Commit 12d754d
committed
[build] Update NuGet package versions
Context: https://dev.azure.com/xamarin/public/_componentGovernance/115226/alert/3150206?typeId=5477311
Context: https://dev.azure.com/xamarin/public/_componentGovernance/115226/alert/6875331?typeId=5477311
Context: dotnet/java-interop@5318261
[Component Governance][0] is a Microsoft internal tool which checks
for known security issues in product dependencies. It is currently
reporting a defects in xamarin-android-tools due to use of older
`System.Net.Http` packages (]CVE-2018-8292][0]) and older
`System.Security.Cryptography.X509Certificates`
packages ([CVE-2017-11770][1]):
> **Location**
>
> * /s/packages/system.net.http/4.1.0/system.net.http.4.1.0.nupkg
> * /s/packages/system.net.http/4.1.0/system.net.http.nuspec
> * /s/packages/system.security.cryptography.x509certificates/4.1.0/system.security.cryptography.x509certificates.4.1.0.nupkg
> * /s/packages/system.security.cryptography.x509certificates/4.1.0/system.security.cryptography.x509certificates.nuspec
The "odd" thing is that xamarin-android-tools doesn't *use* either
of these dependencies! They appear to be pulled in via package
dependencies.
Rework how we use `@(PackageReference)` so that
`Directory.Build.targets` uses [the `Update` attribute][2] to
centralize package version specification, except within
`MSBuildReferences.projitems` as it's `<Import/>`ed by xamarin-android.
Update most NuGet package versions to the latest versions provided by
`dotnet-public` or `dotnet-eng` (which may not be the latest versions
on NuGet.org).
While stable versions are generally preferred, we use
Microsoft.NET.Test.Sdk version 17.5.0-preview-20221003-04 to ensure
that we avoid Newtonsoft.Json 9.0.1 issues a'la
dotnet/java-interop@53182615.
[0]: https://nvd.nist.gov/vuln/detail/CVE-2018-8292
[1]: https://nvd.nist.gov/vuln/detail/CVE-2017-11770
[2]: https://learn.microsoft.com/en-us/visualstudio/msbuild/item-element-msbuild?view=vs-2022#attributes-and-elements1 parent 59cac90 commit 12d754d
File tree
5 files changed
+14
-9
lines changed- src
- Microsoft.Android.Build.BaseTasks
- Xamarin.Android.Tools.AndroidSdk
- tests
- Microsoft.Android.Build.BaseTasks-Tests
- Xamarin.Android.Tools.AndroidSdk-Tests
5 files changed
+14
-9
lines changed| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
19 | 19 | | |
20 | 20 | | |
21 | 21 | | |
| 22 | + | |
22 | 23 | | |
23 | | - | |
| 24 | + | |
| 25 | + | |
| 26 | + | |
| 27 | + | |
| 28 | + | |
24 | 29 | | |
25 | 30 | | |
26 | 31 | | |
Lines changed: 1 addition & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
4 | 4 | | |
5 | 5 | | |
6 | 6 | | |
7 | | - | |
| 7 | + | |
8 | 8 | | |
9 | 9 | | |
10 | 10 | | |
| |||
Lines changed: 1 addition & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
26 | 26 | | |
27 | 27 | | |
28 | 28 | | |
29 | | - | |
| 29 | + | |
30 | 30 | | |
31 | 31 | | |
32 | 32 | | |
| |||
Lines changed: 3 additions & 3 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
14 | 14 | | |
15 | 15 | | |
16 | 16 | | |
17 | | - | |
18 | | - | |
19 | | - | |
| 17 | + | |
| 18 | + | |
| 19 | + | |
20 | 20 | | |
21 | 21 | | |
22 | 22 | | |
| |||
Lines changed: 3 additions & 3 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
13 | 13 | | |
14 | 14 | | |
15 | 15 | | |
16 | | - | |
17 | | - | |
18 | | - | |
| 16 | + | |
| 17 | + | |
| 18 | + | |
19 | 19 | | |
20 | 20 | | |
21 | 21 | | |
| |||
0 commit comments