Solution build fails on main: NU1903 advisory on Microsoft.DotNet.ILCompiler 10.0.5 (DelmiaNotifier) #82
Assignees
dohertj2 (dohertj2)
Clear assignees
dohertj2 (dohertj2)
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: dohertj2/ScadaBridge#82
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
dotnet build ZB.MOM.WW.ScadaBridge.slnxonmain(0e89966d/a5c3de63) fails restore with NU1903, a vulnerability advisory againstMicrosoft.DotNet.ILCompiler10.0.5 pulled in by the DelmiaNotifier (AOT) project; warnings are treated as errors. Found while working #58; that work built with the advisory downgraded locally. Fix: move to a patched .NET 10 SDK/ILCompiler (or pin a patched version). Do not suppress the advisory.Diagnosis: the repo has no
global.json. The Mac's Homebrew SDK is 10.0.105, which bundles runtime and ILCompiler 10.0.5; nuget.org has ILCompiler up to 10.0.14, and Homebrew offers SDK 10.0.403. This is environment drift, not a repo pin. Fix: upgrade the dev and CI SDKs (Homebrewdotnet, and the Gitea runner image). Optionally add aglobal.jsonwithrollForward: latestFeatureand a minimum patched SDK so the requirement is explicit. The same advisory class also broke old historiangwmain(System.Security.Cryptography.Pkcs).Fixed 2026-11-06 by upgrading the dev Mac's Homebrew SDK from 10.0.105 to 10.0.403 (runtime 10.0.14).
dotnet build ZB.MOM.WW.ScadaBridge.slnxnow succeeds with 0 warnings and 0 errors, without suppressing the advisory. ScadaBridge has no.gitea/workflows, so there is no CI image to update.