Repository navigation
fix(deps): resolve .NET 10 packages to 10.0.13 for the October advisories - #1290
Merged
Merged
Conversation
…ries Microsoft published four high-severity denial-of-service advisories on 2026-10-13 against System.Security.Cryptography.Pkcs and .Xml up to 10.0.12: GHSA-846f-f764-76mx, GHSA-r955-8q5j-3h83, GHSA-7hqp-7c5m-4vq6 and GHSA-c399-9853-6jmj. The #146 NuGet gate fails every build on main. The lock files re-resolve only the 10.0.12 -> 10.0.13 servicing line. The other floating ranges stay at their current versions, so the FluentValidation, StackExchange.Redis and test SDK minors wait for the normal Dependabot group.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
On 2026-10-13 Microsoft published four high-severity denial-of-service advisories against
System.Security.Cryptography.PkcsandSystem.Security.Cryptography.Xmlthrough 10.0.12. Since then, the #146 NuGet gate (Build, audit and schema docs) fails onmainand on every PR, the release PR #1133 included. Example: run 38491831246.Change
The diff touches lock files only. Every
10.0.12entry now resolves to10.0.13, and nothing else changes.Directory.Packages.propsstays the same.A plain
--force-evaluatewould also have bumped FluentValidation (12.1.1 → 12.2.0), StackExchange.Redis (3.3.1 → 3.4.5) and the test SDK. This PR keeps them at their current versions, so they arrive later through the usual Dependabot group.The AppHost and AppHost.Tests lock files still contain some
Microsoft.Extensions.*packages at 10.0.12, because Aspire 13.6.1's dependencies pin them there.System.IO.Hashingalso stays at 10.0.12. Neither is an advisory package, and the gate reports no findings for them. The mix of versions is deliberate.Verification
dotnet restore Cluckwork.slnx --locked-mode: clean.dotnet list package --vulnerable … | vuln-gate.mjs --level high):no advisories at or above "high".dotnet build: 0 errors.After this merges, #1133 needs a rebase or re-run to go green.