Skip to content

Commit c48ea1a

Browse files
VulthilVulthil
authored
Align the .NET servicing train to 10.0.10/9.0.18 and hand-manage the Microsoft.OpenApi pin (#355)
* build(deps): align framework packages to 10.0.10/9.0.18 and hand-manage the Microsoft.OpenApi pin * build(deps): document the Aspire 13 floor that keeps Microsoft.Extensions.* pins literal
1 parent 4444ef5 commit c48ea1a

2 files changed

Lines changed: 28 additions & 21 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -22,12 +22,13 @@ updates:
2222
interval: "daily"
2323
open-pull-requests-limit: 25
2424
ignore:
25-
# Microsoft.OpenApi 3.x is a separate major that ASP.NET Core's Microsoft.AspNetCore.OpenApi does
26-
# not consume; the explicit 2.x pin in Directory.Packages.props tracks the patched line for
27-
# GHSA-v5pm-xwqc-g5wc. Allow 2.x patch/minor bumps; drop this rule together with that pin once
28-
# Microsoft.AspNetCore.OpenApi's own dependency floor passes 2.7.5.
25+
# Microsoft.OpenApi is pinned per-TFM in Directory.Packages.props (2.x patched line for net10.0
26+
# per GHSA-v5pm-xwqc-g5wc; 1.6.17 for net9.0, matching Microsoft.AspNetCore.OpenApi 9.x's own
27+
# floor — ASP.NET Core 9 does not consume the 2.x line). Dependabot flattens conditional MSBuild
28+
# property definitions to a single value, which would force 2.x onto the net9.0 leg, so the pin
29+
# is hand-managed and ALL updates are ignored here; NuGetAudit still fails CI on advisories.
30+
# Drop this rule together with the pin once Microsoft.AspNetCore.OpenApi's floor passes 2.7.5.
2931
- dependency-name: "Microsoft.OpenApi"
30-
update-types: ["version-update:semver-major"]
3132
groups:
3233
xunit:
3334
patterns:

‎Directory.Packages.props‎

Lines changed: 22 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -4,14 +4,15 @@
44
<CentralPackageTransitivePinningEnabled>false</CentralPackageTransitivePinningEnabled>
55
</PropertyGroup>
66
<PropertyGroup>
7-
<FrameworkVersion>10.0.9</FrameworkVersion>
8-
<FrameworkVersion Condition="'$(TargetFramework)' == 'net9.0'">9.0.17</FrameworkVersion>
7+
<FrameworkVersion>10.0.10</FrameworkVersion>
8+
<FrameworkVersion Condition="'$(TargetFramework)' == 'net9.0'">9.0.18</FrameworkVersion>
99
<AspireVersion>13.4.6</AspireVersion>
10-
<!-- GHSA-v5pm-xwqc-g5wc: Microsoft.AspNetCore.OpenApi 10.0.9 (net10.0) pulls in the vulnerable
11-
Microsoft.OpenApi 2.0.0. net9.0's Microsoft.AspNetCore.OpenApi 9.0.17 already depends on the
12-
unaffected 1.x line, so only override the net10.0 leg; remove once AspNetCore.OpenApi bumps its own
13-
floor past 2.7.5. -->
14-
<MicrosoftOpenApiVersion>2.9.0</MicrosoftOpenApiVersion>
10+
<!-- GHSA-v5pm-xwqc-g5wc: Microsoft.AspNetCore.OpenApi 10.0.10 (net10.0) still floors at the vulnerable
11+
Microsoft.OpenApi 2.0.0. net9.0's Microsoft.AspNetCore.OpenApi 9.0.18 floors at the unaffected
12+
1.6.17, so only override the net10.0 leg; remove once AspNetCore.OpenApi bumps its own floor past
13+
2.7.5. Hand-managed: dependabot ignores Microsoft.OpenApi entirely because it flattens these
14+
conditional legs to one value, forcing 2.x onto net9.0 (see .github/dependabot.yml). -->
15+
<MicrosoftOpenApiVersion>2.11.0</MicrosoftOpenApiVersion>
1516
<MicrosoftOpenApiVersion Condition="'$(TargetFramework)' == 'net9.0'">1.6.17</MicrosoftOpenApiVersion>
1617
</PropertyGroup>
1718
<ItemGroup>
@@ -33,18 +34,23 @@
3334
<PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="$(FrameworkVersion)" />
3435
<!-- MySQL: Aspire/Pomelo integration on net9; the Microting fork (a Pomelo fork) fills the EF Core 10 / net10 gap until the official Pomelo/Aspire packages ship it. -->
3536
<PackageVersion Include="Aspire.Pomelo.EntityFrameworkCore.MySql" Version="$(AspireVersion)" />
36-
<PackageVersion Include="Microting.EntityFrameworkCore.MySql" Version="10.0.9" />
37+
<PackageVersion Include="Microting.EntityFrameworkCore.MySql" Version="10.0.10" />
3738
<PackageVersion Include="Microsoft.EntityFrameworkCore.Cosmos" Version="$(FrameworkVersion)" />
3839
<PackageVersion Include="Microsoft.CodeAnalysis.PublicApiAnalyzers" Version="5.6.0" />
39-
<PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.9" />
40-
<PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.9" />
41-
<PackageVersion Include="Microsoft.Extensions.Diagnostics.HealthChecks" Version="10.0.9" />
42-
<PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.9" />
43-
<PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.9" />
40+
<!-- The in-box Microsoft.Extensions.* packages are deliberately literal, NOT $(FrameworkVersion):
41+
the Aspire 13.x client integrations shipped in src (Aspire.RabbitMQ.Client and the three EF
42+
provider integrations) floor them at >= 10.0.8 on BOTH TFMs, so a 9.x net9.0 leg is an NU1605
43+
downgrade error. Http.Resilience and ServiceDiscovery version on their own out-of-band minor
44+
cadence. -->
45+
<PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.10" />
46+
<PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.10" />
47+
<PackageVersion Include="Microsoft.Extensions.Diagnostics.HealthChecks" Version="10.0.10" />
48+
<PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.10" />
49+
<PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.10" />
4450
<PackageVersion Include="Microsoft.Extensions.Http.Resilience" Version="10.7.0" />
45-
<PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.9" />
46-
<PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="10.0.9" />
47-
<PackageVersion Include="Microsoft.Extensions.Options.DataAnnotations" Version="10.0.9" />
51+
<PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.10" />
52+
<PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="10.0.10" />
53+
<PackageVersion Include="Microsoft.Extensions.Options.DataAnnotations" Version="10.0.10" />
4854
<PackageVersion Include="Microsoft.Extensions.ServiceDiscovery" Version="10.7.0" />
4955
<PackageVersion Include="Microsoft.Testing.Extensions.CodeCoverage" Version="18.8.0" />
5056
<!-- Scoped to the Aspire DCP integration-test project only (via eng/coverage.ps1's

0 commit comments

Comments
 (0)