You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Context: c936d09
Context: https://devdiv.visualstudio.com/DevDiv/_componentGovernance/112825/alert/7082457?typeId=12393424
Context: microsoft/vstest#4098
[Component Governance][0] is a Microsoft internal tool which checks
for known security issues in product dependencies. It is currently
reporting a defect in Java.Interop because of Newtonsoft.Json 9.0.1
and [GHSA-5crp-9r3c-p9vr][1]. This is a tad odd because Java.Interop
*does not use* Newtonsoft.Json.
Apparently the [Microsoft.NET.Test.Sdk 16.11.0 package][2] pulls in
Newtonsoft.Json 9.0.1 when `$(TargetFramework)`=UAP10.0, which is
also something that Java.Interop does not use.
Regardless! Take this as a reminder and opportunity to update some
NuGet packages. Update all of the `Microsoft.*` NuGet packages
*except* `Microsoft.Xml.SgmlReader`; as mentioned in c936d09, newer
versions of that package have an API break, which prevent us from
trivially bumping the dependency.
Most other `Microsoft.*` NuGet packages are updated to the latest
*non-preview* versions listed on NuGet.org and available on
[dotnet-public][3].
`Microsoft.NET.Test.Sdk` is updated to the *preview* version
17.5.0-preview-20221003-04, because the [current stable 17.3.2][4]
version still references Newtonsoft.Json 9.0.1 for UAP10.0.
I have also sorted the `Microsoft.*` entries in
`Directory.Build.targets`.
One oddity: updating the `Microsoft.NET.Test.Sdk` NuGet package to
17.4.0-preview-20220726-02 or later results in a CS0017!
samples/Hello-Java.Base/Program.cs(15,22):
error CS0017: Program has more than one entry point defined.
Compile with /main to specify the type that contains the entry point.
This is because `Hello-Java.Base.csproj` references
`TestJVM.csproj`, which references `Microsoft.NET.Test.Sdk`, and
more recent versions of the `Microsoft.NET.Test.Sdk` package contain
`buildTransitive/netcoreapp3.1/Microsoft.NET.Test.Sdk.Program.cs`,
which contains a `Main()` method!
[Microsoft.VisualStudio.TestPlatform.TestSDKAutoGeneratedCode]
class AutoGeneratedProgram {static void Main(string[] args){}}
See also microsoft/vstest#4098.
Prevent the CS0017 by setting the [`$(StartupObject)`][5] MSBuild
property to `Hello.App`.
[0]: https://docs.opensource.microsoft.com/tools/cg/
[1]: GHSA-5crp-9r3c-p9vr
[2]: https://www.nuget.org/packages/Microsoft.NET.Test.Sdk/16.11.0
[3]: https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public/nuget/v3/index.json
[4]: https://www.fuget.org/packages/Microsoft.NET.Test.Sdk/17.3.2
[5]: https://learn.microsoft.com/en-us/visualstudio/msbuild/common-msbuild-project-properties?view=vs-2022
0 commit comments