Joseph Doherty
1baa384cbe
10.0.7's pool can hand one handle to two users (efcore#39009). 10.0.13 floors SQLitePCLRaw 2.1.13, so the transitive lib.e_sqlite3 pin moves 2.1.12 -> 2.1.13 (the old pin is a NU1109 downgrade error). NuGetAudit clean; all suites green. Versions bumped, NOT published: Secrets 0.6.5, LocalDb 0.3.5, Auth 0.4.3. GalaxyRepository and Overview do not use Microsoft.Data.Sqlite. Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV
55 lines
3.4 KiB
XML
55 lines
3.4 KiB
XML
<Project>
|
|
|
|
<PropertyGroup>
|
|
<ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
|
|
<!-- Enable transitive pinning so the security override below (SQLitePCLRaw native lib) takes effect. -->
|
|
<CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
|
|
</PropertyGroup>
|
|
|
|
<ItemGroup>
|
|
<!-- LDAP -->
|
|
<PackageVersion Include="Novell.Directory.Ldap.NETStandard" Version="3.6.0" />
|
|
|
|
<!-- Data -->
|
|
<PackageVersion Include="Microsoft.Data.Sqlite" Version="10.0.13" />
|
|
<!-- Transitive security pin: Microsoft.Data.Sqlite pulled SQLitePCLRaw.lib.e_sqlite3 2.1.11 (10.0.7); 10.0.13 floors 2.1.13 (scadaproj#26),
|
|
which carries advisory GHSA-2m69-gcr7-jv3q (NU1903). Pin the patched 2.1.13 native lib. -->
|
|
<PackageVersion Include="SQLitePCLRaw.lib.e_sqlite3" Version="2.1.13" />
|
|
<!-- Shared SQL-Server API-key store (ZB.MOM.WW.Auth.ApiKeys.SqlServer). 6.0.2 matches the
|
|
family pin used by ZB.MOM.WW.Secrets' SQL-Server store, so a consumer taking both gets one
|
|
SqlClient rather than a downgrade warning. -->
|
|
<PackageVersion Include="Microsoft.Data.SqlClient" Version="6.0.2" />
|
|
<!-- 9.0.4, not 9.0.0: Microsoft.Data.SqlClient 6.0.2 pulls System.Configuration.ConfigurationManager
|
|
9.0.4, which requires ProtectedData >= 9.0.4. With transitive pinning on, the lower central
|
|
version is a hard NU1109 downgrade error rather than a silent resolve. -->
|
|
<PackageVersion Include="System.Security.Cryptography.ProtectedData" Version="9.0.4" />
|
|
<!-- Transitive security pin (scadaproj#22): Microsoft.Data.SqlClient 6.0.2 pulls
|
|
System.Security.Cryptography.Pkcs 9.0.4, which carries GHSA-846f-f764-76mx (high) and
|
|
GHSA-2fmv-rv2c-59x7 (moderate) and fails restore under warnings-as-errors (NU1902/NU1903).
|
|
Pin the patched 9.0.21 (first fixed in the 9.0 line; 9.0.0-9.0.20 and 10.0.0-10.0.12 are all affected). -->
|
|
<PackageVersion Include="System.Security.Cryptography.Pkcs" Version="9.0.21" />
|
|
|
|
<!-- Extensions -->
|
|
<PackageVersion Include="Microsoft.Extensions.Options" Version="10.0.7" />
|
|
<PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="10.0.7" />
|
|
<PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.7" />
|
|
<PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.7" />
|
|
<PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.7" />
|
|
<PackageVersion Include="Microsoft.Extensions.Configuration" Version="10.0.7" />
|
|
<PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.7" />
|
|
<PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.7" />
|
|
|
|
<!-- ASP.NET Core Authentication / Authorization -->
|
|
<PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.7" />
|
|
<PackageVersion Include="Microsoft.AspNetCore.Authorization" Version="10.0.7" />
|
|
|
|
<!-- Test -->
|
|
<PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
|
|
<PackageVersion Include="xunit" Version="2.9.3" />
|
|
<PackageVersion Include="xunit.runner.visualstudio" Version="3.1.4" />
|
|
<PackageVersion Include="Xunit.SkippableFact" Version="1.5.61" />
|
|
<PackageVersion Include="coverlet.collector" Version="6.0.4" />
|
|
</ItemGroup>
|
|
|
|
</Project>
|