Microsoft.AspNetCore.Mvc.Core 1.1.5 depends on a non-existent NuGet Package

[dperschonok]

The NuGet package for Microsoft.AspNetCore.Mvc.Core v1.1.5 depends on Microsoft.Extensions.DependencyModel (>= 1.1.4-servicing-001653) which doesn't exist as a NuGet package. This causes a 2.x version of the library to be pulled in instead. Shouldn't this be resolved to reference a proper 1.1.x package instead?

[pranavkm]

@dperschonok we're aware of this issue and we're working on producing a new build of Mvc that rolls back the dependency to the 1.1.2 version of Microsoft.Extensions.DependencyModel. In the meanwhile, we verified that using the 2.0.0-* version of the package in an 1.1.x application does not affect runtime behavior. We'll create a new announcement once updated builds of Mvc are available.

[Eilon]

Assigning to @muratg so he can close when the packages go up to NuGet.org.

[sobanieca]

+1 I'm also blocked on fixing the CORS vulnerability now (aspnet/Announcements#279). Waiting for the 1.1.4 stable version to be released (or downgrade to 1.1.2).

[muratg]

This is done.

[pranavkm]

@muratg could you respond to the announcement (#7054) or file a new one? Presumably we want folks to upgrade to this new version.

[muratg]

@blowdart Do you want to update the main text of the announcement, putting a note for the release, and updating the version numbers?

[blowdart]

Tell me what the versions now need to be and I'll update the issue.