dohertj2/ScadaBridge
1
0
Fork 0
Code Issues 2 Pull Requests 1 Actions Packages Projects Releases Wiki Activity
Files
4715f2f921f0b9dde2fc0a88c3d76e1455baf3e9
ScadaBridge/Directory.Packages.props
T
Joseph Doherty 4715f2f921 chore(deps): raise gRPC stack 2.71.0 -> 2.76.0 (Protobuf 3.34.1) 
Forced by ZB.MOM.WW.LocalDb.Replication 0.1.0, whose nuspec floors
Grpc.AspNetCore / Grpc.Net.Client / Grpc.Core.Api / Grpc.Tools at 2.76.0 and
Google.Protobuf at 3.34.1. Restore fails NU1605 (package downgrade) below that
floor, so LocalDb adoption cannot proceed without it.

Landed as its own commit deliberately. The SQLitePCLRaw note in
Directory.Packages.props deferred precisely this bump as belonging in "their own
reviewed commit - not smuggled in under a SQLite security fix"; this honors that.

Scope kept minimal:
  - Grpc.Core.Api pinned explicitly so the family stays on one version instead
    of floating in transitively.
  - Microsoft.Data.SqlClient and Newtonsoft.Json, also named in that note, are
    NOT bumped - nothing forces them and they carry their own risk profile.

Direct consumer surface is two projects: Grpc.AspNetCore in Host,
Grpc.Net.Client in Communication.

Verified:
  dotnet build ZB.MOM.WW.ScadaBridge.slnx     -> 0 Error(s), 0 Warning(s)
  Communication.Tests                          -> 312 passed, 0 failed
  Transport.IntegrationTests                   -> 103 passed, 0 failed

Claude-Session: https://claude.ai/code/session_01BL2Vu1ESDQ9SCN4gVKkdts
2026-07-19 02:39:11 -04:00

