Skip to content

Commit d44116e

Browse files
ViktorHoferViktorHofer
authored
Use current STJ in HostModel and remove unnecessary audit suppressions (#109852)
* Use current STJ in HostModel and remove unnecessary audit suppressions Fixes #108262 * Remove unnecessary nuget audit suppressions * Remove SetConfiguration from ProjectReference
1 parent d257079 commit d44116e

File tree

10 files changed

+6
-51
lines changed

10 files changed

+6
-51
lines changed

‎src/installer/managed/Microsoft.NET.HostModel/Microsoft.NET.HostModel.csproj‎

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -21,14 +21,9 @@
2121
<ItemGroup>
2222
<!-- SDK pins this to a lower version https://github.com/dotnet/sdk/issues/43325 -->
2323
<PackageReference Include="System.Reflection.Metadata" Version="$(SystemReflectionMetadataToolsetVersion)" />
24-
<!-- The SDK distributes the live version of Json we can't reference that https://github.com/dotnet/runtime/issues/108262 -->
25-
<PackageReference Include="System.Text.Json" Version="$(SystemTextJsonToolsetVersion)" />
2624
<PackageReference Include="System.Memory" Version="$(SystemMemoryVersion)" />
27-
</ItemGroup>
2825

29-
<!-- Suppress System.Text.Json/8.0.4 advisory as desktop msbuild doesn't yet provide binding redirects for the non-vulnerable version (8.0.5). -->
30-
<ItemGroup>
31-
<NuGetAuditSuppress Include="https://github.com/advisories/GHSA-8g4q-xg66-9fp4" />
26+
<ProjectReference Include="$(LibrariesProjectRoot)System.Text.Json\src\System.Text.Json.csproj" />
3227
</ItemGroup>
3328

3429
<ItemGroup>

‎src/installer/tests/AppHost.Bundle.Tests/AppHost.Bundle.Tests.csproj‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,4 @@
1414
<ProjectReference Include="..\..\managed\Microsoft.NET.HostModel\Microsoft.NET.HostModel.csproj" />
1515
</ItemGroup>
1616

17-
<!-- Suppress System.Text.Json/8.0.4 advisory as desktop msbuild doesn't yet provide binding redirects for the non-vulnerable version (8.0.5). -->
18-
<ItemGroup>
19-
<NuGetAuditSuppress Include="https://github.com/advisories/GHSA-8g4q-xg66-9fp4" />
20-
</ItemGroup>
21-
2217
</Project>

‎src/installer/tests/HostActivation.Tests/HostActivation.Tests.csproj‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,4 @@
1313
<ProjectReference Include="..\..\managed\Microsoft.NET.HostModel\Microsoft.NET.HostModel.csproj" />
1414
</ItemGroup>
1515

16-
<!-- Suppress System.Text.Json/8.0.4 advisory as desktop msbuild doesn't yet provide binding redirects for the non-vulnerable version (8.0.5). -->
17-
<ItemGroup>
18-
<NuGetAuditSuppress Include="https://github.com/advisories/GHSA-8g4q-xg66-9fp4" />
19-
</ItemGroup>
20-
2116
</Project>

‎src/installer/tests/Microsoft.DotNet.CoreSetup.Packaging.Tests/Microsoft.DotNet.CoreSetup.Packaging.Tests.csproj‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -32,11 +32,6 @@
3232
BuildInParallel="$(BuildInParallel)" />
3333
</Target>
3434

35-
<!-- Suppress System.Text.Json/8.0.4 advisory as desktop msbuild doesn't yet provide binding redirects for the non-vulnerable version (8.0.5). -->
36-
<ItemGroup>
37-
<NuGetAuditSuppress Include="https://github.com/advisories/GHSA-8g4q-xg66-9fp4" />
38-
</ItemGroup>
39-
4035
<Import Project="$(RepositoryEngineeringDir)PackageDownloadAndReference.targets" />
4136

4237
</Project>

‎src/installer/tests/Microsoft.NET.HostModel.Tests/Microsoft.NET.HostModel.Tests.csproj‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -13,11 +13,6 @@
1313
<ProjectReference Include="..\..\managed\Microsoft.NET.HostModel\Microsoft.NET.HostModel.csproj" />
1414
</ItemGroup>
1515

16-
<!-- Suppress System.Text.Json/8.0.4 advisory as desktop msbuild doesn't yet provide binding redirects for the non-vulnerable version (8.0.5). -->
17-
<ItemGroup>
18-
<NuGetAuditSuppress Include="https://github.com/advisories/GHSA-8g4q-xg66-9fp4" />
19-
</ItemGroup>
20-
2116
<ItemGroup>
2217
<PackageReference Include="Microsoft.NET.HostModel.TestData" Version="$(MicrosoftNETHostModelTestDataVersion)" />
2318
</ItemGroup>

‎src/installer/tests/TestUtils/TestUtils.csproj‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -11,11 +11,6 @@
1111
<ProjectReference Include="..\..\managed\Microsoft.NET.HostModel\Microsoft.NET.HostModel.csproj" />
1212
</ItemGroup>
1313

14-
<!-- Suppress System.Text.Json/8.0.4 advisory as desktop msbuild doesn't yet provide binding redirects for the non-vulnerable version (8.0.5). -->
15-
<ItemGroup>
16-
<NuGetAuditSuppress Include="https://github.com/advisories/GHSA-8g4q-xg66-9fp4" />
17-
</ItemGroup>
18-
1914
<ItemGroup>
2015
<PackageReference Include="FluentAssertions" Version="$(FluentAssertionsVersion)" />
2116
<PackageReference Include="Microsoft.DotNet.XUnitExtensions" Version="$(MicrosoftDotNetXUnitExtensionsVersion)" />

