chore(deps): bump .NET, EF Core and library patch versions to fix ASP.NET Core CVEs
還沒有人認領這個 Issue。
評估
- 難度
- 3/5
- 預估耗時
- 1-2 天
- 新手友好度
- 45/100
- Issue 類型
- 缺陷
- 描述清晰度
- 描述清楚
- 活躍度
- 活躍
- 技術堆疊
- csharp
- 領域
- build-system, security
研究方向
Start with the root Directory.Packages.props and check for hard-coded versions in src and tests as directed in the issue. Verify the listed package versions on NuGet, then restore, build, and test Datasync.Toolkit.sln; Docker and an optional Cosmos connection string affect live test coverage. Done means the package pins and comments match the acceptance criteria, vulnerability checks are clear, and build-library.yml succeeds on the fork.
由索引模型根據 Issue 內容生成。
描述
Part 1 of the outdated-package sweep (found with dotnet-outdated 4.8.1 on 2026-11-05). This is the security-relevant patch bump for the main library solution (Datasync.Toolkit.sln). Related: #584 (Dependabot alert 9, samples only).
Scope (this PR only)
Patch-level bumps only, in the root Directory.Packages.props. No source changes are expected.
| Property / package | Current | Target | Notes |
|---|---|---|---|
<DotNetVersion> |
10.0.9 | 10.0.14 | Drives Microsoft.AspNetCore.Mvc.Testing, Microsoft.AspNetCore.OpenApi, Microsoft.Extensions.* (Caching.Memory, DependencyInjection.Abstractions, Http, Logging.Abstractions), System.Formats.Asn1, System.Text.Json, System.Threading.Tasks.Dataflow. 10.0.9 is in the range affected by ASP.NET Core RCE advisories GHSA-qjpx-jqm5-h2c4 (fixed 10.0.13) and GHSA-g27p-qf6j-c96c (fixed 10.0.14). |
<EFCoreVersion> |
10.0.9 | 10.0.14 | Drives all Microsoft.EntityFrameworkCore.* packages. |
Npgsql.EntityFrameworkCore.PostgreSQL |
10.0.2 | 10.0.3 | |
Microsoft.SourceLink.GitHub |
10.0.300 | 10.0.403 | |
SQLitePCLRaw.bundle_e_sqlite3 |
3.0.3 | 3.0.5 | Deliberate NU1903 pin (GHSA-2m69-gcr7-jv3q). Keep the explanatory XML comment. Must stay on the 3.x line. |
System.Linq.Async |
7.0.0 | 7.0.1 | Only used by CommunityToolkit.Datasync.Client.Test. |
<ODataVersion> and Microsoft.Spatial |
8.4.3 | 8.4.4 | Microsoft.Spatial is pinned separately from <ODataVersion> (line ~43): update both. 8.4.4 exists on NuGet for Core, Edm and Spatial. Microsoft.AspNetCore.OData 9.4.1 depends on [8.4.0, 9.0.0) so this is compatible. Do not go to 9.0.0 (see the separate OData 9 issue). |
Verify each target version exists with curl -s https://api.nuget.org/v3-flatcontainer/<lowercase-id>/index.json before editing; if a newer patch of the same line has shipped, use it.
Out of scope: samples, minor/major bumps, test tooling.
Steps
- Edit
Directory.Packages.propsas above. Do not touch any.csprojunless a version is hard-coded there (check withgrep -rn 'Version="' src tests --include=*.csproj). dotnet restore && dotnet build && dotnet testfrom the repo root. Docker is needed for the Testcontainers-based suites (MongoDB, SQL Server, PostgreSQL); Cosmos tests needCOSMOS_CONNECTION_STRINGand are skipped otherwise (see README "Running Live Tests").- Confirm no vulnerability warnings:
dotnet restoremust emit noNU1901-NU1904, anddotnet list Datasync.Toolkit.sln package --vulnerable --include-transitiveshould be empty. - Re-run
dotnet-outdated Datasync.Toolkit.sln(dotnet tool install -g dotnet-outdated-tool); the packages above should no longer be reported. - Dispatch
build-library.ymlon the fork with--ref <branch>and wait for success.
Acceptance criteria
- All packages in the table are at target versions; comments in the props file preserved.
- Local build and tests pass; no NU190x warnings.
build-library.ymlpasses on the fork.- PR is a single commit-scoped change:
chore(deps): bump .NET, EF Core and library patch versions.
- 主要語言
- C#
- 星號
- 184
- 分支
- 48
- 平均合併
- 21 分鐘
- 30 天內合併 PR
- 7
環境準備
- 沒有 Dockerfile 或 Docker Compose 檔案
- 沒有 Pull Request 範本
- 閱讀貢獻指南
從這裡開始
- 先讀完整個 Issue，再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫，在一個分支上完成修改。
- 送出 Pull Request，並在描述裡引用這個 Issue 編號。
CommunityToolkit/Datasync 的其他 Issue
-
難度 2/5 1-3 小時 新手友好度 78/100
CommunityToolkit/Datasync#600 · 1 則留言 ·
-
Blocked dependencies Server
難度 4/5 3-5 天 新手友好度 25/100
CommunityToolkit/Datasync#594 ·
-
dependencies Examples
難度 4/5 3-5 天 新手友好度 40/100
CommunityToolkit/Datasync#593 ·
-
dependencies Infrastructure
難度 3/5 1-2 天 新手友好度 72/100
CommunityToolkit/Datasync#592 ·
-
dependencies Infrastructure
難度 4/5 3-5 天 新手友好度 48/100
CommunityToolkit/Datasync#591 ·
查看 CommunityToolkit/Datasync 的全部 Issue
相似的 Issue
-
enhancement needs-triage
難度 2/5 1-3 小時 新手友好度 78/100
microsoft/microsoft-ui-reactor#1460 ·
維護者通常 1 天內回覆
-
t/bug
難度 2/5 1-3 小時 新手友好度 75/100
dotnet/maui#39950 · 1 個 reaction ·
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 72/100
NimblePros/deviq-hugo#121 ·
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 76/100
philterd/phileas-dotnet#188 ·
-
enhancement triaged
難度 2/5 1-3 小時 新手友好度 68/100
nikneem/sessionize-api-client#55 · 3 則留言 ·