdated 4.8.1 on 2026-11-05). This is the security-relevant patch bump for the main library solution (Datasync.Toolkit.sln). Related: #584 (Dependabot alert 9, samples only).

Scope (this PR only)

Patch-level bumps only, in the root Directory.Packages.props. No source changes are expected.

Property / package Current Target Notes
<DotNetVersion> 10.0.9 10.0.14 Drives Microsoft.AspNetCore.Mvc.Testing, Microsoft.AspNetCore.OpenApi, Microsoft.Extensions.* (Caching.Memory, DependencyInjection.Abstractions, Http, Logging.Abstractions), System.Formats.Asn1, System.Text.Json, System.Threading.Tasks.Dataflow. 10.0.9 is in the range affected by ASP.NET Core RCE advisories GHSA-qjpx-jqm5-h2c4 (fixed 10.0.13) and GHSA-g27p-qf6j-c96c (fixed 10.0.14).
<EFCoreVersion> 10.0.9 10.0.14 Drives all Microsoft.EntityFrameworkCore.* packages.
Npgsql.EntityFrameworkCore.PostgreSQL 10.0.2 10.0.3
Microsoft.SourceLink.GitHub 10.0.300 10.0.403
SQLitePCLRaw.bundle_e_sqlite3 3.0.3 3.0.5 Deliberate NU1903 pin (GHSA-2m69-gcr7-jv3q). Keep the explanatory XML comment. Must stay on the 3.x line.
System.Linq.Async 7.0.0 7.0.1 Only used by CommunityToolkit.Datasync.Client.Test.
<ODataVersion> and Microsoft.Spatial 8.4.3 8.4.4 Microsoft.Spatial is pinned separately from <ODataVersion> (line ~43): update both. 8.4.4 exists on NuGet for Core, Edm and Spatial. Microsoft.AspNetCore.OData 9.4.1 depends on [8.4.0, 9.0.0) so this is compatible. Do not go to 9.0.0 (see the separate OData 9 issue).

Verify each target version exists with curl -s https://api.nuget.org/v3-flatcontainer/<lowercase-id>/index.json before editing; if a newer patch of the same line has shipped, use it.

Out of scope: samples, minor/major bumps, test tooling.

Steps

  1. Edit Directory.Packages.props as above. Do not touch any .csproj unless a version is hard-coded there (check with grep -rn 'Version="' src tests --include=*.csproj).
  2. dotnet restore && dotnet build && dotnet test from the repo root. Docker is needed for the Testcontainers-based suites (MongoDB, SQL Server, PostgreSQL); Cosmos tests need COSMOS_CONNECTION_STRING and are skipped otherwise (see README "Running Live Tests").
  3. Confirm no vulnerability warnings: dotnet restore must emit no NU1901-NU1904, and dotnet list Datasync.Toolkit.sln package --vulnerable --include-transitive should be empty.
  4. Re-run dotnet-outdated Datasync.Toolkit.sln (dotnet tool install -g dotnet-outdated-tool); the packages above should no longer be reported.
  5. Dispatch build-library.yml on the fork with --ref <branch> and wait for success.

Acceptance criteria

  • All packages in the table are at target versions; comments in the props file preserved.
  • Local build and tests pass; no NU190x warnings.
  • build-library.yml passes on the fork.
  • PR is a single commit-scoped change: chore(deps): bump .NET, EF Core and library patch versions.
Linguagem predominante
C#
Estrelas
184
Forks
48
Merge médio
21min
PRs com merge (30d)
7

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de CommunityToolkit/Datasync

Todas as issues de CommunityToolkit/Datasync

Issues semelhantes

Mais issues de C#

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.