163 lines
10 KiB
XML
Raw Blame History

<Project>
<PropertyGroup>
<ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
</PropertyGroup>
<ItemGroup>
<PackageVersion Include="Akka" Version="1.5.62" />
<PackageVersion Include="Akka.Cluster" Version="1.5.62" />
<PackageVersion Include="Akka.Cluster.Tools" Version="1.5.62" />
<PackageVersion Include="Akka.Remote" Version="1.5.62" />
<PackageVersion Include="Akka.Streams" Version="1.5.62" />
<PackageVersion Include="Akka.Streams.TestKit" Version="1.5.62" />
<PackageVersion Include="Akka.TestKit.Xunit2" Version="1.5.62" />
<PackageVersion Include="bunit" Version="2.0.33-preview" />
<PackageVersion Include="coverlet.collector" Version="6.0.4" />
<PackageVersion Include="FluentAssertions" Version="8.3.0" />
<!--
gRPC stack raised 2.71.0 -> 2.76.0 (Protobuf 3.29.3 -> 3.34.1) on 2026-07-19.
Forced by ZB.MOM.WW.LocalDb.Replication 0.1.0, whose nuspec floors Grpc.AspNetCore,
Grpc.Net.Client, Grpc.Core.Api and Grpc.Tools at 2.76.0 and Google.Protobuf at 3.34.1.
Below that floor restore fails NU1605 (package downgrade), so this is not optional for
LocalDb adoption.
The SQLitePCLRaw note below deferred exactly this bump as belonging in "their own
reviewed commit" rather than smuggled under a security fix - so it IS its own commit.
Direct consumer surface is narrow: Grpc.AspNetCore only in Host, Grpc.Net.Client only
in Communication. Grpc.Core.Api is pinned explicitly here to keep the whole family on
one version rather than letting it float in transitively.
Not bumped here: Microsoft.Data.SqlClient and Newtonsoft.Json, also named in that note.
Nothing forces them, and they are a data-access change with its own risk profile.
-->
<PackageVersion Include="Google.Protobuf" Version="3.34.1" />
<PackageVersion Include="Grpc.AspNetCore" Version="2.76.0" />
<PackageVersion Include="Grpc.Net.Client" Version="2.76.0" />
<PackageVersion Include="Grpc.Core.Api" Version="2.76.0" />
<PackageVersion Include="Grpc.Tools" Version="2.76.0" />
<PackageVersion Include="MailKit" Version="4.16.0" />
<PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.7" />
<PackageVersion Include="Microsoft.AspNetCore.Authorization" Version="10.0.7" />
<PackageVersion Include="Microsoft.AspNetCore.DataProtection" Version="10.0.7" />
<PackageVersion Include="Microsoft.AspNetCore.DataProtection.EntityFrameworkCore" Version="10.0.7" />
<PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.7" />
<PackageVersion Include="Microsoft.AspNetCore.TestHost" Version="10.0.7" />
<PackageVersion Include="Microsoft.AspNetCore.SignalR.Client" Version="9.0.3" />
<PackageVersion Include="Microsoft.CodeAnalysis.CSharp.Scripting" Version="5.0.0" />
<PackageVersion Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="5.0.0" />
<PackageVersion Include="Microsoft.Data.SqlClient" Version="6.0.2" />
<PackageVersion Include="Microsoft.Data.Sqlite" Version="10.0.7" />
<PackageVersion Include="Microsoft.EntityFrameworkCore" Version="10.0.7" />
<PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.7" />
<PackageVersion Include="Microsoft.EntityFrameworkCore.InMemory" Version="10.0.7" />
<PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.7" />
<PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.7" />
<PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="10.0.7" />
<PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.7" />
<PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.7" />
<PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.7" />
<PackageVersion Include="Microsoft.Extensions.Hosting.WindowsServices" Version="10.0.7" />
<PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.7" />
<PackageVersion Include="Microsoft.Extensions.Logging" Version="10.0.7" />
<PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.7" />
<PackageVersion Include="Microsoft.Extensions.Options" Version="10.0.7" />
<PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="10.0.7" />
<PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
<PackageVersion Include="Microsoft.Playwright" Version="1.58.0" />
<PackageVersion Include="Moq" Version="4.20.72" />
<!-- Pinned to the version Akka.NET already pulls transitively (no version-bump ride-along);
used by Commons.Tests contract-lock tests that exercise the Akka default JSON serializer. -->
<PackageVersion Include="Newtonsoft.Json" Version="13.0.3" />
<PackageVersion Include="Novell.Directory.Ldap.NETStandard" Version="3.6.0" />
<PackageVersion Include="NSubstitute" Version="5.3.0" />
<PackageVersion Include="OPCFoundation.NetStandard.Opc.Ua.Client" Version="1.5.378.106" />
<PackageVersion Include="OpenTelemetry.Api" Version="1.15.3" />
<PackageVersion Include="Serilog" Version="4.3.1" />
<PackageVersion Include="Serilog.AspNetCore" Version="10.0.0" />
<PackageVersion Include="Serilog.Sinks.Console" Version="6.1.1" />
