Commit b81ee32
Pin Microsoft.Data.OData nuspec dependency to [5.8.4, 6.0.0) and bump to 6.0.1.0
The previous nuspec dependency range '[5.*, 6.0.0)' has a subtle bug: in
NuGet PackageReferences a '5.*' wildcard floats to the latest 5.x at
build time, but inside a .nuspec dependency element it is interpreted
as the minimum version of the range, so a fresh restore of
GeneXus.Odata.Client picks up Microsoft.Data.OData 5.0.0.50403 — the
oldest 5.x with the high-severity advisory GHSA-mv2r-q4g5-j8q5.
Pin the lower bound to 5.8.4 (the last vulnerability-free 5.x) so
consumers default to that version. Bump AssemblyVersion to 6.0.1.0.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>1 parent 99e7083 commit b81ee32
2 files changed
Lines changed: 4 additions & 4 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
20 | 20 | | |
21 | 21 | | |
22 | 22 | | |
23 | | - | |
| 23 | + | |
24 | 24 | | |
25 | 25 | | |
26 | 26 | | |
27 | | - | |
| 27 | + | |
28 | 28 | | |
29 | 29 | | |
30 | 30 | | |
31 | | - | |
| 31 | + | |
32 | 32 | | |
33 | 33 | | |
34 | 34 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
3 | 3 | | |
4 | 4 | | |
5 | 5 | | |
6 | | - | |
| 6 | + | |
7 | 7 | | |
8 | 8 | | |
9 | 9 | | |
| |||
0 commit comments