Repository navigation
chore: patch vulnerable transitive packages - #297
Merged
Merged
Conversation
Resolves every known-vulnerable package reported by 'dotnet list package --vulnerable --include-transitive'. Enables CentralPackageTransitivePinningEnabled so transitive-only packages can be pinned from Directory.Packages.props, then pins: - System.Security.Cryptography.Pkcs 10.0.7 -> 10.0.14 (GHSA-846f-f764-76mx high, GHSA-2fmv-rv2c-59x7 moderate) - MessagePack 2.5.192 -> 2.5.307 (GHSA-hv8m-jj95-wg3x, GHSA-vh6j-jc39-fggf high, +10 moderate) - OpenTelemetry.Api 1.9.0/1.10.0 -> 1.15.3 (GHSA-g94r-2vxg-569j, GHSA-8785-wc3w-h8q6 moderate) - Newtonsoft.Json 12.0.3 -> 13.0.4 (GHSA-5crp-9r3c-p9vr high, via FluentEmail.Mailgun) Also bumps two direct pins to patched versions: - OpenTelemetry.Exporter.OpenTelemetryProtocol 1.15.0 -> 1.15.3 (GHSA-q834-8qmm-v933 moderate) - Grpc.Tools 2.72.0 -> 2.78.0, the floor Aspire.Hosting.AppHost requires. Enabling transitive pinning surfaced this pre-existing downgrade as a hard NU1109 error. All 8 projects now report zero vulnerable packages. Build: 0 errors, 15 warnings (down from 47). Unit tests: 8/8.
Aaronontheweb
enabled auto-merge (squash)
October 28, 2026 22:14
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes out every known-vulnerable package in the solution.
dotnet list DrawTogether.sln package --vulnerable --include-transitivenow reports zero for all 8 projects.What was vulnerable (before)
System.Security.Cryptography.PkcsMessagePackAspire.Hosting→StreamJsonRpc2.22.23OpenTelemetry.ApiActorsandEnd2End.TestsNewtonsoft.JsonFluentEmail.Mailgun3.0.2OpenTelemetry.Exporter.OpenTelemetryProtocolFix
All of these are transitive-only, so CPM alone could not move them. Enabled
CentralPackageTransitivePinningEnabledand pinned each package to its patched release:System.Security.Cryptography.Pkcs→ 10.0.14 — GHSA-846f-f764-76mxMessagePack→ 2.5.307 — GHSA-hv8m-jj95-wg3x, GHSA-vh6j-jc39-fggfOpenTelemetry.Api→ 1.15.3 — GHSA-g94r-2vxg-569jNewtonsoft.Json→ 13.0.4 — GHSA-5crp-9r3c-p9vrTwo direct pins also moved to patched versions:
OpenTelemetry.Exporter.OpenTelemetryProtocol1.15.0 → 1.15.3 — GHSA-q834-8qmm-v933Grpc.Tools2.72.0 → 2.78.0 — the floorAspire.Hosting.AppHost/Aspire.Hosting.Testingrequire. Turning on transitive pinning surfaced this as a hardNU1109downgrade error; it was silently tolerated before becauseGrpc.ToolsisPrivateAssets=all.Verification
dotnet list ... --vulnerable --include-transitive→ no vulnerable packages in any projectdotnet build -c Release→ 0 errors, 15 warnings (down from 47 — theNU1902/NU1903audit warnings are gone)DrawTogether.Tests→ 8/8 passingRisk
Every pin is a patch-level move within the same major, except
Newtonsoft.Json12 → 13. That one is a transitive dependency ofFluentEmail.Mailgunonly; 13.x is source-compatible with 12.x apart from a handful of obsolete APIs, and nothing in this repo binds directly to it.The
Security pinsItemGroup is annotated so it can be deleted once the upstream direct dependencies ship patched versions on their own.