<PackageVersion Include="Serilog.Sinks.File" Version="7.0.0" />
<PackageVersion Include="System.CommandLine" Version="2.0.5" />
<PackageVersion Include="System.IdentityModel.Tokens.Jwt" Version="8.11.0" />
<PackageVersion Include="xunit" Version="2.9.3" />
<PackageVersion Include="xunit.runner.visualstudio" Version="3.1.4" />
<!--
Xunit.SkippableFact provides [SkippableFact] + Skip.IfNot/Skip.If for
xunit v2. The native Skip API (Assert.Skip / Assert.SkipUnless /
Assert.SkipWhen) only exists in xunit v3; xunit 2.9.x lacks it. Used by
Bundle C MSSQL integration tests in ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.Tests
to mark tests as Skipped (not silently Passed) when MSSQL is unreachable.
-->
<PackageVersion Include="Xunit.SkippableFact" Version="1.5.61" />
<PackageVersion Include="ZB.MOM.WW.Health" Version="0.1.0" />
<PackageVersion Include="ZB.MOM.WW.Health.Akka" Version="0.1.0" />
<PackageVersion Include="ZB.MOM.WW.Health.EntityFrameworkCore" Version="0.1.0" />
<PackageVersion Include="ZB.MOM.WW.Telemetry" Version="0.1.0" />
<PackageVersion Include="ZB.MOM.WW.Telemetry.Serilog" Version="0.1.0" />
<PackageVersion Include="ZB.MOM.WW.MxGateway.Client" Version="0.1.1" />
<PackageVersion Include="ZB.MOM.WW.MxGateway.Contracts" Version="0.1.1" />
<PackageVersion Include="ZB.MOM.WW.Configuration" Version="0.1.0" />
<PackageVersion Include="ZB.MOM.WW.Auth.Abstractions" Version="0.1.5" />
<PackageVersion Include="ZB.MOM.WW.Auth.Ldap" Version="0.1.5" />
<PackageVersion Include="ZB.MOM.WW.Auth.ApiKeys" Version="0.1.5" />
<PackageVersion Include="ZB.MOM.WW.Auth.AspNetCore" Version="0.1.5" />
<PackageVersion Include="ZB.MOM.WW.Audit" Version="0.1.0" />
<PackageVersion Include="ZB.MOM.WW.Theme" Version="0.3.1" />
<PackageVersion Include="ZB.MOM.WW.Secrets" Version="0.2.3" />
<PackageVersion Include="ZB.MOM.WW.Secrets.Abstractions" Version="0.2.3" />
<PackageVersion Include="ZB.MOM.WW.Secrets.Ui" Version="0.2.3" />
<PackageVersion Include="ZB.MOM.WW.Secrets.Replicator.SqlServer" Version="0.2.3" />
</ItemGroup>
<!--
GHSA-2m69-gcr7-jv3q (NU1903, high) is on the NATIVE library SQLitePCLRaw.lib.e_sqlite3
2.1.11, pulled in TRANSITIVELY by Microsoft.Data.Sqlite / EntityFrameworkCore.Sqlite.
FIXED PROPERLY 2026-07-18, replacing a NuGetAuditSuppress that had been masking it. The
suppression's stated rationale — "the only patched native lib is the SQLitePCLRaw 3.x line" —
was WRONG: 2.1.12 patches this advisory within the 2.1.x line, so no risky force-override of
the whole family to 3.x is needed. Verified empirically: with the suppression removed and the
pin in place, a forced restore reports no NU1903.
Why the pin and not a Microsoft.Data.Sqlite bump: bumping Sqlite does NOT clear it (even
10.0.10 still references 2.1.11). Pinning the native lib is the fix. Same approach as
ZB.MOM.WW.Secrets and ZB.MOM.WW.LocalDb.
Why this mattered more than it looked: only the Host project resolved a patched 2.1.12 (via
ZB.MOM.WW.Auth.ApiKeys). AuditLog, SiteEventLogging, SiteRuntime, StoreAndForward and the
test projects — the whole site-local SQLite layer — were still resolving the vulnerable
2.1.11, and the suppression hid that everywhere.
Delivered as an explicit <PackageReference> in each SQLite-consuming project rather than via
CentralPackageTransitivePinningEnabled. Enabling transitive pinning globally was tried first
and rejected: it makes every centrally-defined version a hard ceiling for transitive
resolution too, which immediately demanded bumps to Google.Protobuf (3.29.3->3.34.1),
Grpc.Net.Client (2.71.0->2.76.0), Microsoft.Data.SqlClient (6.0.2->6.1.1) and Newtonsoft.Json
(13.0.3->13.0.4). Those may well be worth doing, but they are a gRPC/data-access change to a
production SCADA platform and belong in their own reviewed commit — not smuggled in under a
SQLite security fix.
-->
<ItemGroup>
<PackageVersion Include="SQLitePCLRaw.lib.e_sqlite3" Version="2.1.12" />
</ItemGroup>
<!--
GHSA-pgww-w46g-26qg (NU1902, moderate) is on AngleSharp 1.1.1, pulled in TRANSITIVELY by
bunit into ZB.MOM.WW.ScadaBridge.CentralUI.Tests. With TreatWarningsAsErrors this made the
WHOLE SOLUTION BUILD RED — `dotnet build ZB.MOM.WW.ScadaBridge.slnx` failed on clean main,
so no test suite could run and every "0 warnings / suite green" gate was unverifiable.
Fixed the same way HistorianGateway fixed the identical break (historiangw @ 6bc005d):
an explicit test-only pin to a patched AngleSharp. TEST-ONLY — AngleSharp is a bunit
(HTML-parsing) dependency and reaches no production project, so this cannot affect runtime.
Do not "fix" this by bumping bunit: 2.0.33-preview is the current preview line and still
resolves the vulnerable AngleSharp transitively. Pinning the leaf is the fix.
-->
<ItemGroup>
<PackageVersion Include="AngleSharp" Version="1.5.2" />
</ItemGroup>
</Project>
Reference in New Issue View Git Blame Copy Permalink