Joseph Doherty
a05ce8c86d
bUnit 2.x drops RenderComponent/AddTestAuthorization, so pin the parser instead of migrating the Ui tests. Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV
100 lines
6.1 KiB
XML
100 lines
6.1 KiB
XML
<Project>
|
|
|
|
<PropertyGroup>
|
|
<ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
|
|
<!-- Enable transitive pinning so the security override below (SQLitePCLRaw native lib) takes effect. -->
|
|
<CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
|
|
</PropertyGroup>
|
|
|
|
<ItemGroup>
|
|
<!-- LDAP -->
|
|
<PackageVersion Include="Novell.Directory.Ldap.NETStandard" Version="3.6.0" />
|
|
|
|
<!-- Data -->
|
|
<PackageVersion Include="Microsoft.Data.Sqlite" Version="10.0.7" />
|
|
<!-- Transitive security pin: Microsoft.Data.Sqlite 10.0.7 pulls SQLitePCLRaw.lib.e_sqlite3 2.1.11,
|
|
which carries advisory GHSA-2m69-gcr7-jv3q (NU1903). Pin the patched 2.1.12 native lib. -->
|
|
<PackageVersion Include="SQLitePCLRaw.lib.e_sqlite3" Version="2.1.12" />
|
|
|
|
<!-- Shared SQL-Server secret store (ZB.MOM.WW.Secrets.Replication.SqlServer).
|
|
6.0.2 matches the version ScadaBridge and ZB.MOM.WW.GalaxyRepository already resolve, so a
|
|
consumer taking both gets one SqlClient rather than a downgrade warning. -->
|
|
<PackageVersion Include="Microsoft.Data.SqlClient" Version="6.0.2" />
|
|
|
|
<!-- Akka cluster replication (ZB.MOM.WW.Secrets.Replication.Akka).
|
|
1.5.62 matches ScadaBridge's pinned Akka.NET line — the clustered consumer must not be
|
|
forced into an Akka version bump just to adopt secret replication. -->
|
|
<PackageVersion Include="Akka" Version="1.5.62" />
|
|
<PackageVersion Include="Akka.Cluster" Version="1.5.62" />
|
|
<PackageVersion Include="Akka.Cluster.Tools" Version="1.5.62" />
|
|
<PackageVersion Include="Akka.Remote" Version="1.5.62" />
|
|
<PackageVersion Include="Akka.TestKit.Xunit2" Version="1.5.62" />
|
|
|
|
<!-- gRPC secrets hub (ZB.MOM.WW.Secrets.Replicator.Grpc).
|
|
2.76.0 / 3.34.1 is the version the whole family already resolves — ScadaBridge and
|
|
OtOpcUa pin exactly these, and the sibling ZB.MOM.WW.LocalDb libraries floor them there.
|
|
A consumer taking the hub alongside LocalDb replication must not be pushed into a
|
|
downgrade warning or an unplanned Grpc bump just to adopt secret replication. -->
|
|
<PackageVersion Include="Google.Protobuf" Version="3.34.1" />
|
|
<PackageVersion Include="Grpc.AspNetCore" Version="2.76.0" />
|
|
<PackageVersion Include="Grpc.Core.Api" Version="2.76.0" />
|
|
<PackageVersion Include="Grpc.Net.Client" Version="2.76.0" />
|
|
<PackageVersion Include="Grpc.Tools" Version="2.76.0" />
|
|
|
|
<!-- Cryptography -->
|
|
<!-- 9.0.4, not 9.0.0: Microsoft.Data.SqlClient 6.0.2 pulls System.Configuration.ConfigurationManager
|
|
9.0.4, which requires ProtectedData >= 9.0.4. With transitive pinning on, the lower central
|
|
version is a hard NU1109 downgrade error rather than a silent resolve. -->
|
|
<PackageVersion Include="System.Security.Cryptography.ProtectedData" Version="9.0.4" />
|
|
<!-- Transitive security pin (scadaproj#22): Microsoft.Data.SqlClient 6.0.2 pulls
|
|
System.Security.Cryptography.Pkcs 9.0.4, which carries GHSA-846f-f764-76mx (high) and
|
|
GHSA-2fmv-rv2c-59x7 (moderate) and fails restore under warnings-as-errors (NU1902/NU1903).
|
|
Pin the patched 9.0.21 (first fixed in the 9.0 line; 9.0.0-9.0.20 and 10.0.0-10.0.12 are all affected). -->
|
|
<PackageVersion Include="System.Security.Cryptography.Pkcs" Version="9.0.21" />
|
|
|
|
<!-- Extensions -->
|
|
<PackageVersion Include="Microsoft.Extensions.Options" Version="10.0.7" />
|
|
<PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="10.0.7" />
|
|
<PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.7" />
|
|
<PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.7" />
|
|
<PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.7" />
|
|
<PackageVersion Include="Microsoft.Extensions.Configuration" Version="10.0.7" />
|
|
<PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.7" />
|
|
<PackageVersion Include="Microsoft.Extensions.Hosting" Version="10.0.7" />
|
|
<PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.7" />
|
|
<PackageVersion Include="Microsoft.Extensions.Logging" Version="10.0.7" />
|
|
|
|
<!-- ASP.NET Core Authentication / Authorization -->
|
|
<PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.7" />
|
|
<PackageVersion Include="Microsoft.AspNetCore.Authorization" Version="10.0.7" />
|
|
|
|
<!-- ZB.MOM.WW shared libraries (Gitea feed) -->
|
|
<PackageVersion Include="ZB.MOM.WW.Audit" Version="0.1.0" />
|
|
<PackageVersion Include="ZB.MOM.WW.Configuration" Version="0.1.0" />
|
|
<PackageVersion Include="ZB.MOM.WW.Theme" Version="0.2.0" />
|
|
<PackageVersion Include="ZB.MOM.WW.Auth.AspNetCore" Version="0.1.4" />
|
|
|
|
<!-- Interactive console -->
|
|
<PackageVersion Include="Spectre.Console" Version="0.50.0" />
|
|
<PackageVersion Include="Spectre.Console.Testing" Version="0.50.0" />
|
|
|
|
<!-- Test -->
|
|
<PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
|
|
<PackageVersion Include="xunit" Version="2.9.3" />
|
|
<PackageVersion Include="xunit.runner.visualstudio" Version="3.1.4" />
|
|
<PackageVersion Include="Xunit.SkippableFact" Version="1.5.61" />
|
|
<!-- In-process ASP.NET Core host for the gRPC secrets-hub end-to-end suite. 10.0.7 is the
|
|
version the rest of the family already pins (ZB.MOM.WW.LocalDb, OtOpcUa, ScadaBridge) and
|
|
matches the Microsoft.Extensions.* line above, so the test host cannot drag a second
|
|
ASP.NET Core version into the graph. -->
|
|
<PackageVersion Include="Microsoft.AspNetCore.TestHost" Version="10.0.7" />
|
|
<PackageVersion Include="coverlet.collector" Version="6.0.4" />
|
|
<PackageVersion Include="bunit" Version="1.40.0" />
|
|
<!-- Transitive security pin (scadaproj#24): bunit 1.40.0 pulls AngleSharp 1.2.0 (NU1902,
|
|
GHSA-pgww-w46g-26qg). bUnit 2.x removes RenderComponent/AddTestAuthorization, so pin the
|
|
parser instead (same version Theme resolves via bUnit 2.7.2). -->
|
|
<PackageVersion Include="AngleSharp" Version="1.5.0" />
|
|
</ItemGroup>
|
|
|
|
</Project>
|