Skip to content

Commit 659ac71

Browse files
jonpryorjonpryor
committed
[build] Update more NuGet package versions
Context: https://dev.azure.com/devdiv/DevDiv/_componentGovernance/112013/alert/2979569?typeId=6338203 [Component Governance][0] is a Microsoft internal tool which checks for known security issues in product dependencies. It is currently reporting a defect in Xamarin.Android because Java.Interop restores the `System.Net.Http` v4.1.0 NuGet package, which contains security vulnerability [CVE-2018-8292][1]: /s/xamarin-android/external/Java.Interop/packages/system.net.http/4.1.0/system.net.http.4.1.0.nupkg /s/xamarin-android/external/Java.Interop/packages/system.net.http/4.1.0/system.net.http.nuspec `System.Net.Http` v4.1.0 isn't actually *used* by Java.Interop or Xamarin.Android, it's just an implicit NuGet dependency of one of the various NuGet packages which Java.Interop relies on. The report is "noise". That said, we should still remove "noise" when possible. Update most NuGet package versions within Java.Interop to the latest versions provided by `dotnet-public` or `dotnet-eng` (which may not be the latest versions on NuGet.org). Exceptions: * `Microsoft.Xml.SgmlReader` is not bumped, as the latest version introduced an ABI break. * `Microsoft.CodeAnalysis.FxCopAnalyzers` v3.3.2 deprecated the entire package, introducing additional warnings that I didn't want to deal with right now. * `protobuf-net` is still not updated, as the latest version causes unit test failures; see also PR dotnet#878. In order to better "centralize" NuGet package version information, instead of having multiple `%(PackageReference.Version)` values strewn throughout the codebase, instead have `.csproj` files contain `@(PackageReference)`s that *don't* contain `%(PackageReference.Version)`, and instead use [`%(Update)`][2] within `Directory.Build.targets` to provide the actual package version: <!-- .csproj --> <PackageReference Include="Example" /> <!-- Directory.Build.targets --> <PackageReference Update="Example" Version="1.0.0" /> This pattern requires that there be no "intervening" `Directory.Build.targets` between the `.csproj` and the root directory; see also the [MSBuild Customize your build][3] documentation. Rename the existing `Directory.Build.targets` files to instead use explicit `<Import/>`s against a newly added `.targets` file; conceptually reverts part of d70e40f and later commits which use `Directory.Build.targets`. [0]: https://docs.opensource.microsoft.com/tools/cg/ [1]: https://nvd.nist.gov/vuln/detail/CVE-2018-8292 [2]: https://docs.microsoft.com/en-us/visualstudio/msbuild/item-element-msbuild?view=vs-2019#attributes-and-elements [3]: https://docs.microsoft.com/en-us/visualstudio/msbuild/customize-your-build?view=vs-2019#directorybuildprops-and-directorybuildtargets
1 parent 3f12cd2 commit 659ac71

File tree

43 files changed

+152
-147
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

43 files changed

+152
-147
lines changed

‎Directory.Build.props‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -94,12 +94,4 @@
9494
<NoWarn>$(NoWarn);CA1307;CA1309;CA1310</NoWarn>
9595
</PropertyGroup>
9696

97-
<!-- Add Roslyn analyzers NuGet to all projects -->
98-
<ItemGroup Condition=" '$(DisableRoslynAnalyzers)' != 'True' ">
99-
<PackageReference Include="Microsoft.CodeAnalysis.FxCopAnalyzers" Version="3.3.0">
100-
<PrivateAssets>all</PrivateAssets>
101-
<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
102-
</PackageReference>
103-
</ItemGroup>
104-
10597
</Project>

‎Directory.Build.targets‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project>
3+
4+
<!-- Add Roslyn analyzers NuGet to all projects -->
5+
<ItemGroup Condition=" '$(DisableRoslynAnalyzers)' != 'True' ">
6+
<PackageReference Include="Microsoft.CodeAnalysis.FxCopAnalyzers" Version="3.3.0">
7+
<PrivateAssets>all</PrivateAssets>
8+
<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
9+
</PackageReference>
10+
</ItemGroup>
11+
12+
<!-- NuGet Dependencies -->
13+
<ItemGroup>
14+
<PackageReference Update="Microsoft.Xml.SgmlReader" Version="1.8.16" />
15+
<PackageReference Update="GitInfo" Version="2.1.2" />
16+
<PackageReference Update="HtmlAgilityPack" Version="1.11.30" />
17+
<PackageReference Update="Irony" Version="1.1.0" />
18+
<PackageReference Update="Microsoft.Build.Framework" Version="16.11.0" />
19+
<PackageReference Update="Microsoft.Build.Utilities.Core" Version="16.11.0" />
20+
<PackageReference Update="Microsoft.CodeAnalysis.CSharp" Version="3.11.0" />
21+
<PackageReference Update="Microsoft.NET.Test.Sdk" Version="16.11.0" />
22+
<PackageReference Update="Microsoft.NETFramework.ReferenceAssemblies" Version="1.0.2" />
23+
<PackageReference Update="Mono.CSharp" Version="4.0.0.143" />
24+
<PackageReference Update="Mono.Linq.Expressions" Version="2.0.0" />
25+
<PackageReference Update="Mono.Options" Version="6.12.0.148" />
26+
<PackageReference Update="Mono.Terminal" Version="5.4.2" />
27+
<PackageReference Update="nunit" Version="3.13.2" />
28+
<PackageReference Update="NUnit.ConsoleRunner" Version="3.12.0" />
29+
<PackageReference Update="NUnit3TestAdapter" Version="4.0.0">
30+
<PrivateAssets>all</PrivateAssets>
31+
<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
32+
</PackageReference>
33+
<PackageReference Update="protobuf-net" Version="2.4.4" />
34+
<PackageReference Update="XliffTasks" Version="1.0.0-beta.20420.1" />
35+
</ItemGroup>
36+
37+
</Project>