‎src/libraries/Microsoft.Extensions.DependencyInjection/tests/DI.External.Tests/Microsoft.Extensions.DependencyInjection.ExternalContainers.Tests.csproj‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323
<PackageReference Include="LightInject.Microsoft.DependencyInjection" Version="3.7.1" />
2424
<PackageReference Include="Grace.DependencyInjection.Extensions" Version="7.1.0" />
2525
<PackageReference Include="Stashbox.Extensions.Dependencyinjection" Version="4.2.3" />
26+
<!-- Update the transitive STJ to a non-vulnerable version. -->
2627
<PackageReference Include="System.Text.Json" Version="$(SystemTextJsonVersion)" />
2728
</ItemGroup>
2829

‎src/mono/wasm/Wasm.Build.Tests/Wasm.Build.Tests.csproj‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,8 @@
4848
<ItemGroup>
4949
<PackageReference Include="Microsoft.Playwright" Version="1.47.0" />
5050
<PackageReference Include="MSBuild.StructuredLogger" Version="2.2.350" />
51-
<PackageReference Include="System.Text.Json" Version="$(SystemTextJsonToolsetVersion)" />
51+
<!-- Update the transitive STJ to a non-vulnerable version. -->
52+
<PackageReference Include="System.Text.Json" Version="$(SystemTextJsonVersion)" />
5253
<ProjectReference Include="$(RepoRoot)src\tasks\Microsoft.NET.Sdk.WebAssembly.Pack.Tasks\Microsoft.NET.Sdk.WebAssembly.Pack.Tasks.csproj" />
5354
<Compile Include="$(BrowserProjectRoot)debugger\DebuggerTestSuite\BrowserLocator.cs" />
5455

@@ -57,11 +58,6 @@
5758
<None Include="data\**\*" Link="data\%(RecursiveDir)%(FileName)%(Extension)" CopyToOutputDirectory="PreserveNewest" />
5859
</ItemGroup>
5960

60-
<!-- Suppress System.Text.Json/8.0.4 advisory as desktop msbuild doesn't yet provide binding redirects for the non-vulnerable version (8.0.5). -->
61-
<ItemGroup>
62-
<NuGetAuditSuppress Include="https://github.com/advisories/GHSA-8g4q-xg66-9fp4" />
63-
</ItemGroup>
64-
6561
<Target Name="UpdateRunScriptCommands" BeforeTargets="GenerateRunScript" DependsOnTargets="_SetPackageVersionForWorkloadsTesting">
6662
<Error Condition="'$(TestUsingWorkloads)' == 'true' and '$(PackageVersionForWorkloadManifests)' == ''" Text="%24(PackageVersionForWorkloadManifests) is not set. PackageVersion=$(PackageVersion)." />
6763

‎src/mono/wasm/symbolicator/WasmSymbolicator.csproj‎

Lines changed: 1 addition & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,14 @@
11
<Project Sdk="Microsoft.NET.Sdk">
22

33
<PropertyGroup>
4-
<OutputType>Exe</OutputType>
54
<TargetFramework>$(NetCoreAppToolCurrent)</TargetFramework>
5+
<OutputType>Exe</OutputType>
66
<ImplicitUsings>enable</ImplicitUsings>
77
<Nullable>enable</Nullable>
88
</PropertyGroup>
99

1010
<ItemGroup>
1111
<PackageReference Include="Microsoft.DotNet.XHarness.Common" Version="$(MicrosoftDotNetXHarnessTestRunnersCommonVersion)" />
12-
<!-- Update and drop package assets from Json, we'll use the framework version -->
13-
<PackageReference Include="System.Text.Json" Version="$(SystemTextJsonToolsetVersion)" PrivateAssets="All" ExcludeAssets="All" />
14-
</ItemGroup>
15-
16-
<!-- Suppress System.Text.Json/8.0.4 advisory as desktop msbuild doesn't yet provide binding redirects for the non-vulnerable version (8.0.5). -->
17-
<ItemGroup>
18-
<NuGetAuditSuppress Include="https://github.com/advisories/GHSA-8g4q-xg66-9fp4" />
1912
</ItemGroup>
2013

2114
<ItemGroup>

‎src/tasks/Directory.Build.targets‎

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -16,12 +16,7 @@
1616
<ItemGroup Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net462'))">
1717
<!-- These assemblies and their dependencies are made available by MSBuild on .NET Framework -->
1818
<PackageReference Include="System.Reflection.Metadata" Version="$(SystemReflectionMetadataToolsetVersion)" ExcludeAssets="Runtime" PrivateAssets="All" />
19-
<PackageReference Include="System.Text.Json" Version="$(SystemTextJsonToolsetVersion)" ExcludeAssets="Runtime" PrivateAssets="All" />
20-
</ItemGroup>
21-
22-
<!-- Suppress System.Text.Json/8.0.4 advisory as desktop msbuild doesn't yet provide binding redirects for the non-vulnerable version (8.0.5). -->
23-
<ItemGroup>
24-
<NuGetAuditSuppress Include="https://github.com/advisories/GHSA-8g4q-xg66-9fp4" />
19+
<PackageReference Include="System.Text.Json" Version="$(SystemTextJsonToolsetVersion)" ExcludeAssets="Runtime" PrivateAssets="All" NoWarn="NU1903" />
2520
</ItemGroup>
2621

2722
<Import Project="$(RepositoryEngineeringDir)PackageDownloadAndReference.targets" />

0 commit comments

Comments
 (0)