[build] Update NuGet package versions #196
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jonpryor
added a commit
to jonpryor/xamarin-android
that referenced
this pull request
Oct 28, 2022
Context: dotnet/android-tools#196 Does It Build™?
Contributor
Author
|
DO NOT MERGE until dotnet/android#7501 is green |
jonpryor
added a commit
to jonpryor/xamarin-android
that referenced
this pull request
Oct 28, 2022
Context: dotnet/android-tools#196 Does It Build™?
jonpryor
added a commit
to jonpryor/xamarin-android
that referenced
this pull request
Nov 7, 2022
Context: dotnet/android-tools#196 Does It Build™?
jonpryor
added a commit
to jonpryor/xamarin-android
that referenced
this pull request
Nov 9, 2022
Context: dotnet/android-tools#196 Does It Build™?
Context: https://dev.azure.com/xamarin/public/_componentGovernance/115226/alert/3150206?typeId=5477311 Context: https://dev.azure.com/xamarin/public/_componentGovernance/115226/alert/6875331?typeId=5477311 Context: dotnet/java-interop@5318261 [Component Governance][0] is a Microsoft internal tool which checks for known security issues in product dependencies. It is currently reporting a defects in xamarin-android-tools due to use of older `System.Net.Http` packages (]CVE-2018-8292][0]) and older `System.Security.Cryptography.X509Certificates` packages ([CVE-2017-11770][1]): > **Location** > > * /s/packages/system.net.http/4.1.0/system.net.http.4.1.0.nupkg > * /s/packages/system.net.http/4.1.0/system.net.http.nuspec > * /s/packages/system.security.cryptography.x509certificates/4.1.0/system.security.cryptography.x509certificates.4.1.0.nupkg > * /s/packages/system.security.cryptography.x509certificates/4.1.0/system.security.cryptography.x509certificates.nuspec The "odd" thing is that xamarin-android-tools doesn't *use* either of these dependencies! They appear to be pulled in via package dependencies. Rework how we use `@(PackageReference)` so that `Directory.Build.targets` uses [the `Update` attribute][2] to centralize package version specification, except within `MSBuildReferences.projitems` as it's `<Import/>`ed by xamarin-android. Update most NuGet package versions to the latest versions provided by `dotnet-public` or `dotnet-eng` (which may not be the latest versions on NuGet.org). While stable versions are generally preferred, we use Microsoft.NET.Test.Sdk version 17.5.0-preview-20221003-04 to ensure that we avoid Newtonsoft.Json 9.0.1 issues a'la dotnet/java-interop@53182615. [0]: https://nvd.nist.gov/vuln/detail/CVE-2018-8292 [1]: https://nvd.nist.gov/vuln/detail/CVE-2017-11770 [2]: https://learn.microsoft.com/en-us/visualstudio/msbuild/item-element-msbuild?view=vs-2022#attributes-and-elements
jonpryor
force-pushed
the
jonp-bump-nuget-versions-2022-10-27
branch
from
298c5c5 to
12d754d
Compare
jonpryor
added a commit
to jonpryor/java.interop
that referenced
this pull request
Jan 12, 2023
Changes: dotnet/android-tools@29f11f2...47f95ab * dotnet/android-tools@47f95ab: Fix CS0121 ambiguity errors. (dotnet/android-tools#200) * dotnet/android-tools@76c076f: Add support for Project Specific RegisterTaskObject. (dotnet/android-tools#199) * dotnet/android-tools@9f02d77: Add reference to System.Security.Cryptography.Xml (dotnet/android-tools#198) * dotnet/android-tools@fa3711b: [build] Update NuGet package versions (dotnet/android-tools#196) * dotnet/android-tools@59cac90: Enable CodeQL (dotnet/android-tools#197) * dotnet/android-tools@9f56dec: Move from `netcoreapp3.1` to `net6.0` (dotnet/android-tools#195) * dotnet/android-tools@0be567a: Use Environment.SpecialFolder.UserProfile, not SpecialFolder.Personal (dotnet/android-tools#194)
