You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Context: https://dev.azure.com/xamarin/public/_componentGovernance/115226/alert/3150206?typeId=5477311
Context: https://dev.azure.com/xamarin/public/_componentGovernance/115226/alert/6875331?typeId=5477311
Context: dotnet/java-interop@5318261
[Component Governance][0] is a Microsoft internal tool which checks
for known security issues in product dependencies. It is currently
reporting a defects in xamarin-android-tools due to use of older
`System.Net.Http` packages (]CVE-2018-8292][0]) and older
`System.Security.Cryptography.X509Certificates`
packages ([CVE-2017-11770][1]):
> **Location**
>
> * /s/packages/system.net.http/4.1.0/system.net.http.4.1.0.nupkg
> * /s/packages/system.net.http/4.1.0/system.net.http.nuspec
> * /s/packages/system.security.cryptography.x509certificates/4.1.0/system.security.cryptography.x509certificates.4.1.0.nupkg
> * /s/packages/system.security.cryptography.x509certificates/4.1.0/system.security.cryptography.x509certificates.nuspec
The "odd" thing is that xamarin-android-tools doesn't *use* either
of these dependencies! They appear to be pulled in via package
dependencies.
Rework how we use `@(PackageReference)` so that
`Directory.Build.targets` uses [the `Update` attribute][2] to
centralize package version specification, except within
`MSBuildReferences.projitems` as it's `<Import/>`ed by xamarin-android.
Update most NuGet package versions to the latest versions provided by
`dotnet-public` or `dotnet-eng` (which may not be the latest versions
on NuGet.org).
While stable versions are generally preferred, we use
Microsoft.NET.Test.Sdk version 17.5.0-preview-20221003-04 to ensure
that we avoid Newtonsoft.Json 9.0.1 issues a'la
dotnet/java-interop@53182615.
[0]: https://nvd.nist.gov/vuln/detail/CVE-2018-8292
[1]: https://nvd.nist.gov/vuln/detail/CVE-2017-11770
[2]: https://learn.microsoft.com/en-us/visualstudio/msbuild/item-element-msbuild?view=vs-2022#attributes-and-elements
0 commit comments