-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathDirectory.Packages.props
More file actions
90 lines (90 loc) · 6.97 KB
/
Copy pathDirectory.Packages.props
File metadata and controls
90 lines (90 loc) · 6.97 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
<Project>
<PropertyGroup>
<ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
<CentralPackageTransitivePinningEnabled>false</CentralPackageTransitivePinningEnabled>
</PropertyGroup>
<PropertyGroup>
<FrameworkVersion>10.0.10</FrameworkVersion>
<FrameworkVersion Condition="'$(TargetFramework)' == 'net9.0'">9.0.18</FrameworkVersion>
<AspireVersion>13.4.6</AspireVersion>
<!-- GHSA-v5pm-xwqc-g5wc: Microsoft.AspNetCore.OpenApi 10.0.10 (net10.0) still floors at the vulnerable
Microsoft.OpenApi 2.0.0. net9.0's Microsoft.AspNetCore.OpenApi 9.0.18 floors at the unaffected
1.6.17, so only override the net10.0 leg; remove once AspNetCore.OpenApi bumps its own floor past
2.7.5. Hand-managed: dependabot ignores Microsoft.OpenApi entirely because it flattens these
conditional legs to one value, forcing 2.x onto net9.0 (see .github/dependabot.yml). -->
<MicrosoftOpenApiVersion>2.11.0</MicrosoftOpenApiVersion>
<MicrosoftOpenApiVersion Condition="'$(TargetFramework)' == 'net9.0'">1.6.17</MicrosoftOpenApiVersion>
</PropertyGroup>
<ItemGroup>
<PackageVersion Include="Aspire.Hosting.PostgreSQL" Version="$(AspireVersion)" />
<PackageVersion Include="Aspire.Hosting.RabbitMQ" Version="$(AspireVersion)" />
<PackageVersion Include="Aspire.Hosting.Testing" Version="$(AspireVersion)" />
<PackageVersion Include="Aspire.Microsoft.EntityFrameworkCore.Cosmos" Version="$(AspireVersion)" />
<PackageVersion Include="Aspire.Npgsql.EntityFrameworkCore.PostgreSQL" Version="$(AspireVersion)" />
<PackageVersion Include="Aspire.RabbitMQ.Client" Version="$(AspireVersion)" />
<PackageVersion Include="FluentValidation" Version="12.1.1" />
<PackageVersion Include="FluentValidation.DependencyInjectionExtensions" Version="12.1.1" />
<PackageVersion Include="Meziantou.Extensions.Logging.Xunit.v3" Version="2.0.3" />
<PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="$(FrameworkVersion)" />
<PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="$(FrameworkVersion)" />
<PackageVersion Include="Microsoft.OpenApi" Version="$(MicrosoftOpenApiVersion)" />
<PackageVersion Include="Microsoft.EntityFrameworkCore" Version="$(FrameworkVersion)" />
<PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="$(FrameworkVersion)" />
<PackageVersion Include="Microsoft.EntityFrameworkCore.Relational" Version="$(FrameworkVersion)" />
<PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="$(FrameworkVersion)" />
<!-- MySQL: Aspire/Pomelo integration on net9; the Microting fork (a Pomelo fork) fills the EF Core 10 / net10 gap until the official Pomelo/Aspire packages ship it. -->
<PackageVersion Include="Aspire.Pomelo.EntityFrameworkCore.MySql" Version="$(AspireVersion)" />
<PackageVersion Include="Microting.EntityFrameworkCore.MySql" Version="10.0.10" />
<PackageVersion Include="Microsoft.EntityFrameworkCore.Cosmos" Version="$(FrameworkVersion)" />
<PackageVersion Include="Microsoft.CodeAnalysis.PublicApiAnalyzers" Version="5.6.0" />
<!-- The in-box Microsoft.Extensions.* packages are deliberately literal, NOT $(FrameworkVersion):
the Aspire 13.x client integrations shipped in src (Aspire.RabbitMQ.Client and the three EF
provider integrations) floor them at >= 10.0.8 on BOTH TFMs, so a 9.x net9.0 leg is an NU1605
downgrade error. Http.Resilience and ServiceDiscovery version on their own out-of-band minor
cadence. -->
<PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.10" />
<PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.10" />
<PackageVersion Include="Microsoft.Extensions.Diagnostics.HealthChecks" Version="10.0.10" />
<PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.10" />
<PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.10" />
<PackageVersion Include="Microsoft.Extensions.Http.Resilience" Version="10.8.0" />
<PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.10" />
<PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="10.0.10" />
<PackageVersion Include="Microsoft.Extensions.Options.DataAnnotations" Version="10.0.10" />
<PackageVersion Include="Microsoft.Extensions.ServiceDiscovery" Version="10.8.0" />
<PackageVersion Include="Microsoft.Testing.Extensions.CodeCoverage" Version="18.9.0" />
<!-- Scoped to the Aspire DCP integration-test project only (via eng/coverage.ps1's
split test invocation); retrying failed unit-suite tests would mask real flake. -->
<PackageVersion Include="Microsoft.Testing.Extensions.Retry" Version="2.3.2" />
<PackageVersion Include="Microsoft.SourceLink.GitHub" Version="10.0.301" />
<PackageVersion Include="Nerdbank.GitVersioning" Version="3.10.91" />
<PackageVersion Include="Moq.AutoMock" Version="4.0.2" />
<PackageVersion Include="OpenTelemetry.Api" Version="1.17.0" />
<PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.17.0" />
<PackageVersion Include="OpenTelemetry.Extensions.Hosting" Version="1.17.0" />
<PackageVersion Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.17.0" />
<PackageVersion Include="OpenTelemetry.Instrumentation.Http" Version="1.17.0" />
<PackageVersion Include="OpenTelemetry.Instrumentation.Runtime" Version="1.17.0" />
<PackageVersion Include="ReportGenerator" Version="5.5.10" />
<PackageVersion Include="Respawn" Version="7.0.0" />
<PackageVersion Include="Scalar.Aspire" Version="0.11.11" />
<PackageVersion Include="Shouldly" Version="4.3.0" />
<PackageVersion Include="SonarAnalyzer.CSharp" Version="10.29.0.143774" />
<PackageVersion Include="Testcontainers" Version="4.13.0" />
<PackageVersion Include="Testcontainers.CosmosDb" Version="4.13.0" />
<PackageVersion Include="Testcontainers.MySql" Version="4.13.0" />
<PackageVersion Include="Testcontainers.PostgreSql" Version="4.13.0" />
<PackageVersion Include="Testcontainers.RabbitMq" Version="4.13.0" />
<PackageVersion Include="Testcontainers.XunitV3" Version="4.13.0" />
<PackageVersion Include="xunit.analyzers" Version="1.27.0" />
<PackageVersion Include="xunit.v3.extensibility.core" Version="3.2.2" />
<PackageVersion Include="xunit.v3.mtp-v2" Version="3.2.2" />
</ItemGroup>
<!-- GHSA-2m69-gcr7-jv3q: high-severity advisory on the native SQLitePCLRaw.lib.e_sqlite3, pulled transitively by
Microsoft.EntityFrameworkCore.Sqlite — referenced only by the relational in-memory test projects, so the
vulnerable native library never ships in a packaged library. Suppressed as a documented stopgap; remove once a
patched SQLitePCLRaw flows through EF Core's pinned version. -->
<ItemGroup>
<NuGetAuditSuppress Include="https://github.com/advisories/GHSA-2m69-gcr7-jv3q" />
</ItemGroup>
</Project>