jonpryor
added a commit
to jonpryor/java.interop
that referenced
this pull request
Jan 18, 2023
Changes: dotnet/android-tools@29f11f2...099fd95 * dotnet/android-tools@099fd95: Add *Task.ProjectSpecificTaskObjectKey() for RegisterTaskObject() use (dotnet/android-tools#202) * dotnet/android-tools@ac9ea09: Revert IBuildEngine.ProjectFileOfTaskNode use. (dotnet/android-tools#201) * dotnet/android-tools@47f95ab: Fix CS0121 ambiguity errors. (dotnet/android-tools#200) * dotnet/android-tools@76c076f: Add support for Project Specific RegisterTaskObject. (dotnet/android-tools#199) * dotnet/android-tools@9f02d77: Add reference to System.Security.Cryptography.Xml (dotnet/android-tools#198) * dotnet/android-tools@fa3711b: [build] Update NuGet package versions (dotnet/android-tools#196) * dotnet/android-tools@59cac90: Enable CodeQL (dotnet/android-tools#197) * dotnet/android-tools@9f56dec: Move from `netcoreapp3.1` to `net6.0` (dotnet/android-tools#195) * dotnet/android-tools@0be567a: Use Environment.SpecialFolder.UserProfile, not SpecialFolder.Personal (dotnet/android-tools#194)
jonpryor
added a commit
to dotnet/java-interop
that referenced
this pull request
Jan 25, 2023
Changes: dotnet/android-tools@29f11f2...099fd95 * dotnet/android-tools@099fd95: Add *Task.ProjectSpecificTaskObjectKey() for RegisterTaskObject() use (dotnet/android-tools#202) * dotnet/android-tools@ac9ea09: Revert IBuildEngine.ProjectFileOfTaskNode use. (dotnet/android-tools#201) * dotnet/android-tools@47f95ab: Fix CS0121 ambiguity errors. (dotnet/android-tools#200) * dotnet/android-tools@76c076f: Add support for Project Specific RegisterTaskObject. (dotnet/android-tools#199) * dotnet/android-tools@9f02d77: Add reference to System.Security.Cryptography.Xml (dotnet/android-tools#198) * dotnet/android-tools@fa3711b: [build] Update NuGet package versions (dotnet/android-tools#196) * dotnet/android-tools@59cac90: Enable CodeQL (dotnet/android-tools#197) * dotnet/android-tools@9f56dec: Move from `netcoreapp3.1` to `net6.0` (dotnet/android-tools#195) * dotnet/android-tools@0be567a: Use Environment.SpecialFolder.UserProfile, not SpecialFolder.Personal (dotnet/android-tools#194)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Context: https://dev.azure.com/xamarin/public/_componentGovernance/115226/alert/3150206?typeId=5477311 Context: https://dev.azure.com/xamarin/public/_componentGovernance/115226/alert/6875331?typeId=5477311 Context: dotnet/java-interop@5318261
Component Governance is a Microsoft internal tool which checks for known security issues in product dependencies. It is currently reporting a defects in xamarin-android-tools due to use of older
System.Net.Httppackages (]CVE-2018-8292]0) and olderSystem.Security.Cryptography.X509Certificatespackages (CVE-2017-11770):
The "odd" thing is that xamarin-android-tools doesn't use either of these dependencies! They appear to be pulled in via package dependencies.
Rework how we use
@(PackageReference)so thatDirectory.Build.targetsuses theUpdateattribute to centralize package version specification, except withinMSBuildReferences.projitemsas it's<Import/>ed by xamarin-android.Update most NuGet package versions to the latest versions provided by
dotnet-publicordotnet-eng(which may not be the latest versions on NuGet.org).While stable versions are generally preferred, we use Microsoft.NET.Test.Sdk version 17.5.0-preview-20221003-04 to ensure that we avoid Newtonsoft.Json 9.0.1 issues a'la
dotnet/java-interop@53182615.