‎build-tools/Java.Interop.BootstrapTasks/Java.Interop.BootstrapTasks.csproj‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@
77
</PropertyGroup>
88

99
<ItemGroup>
10-
<PackageReference Include="Microsoft.Build.Framework" Version="16.5.0" />
11-
<PackageReference Include="Microsoft.Build.Utilities.Core" Version="16.5.0" />
10+
<PackageReference Include="Microsoft.Build.Framework" />
11+
<PackageReference Include="Microsoft.Build.Utilities.Core" />
1212
</ItemGroup>
1313

1414
<ItemGroup>

‎build-tools/jnienv-gen/jnienv-gen.csproj‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,6 @@
1212
</PropertyGroup>
1313

1414
<ItemGroup>
15-
<PackageReference Include="Microsoft.NETFramework.ReferenceAssemblies" PrivateAssets="All" Version="1.0.0" />
15+
<PackageReference Include="Microsoft.NETFramework.ReferenceAssemblies" PrivateAssets="All" />
1616
</ItemGroup>
1717
</Project>

‎build-tools/scripts/RunNUnitTests.targets‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
<_TopDir>$(MSBuildThisFileDirectory)..\..</_TopDir>
66
<_Runtime Condition=" '$(RUNTIME)' != '' ">$(RUNTIME)</_Runtime>
77
<_Runtime Condition=" '$(RUNTIME)' == '' And '$(OS)' != 'Windows_NT' ">mono --debug</_Runtime>
8-
<_NUnit>$(_Runtime) packages\nunit.consolerunner\3.11.1\tools\nunit3-console.exe</_NUnit>
8+
<_NUnit>$(_Runtime) packages\nunit.consolerunner\3.12.0\tools\nunit3-console.exe</_NUnit>
99
<_Run Condition=" '$(RUN)' != '' ">--run=&quot;$(RUN)&quot;</_Run>
1010
</PropertyGroup>
1111
<Import

‎build-tools/scripts/VersionInfo.targets‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
<GitThisAssembly>false</GitThisAssembly>
99
</PropertyGroup>
1010
<ItemGroup>
11-
<PackageReference Include="GitInfo" Version="2.1.2" PrivateAssets="all" />
11+
<PackageReference Include="GitInfo" PrivateAssets="all" />
1212
</ItemGroup>
1313

1414
<Target Name="GenerateVersionInfo"

‎samples/Hello/Hello.csproj‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
</PropertyGroup>
1313

1414
<ItemGroup>
15-
<PackageReference Include="Microsoft.NETFramework.ReferenceAssemblies" PrivateAssets="All" Version="1.0.0" />
15+
<PackageReference Include="Microsoft.NETFramework.ReferenceAssemblies" PrivateAssets="All" />
1616
</ItemGroup>
1717

1818
<ItemGroup>

‎src/Java.Interop.Localization/Java.Interop.Localization.csproj‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
</PropertyGroup>
1212

1313
<ItemGroup>
14-
<PackageReference Include="XliffTasks" Version="1.0.0-beta.20420.1" />
14+
<PackageReference Include="XliffTasks" />
1515
</ItemGroup>
1616

1717
<ItemGroup>

‎src/Java.Interop.Tools.JavaSource/Java.Interop.Tools.JavaSource.csproj‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
<Compile Include="..\utils\NullableAttributes.cs" />
1616
</ItemGroup>
1717
<ItemGroup>
18-
<PackageReference Include="Irony" Version="1.1.0" />
18+
<PackageReference Include="Irony" />
1919
</ItemGroup>
2020
<ItemGroup>
2121
<ProjectReference Include="..\Xamarin.Android.Tools.ApiXmlAdjuster\Xamarin.Android.Tools.ApiXmlAdjuster.csproj" />

‎src/Java.Interop/Java.Interop-MonoAndroid.csproj‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@
8383
<Private>False</Private>
8484
</Reference>
8585
</ItemGroup>
86-
<Import Project="Directory.Build.targets" />
86+
<Import Project="Java.Interop.targets" />
8787
<PropertyGroup>
8888
<BuildDependsOn>
8989
BuildJniEnvironment_g_cs;

0 commit comments

Comments
 (0)