Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade TestFramework System.Text.Json reference to 6.0.10 for net462 target #972

Merged
merged 1 commit into from
Oct 13, 2024

Conversation

paulirwin
Copy link
Contributor

  • You've read the Contributor Guide and Code of Conduct.
  • You've included unit or integration tests for your change, where applicable.
  • You've included inline docs for your change, where applicable.
  • There's an open issue for the PR that you are making. If you'd like to propose a change, please open an issue to discuss the change or find an existing issue.

Upgrades System.Text.Json to 6.0.10 for net462 due to 6.0.6 advisory: GHSA-8g4q-xg66-9fp4

Copy link
Contributor

@NightOwl888 NightOwl888 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, let's do this only once for the release instead of upgrading dependencies one at a time and verifying compatibility each time. Since we will be bringing in new dependencies that may have transitive conflicts, we should wait until after J2N and ICU4N are integrated before upgrading the dependencies.

Also, it is important to test dependency changes on Azure DevOps because only that pipeline publishes the entire solution to a single directory. If there are conflicts because of transitive dependencies, those tests may fail, but the GitHub Actions workflows won't fail because they don't integration test all of the projects together.

According to Visual Studio Package Manager, the following dependencies are all deprecated, so we will also need to upgrade (or downgrade) them to a supported version.

  • Microsoft.AspNetCore.Http.Abstractions 2.0.0
  • Microsoft.AspNetCore.TestHost 5.0.0
  • Microsoft.Extensions.DependencyInjection 2.0.0

There are also several other packages we are not using the latest version of that we should look into.

In theory, we should be using the lowest supported version to give users the option to use what we specify or upgrade. But, in practice many of these can probably be upgraded to the 6.x generation or higher now.

@paulirwin paulirwin changed the base branch from master to 4.8.0-beta00017-deps October 13, 2024 15:17
@paulirwin paulirwin merged commit be698af into apache:4.8.0-beta00017-deps Oct 13, 2024
168 of 200 checks passed
@paulirwin paulirwin deleted the fix/stj-cve branch October 13, 2024 15:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants