Joseph Doherty
0de1352e55
Four NU1903 high-severity advisories (GHSA-23rf-6693-g89p, GHSA-8q5v-6pqq-x66h, GHSA-cvvh-rhrc-wg4q, GHSA-g8r8-53c2-pm3f) landed in the NuGet audit data against System.Security.Cryptography.Xml 10.0.7, which Microsoft.AspNetCore.DataProtection 10.0.7 pulls in transitively for key storage. Under TreatWarningsAsErrors a fresh restore produces 204 NU1903 errors and the solution does not build at all. This was invisible locally: machines with cached audit data keep building, so the break only shows on a clean clone or a docker image build. It surfaced here by accident — a detached worktree at the pre-change baseline, created to check whether a flaky test predated today's work, could not restore. Worth noting that the diagnostic path was the accident, not the intent: nothing in the normal build or test loop would have reported this before someone else hit it. Same surgical-pin pattern as the SQLitePCLRaw entry directly above it: a direct PackageReference at the one project where the chain enters the repo (Core.Configuration), rather than CentralPackageTransitivePinningEnabled, which this repo already documents as breaking the Roslyn version split. Bumping the DataProtection parent to 10.0.10 instead was rejected for the reason the sister repo recorded when it hit the same advisories: 10.0.10 floors Microsoft.Extensions.* and, via the EFCore adapter, Microsoft.EntityFrameworkCore at 10.0.10, forcing a family-wide servicing bump and an NU1605 downgrade cascade that deserves its own reviewed change. Verified the way the defect demanded — in a fresh worktree, not this one: restore clean (0 errors, down from 204) and full solution build clean. Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW
47 lines
2.9 KiB
XML
47 lines
2.9 KiB
XML
<Project Sdk="Microsoft.NET.Sdk">
|
|
|
|
<PropertyGroup>
|
|
<TargetFramework>net10.0</TargetFramework>
|
|
<Nullable>enable</Nullable>
|
|
<ImplicitUsings>enable</ImplicitUsings>
|
|
<LangVersion>latest</LangVersion>
|
|
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
|
|
<GenerateDocumentationFile>true</GenerateDocumentationFile>
|
|
<!-- WP7: the calc deploy-gate reuses the pure DependencyGraph (Tarjan SCC) from Core.VirtualTags,
|
|
whose closure includes Microsoft.CodeAnalysis.CSharp.Scripting 4.12.0 (== CodeAnalysis.Common
|
|
4.12.0), while EF's transitive CodeAnalysis.Common 5.0.0 wins resolution. Suppress NU1608 — the
|
|
only surface Configuration touches (DependencyGraph.DetectCycles) has ZERO Roslyn dependency, so
|
|
the version skew never runs. Mirrors the identical suppression + rationale in the Host csproj. -->
|
|
<NoWarn>$(NoWarn);CS1591;NU1608</NoWarn>
|
|
<RootNamespace>ZB.MOM.WW.OtOpcUa.Configuration</RootNamespace>
|
|
</PropertyGroup>
|
|
|
|
<ItemGroup>
|
|
<PackageReference Include="Microsoft.EntityFrameworkCore"/>
|
|
<PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer"/>
|
|
<PackageReference Include="Microsoft.EntityFrameworkCore.Design">
|
|
<PrivateAssets>all</PrivateAssets>
|
|
<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
|
|
</PackageReference>
|
|
<PackageReference Include="Microsoft.AspNetCore.DataProtection.EntityFrameworkCore"/>
|
|
<!-- Surgical transitive pin — see the System.Security.Cryptography.Xml block in
|
|
Directory.Packages.props. This is the one project where the DataProtection chain
|
|
enters the repo; every other consumer reaches it through a ProjectReference here. -->
|
|
<PackageReference Include="System.Security.Cryptography.Xml"/>
|
|
<PackageReference Include="Microsoft.Extensions.Configuration.Abstractions"/>
|
|
<PackageReference Include="Microsoft.Extensions.Logging.Abstractions"/>
|
|
<PackageReference Include="Polly.Core"/>
|
|
</ItemGroup>
|
|
|
|
<ItemGroup>
|
|
<ProjectReference Include="..\ZB.MOM.WW.OtOpcUa.Core.Abstractions\ZB.MOM.WW.OtOpcUa.Core.Abstractions.csproj"/>
|
|
<!-- R2-11 (01/C-1): consume the shared TagConfigIntent.Parse byte-parity authority in Commons.
|
|
Cycle-safe — Commons has zero in-repo ProjectReferences. -->
|
|
<ProjectReference Include="..\ZB.MOM.WW.OtOpcUa.Commons\ZB.MOM.WW.OtOpcUa.Commons.csproj"/>
|
|
<!-- WP7: the deploy-gate cycle check reuses DependencyGraph (Tarjan SCC) for the calc→calc
|
|
dependency-cycle rule. Cycle-safe — Core.VirtualTags does not reference Configuration. -->
|
|
<ProjectReference Include="..\ZB.MOM.WW.OtOpcUa.Core.VirtualTags\ZB.MOM.WW.OtOpcUa.Core.VirtualTags.csproj"/>
|
|
</ItemGroup>
|
|
|
|
</Project>
|