chore(deps): bump .NET, EF Core and library patch versions to fix ASP.NET Core CVEs
还没有人认领这个 Issue。
评估
- 难度
- 3/5
- 预计耗时
- 1-2 天
- 新手友好度
- 45/100
- Issue 类型
- 缺陷
- 描述清晰度
- 描述清楚
- 活跃度
- 活跃
- 技术栈
- csharp
- 领域
- build-system, security
调研方向
Start with the root Directory.Packages.props and check for hard-coded versions in src and tests as directed in the issue. Verify the listed package versions on NuGet, then restore, build, and test Datasync.Toolkit.sln; Docker and an optional Cosmos connection string affect live test coverage. Done means the package pins and comments match the acceptance criteria, vulnerability checks are clear, and build-library.yml succeeds on the fork.
由索引模型根据 Issue 内容生成。
描述
Part 1 of the outdated-package sweep (found with dotnet-outdated 4.8.1 on 2026-11-05). This is the security-relevant patch bump for the main library solution (Datasync.Toolkit.sln). Related: #584 (Dependabot alert 9, samples only).
Scope (this PR only)
Patch-level bumps only, in the root Directory.Packages.props. No source changes are expected.
| Property / package | Current | Target | Notes |
|---|---|---|---|
<DotNetVersion> |
10.0.9 | 10.0.14 | Drives Microsoft.AspNetCore.Mvc.Testing, Microsoft.AspNetCore.OpenApi, Microsoft.Extensions.* (Caching.Memory, DependencyInjection.Abstractions, Http, Logging.Abstractions), System.Formats.Asn1, System.Text.Json, System.Threading.Tasks.Dataflow. 10.0.9 is in the range affected by ASP.NET Core RCE advisories GHSA-qjpx-jqm5-h2c4 (fixed 10.0.13) and GHSA-g27p-qf6j-c96c (fixed 10.0.14). |
<EFCoreVersion> |
10.0.9 | 10.0.14 | Drives all Microsoft.EntityFrameworkCore.* packages. |
Npgsql.EntityFrameworkCore.PostgreSQL |
10.0.2 | 10.0.3 | |
Microsoft.SourceLink.GitHub |
10.0.300 | 10.0.403 | |
SQLitePCLRaw.bundle_e_sqlite3 |
3.0.3 | 3.0.5 | Deliberate NU1903 pin (GHSA-2m69-gcr7-jv3q). Keep the explanatory XML comment. Must stay on the 3.x line. |
System.Linq.Async |
7.0.0 | 7.0.1 | Only used by CommunityToolkit.Datasync.Client.Test. |
<ODataVersion> and Microsoft.Spatial |
8.4.3 | 8.4.4 | Microsoft.Spatial is pinned separately from <ODataVersion> (line ~43): update both. 8.4.4 exists on NuGet for Core, Edm and Spatial. Microsoft.AspNetCore.OData 9.4.1 depends on [8.4.0, 9.0.0) so this is compatible. Do not go to 9.0.0 (see the separate OData 9 issue). |
Verify each target version exists with curl -s https://api.nuget.org/v3-flatcontainer/<lowercase-id>/index.json before editing; if a newer patch of the same line has shipped, use it.
Out of scope: samples, minor/major bumps, test tooling.
Steps
- Edit
Directory.Packages.propsas above. Do not touch any.csprojunless a version is hard-coded there (check withgrep -rn 'Version="' src tests --include=*.csproj). dotnet restore && dotnet build && dotnet testfrom the repo root. Docker is needed for the Testcontainers-based suites (MongoDB, SQL Server, PostgreSQL); Cosmos tests needCOSMOS_CONNECTION_STRINGand are skipped otherwise (see README "Running Live Tests").- Confirm no vulnerability warnings:
dotnet restoremust emit noNU1901-NU1904, anddotnet list Datasync.Toolkit.sln package --vulnerable --include-transitiveshould be empty. - Re-run
dotnet-outdated Datasync.Toolkit.sln(dotnet tool install -g dotnet-outdated-tool); the packages above should no longer be reported. - Dispatch
build-library.ymlon the fork with--ref <branch>and wait for success.
Acceptance criteria
- All packages in the table are at target versions; comments in the props file preserved.
- Local build and tests pass; no NU190x warnings.
build-library.ymlpasses on the fork.- PR is a single commit-scoped change:
chore(deps): bump .NET, EF Core and library patch versions.
- 主要语言
- C#
- 星标
- 184
- 派生
- 48
- 平均合并
- 21 分钟
- 30 天内合并 PR
- 7
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
CommunityToolkit/Datasync 的其他 Issue
-
难度 2/5 1-3 小时 新手友好度 78/100
CommunityToolkit/Datasync#600 · 1 条评论 ·
-
Blocked dependencies Server
难度 4/5 3-5 天 新手友好度 25/100
CommunityToolkit/Datasync#594 ·
-
dependencies Examples
难度 4/5 3-5 天 新手友好度 40/100
CommunityToolkit/Datasync#593 ·
-
dependencies Infrastructure
难度 3/5 1-2 天 新手友好度 72/100
CommunityToolkit/Datasync#592 ·
-
dependencies Infrastructure
难度 4/5 3-5 天 新手友好度 48/100
CommunityToolkit/Datasync#591 ·
查看 CommunityToolkit/Datasync 的全部 Issue
相似的 Issue
-
enhancement needs-triage
难度 2/5 1-3 小时 新手友好度 78/100
microsoft/microsoft-ui-reactor#1460 ·
维护者通常 1 天内回复
-
t/bug
难度 2/5 1-3 小时 新手友好度 75/100
dotnet/maui#39950 · 1 个 reaction ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 72/100
NimblePros/deviq-hugo#121 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 76/100
philterd/phileas-dotnet#188 ·
-
enhancement triaged
难度 2/5 1-3 小时 新手友好度 68/100
nikneem/sessionize-api-client#55 · 3 条评论 ·