Skip to content

Commit df76a01

Browse files
ericstjjkoritzinsky
ericstj
and
jkoritzinsky
authored
Enable NuGet Audit and fix issues (dotnet#107639)
* Enable NuGet Audit and fix issues Microsoft.NET.HostModel can reference the live builds of the packages it depends on. These will be deployed by the SDK.� Most other audit alerts were due to tasks pulling in old dependencies that aren't even used by the task. Avoid these by cherry-picking just the assemblies needed by the tasks and provided by MSBuild / SDK. This prevents NuGet from downloading the package closure with the vulnerable packages. We don't need those packages since the tasks aren't responsible for deploying them. A better solution in the future would be a targeting pack for MSBuild and the .NET SDK - so that components that contribute to these hosts have a surface area they can target without taking on responsibility for servicing. There is once case where we have a test that references NuGet.* packages which also bring in stale dependencies that overlap with framework assemblies. Avoid these by cherry-picking the NuGet packages in the same way. * Fix package path on linux * Only use live JSON from HostModel SDK pins S.R.M and a few others, so don't make them upgrade yet. * Add a couple missing assembly references * Refactor tasks dependencies Consolidate representation of msbuild-provided task dependencies * Fix audit warnings in tests * Remove MetadataLoadContext from WasmAppBuilder package * Update Analyzer.Testing packages * Reduce exposure of Microsoft.Build.Tasks.Core * Fix audit warnings that only occur on browser * Update Asn1 used by linker analyzer tests * React to breaking change in analyzer test SDK * Enable working DryIoc tests * Fix double-write when LibrariesConfiguration differs from Configuration * Fix LibrariesConfiguration update target * Clean up references and add comments. * Make HostModel references private This ensures projects referenced will not be rebuilt by tests. This also means the HostModel package will not list these as references, but that's OK since the SDK provides them and this is not a shipping package. * Use ProjectReferenceExclusion to avoid framework project references On .NETCore we want to use the targeting pack and avoid rebuilding libs. * Update src/libraries/System.Runtime.InteropServices.JavaScript/tests/JSImportGenerator.UnitTest/JSImportGenerator.Unit.Tests.csproj Co-authored-by: Jeremy Koritzinsky <jkoritzinsky@gmail.com> --------- Co-authored-by: Jeremy Koritzinsky <jkoritzinsky@gmail.com>
1 parent 13fef94 commit df76a01

File tree

42 files changed

+176
-118
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

42 files changed

+176
-118
lines changed

‎Directory.Build.targets

+2-2
Original file line numberDiff line numberDiff line change
@@ -143,12 +143,12 @@
143143
<Target Name="FilterTransitiveProjectReferences"
144144
AfterTargets="IncludeTransitiveProjectReferences"
145145
Condition="'$(DisableTransitiveProjectReferences)' != 'true' and
146-
'@(DefaultReferenceExclusion)' != ''">
146+
('@(DefaultReferenceExclusion)' != '' or '@(ProjectReferenceExclusion)' != '')">
147147
<ItemGroup>
148148
<_transitiveProjectReferenceWithProjectName Include="@(ProjectReference->Metadata('NuGetPackageId'))"
149149
OriginalIdentity="%(Identity)" />
150150
<_transitiveIncludedProjectReferenceWithProjectName Include="@(_transitiveProjectReferenceWithProjectName)"
151-
Exclude="@(DefaultReferenceExclusion)" />
151+
Exclude="@(DefaultReferenceExclusion);@(ProjectReferenceExclusion)" />
152152
<_transitiveExcludedProjectReferenceWithProjectName Include="@(_transitiveProjectReferenceWithProjectName)"
153153
Exclude="@(_transitiveIncludedProjectReferenceWithProjectName)" />
154154
<ProjectReference Remove="@(_transitiveExcludedProjectReferenceWithProjectName->Metadata('OriginalIdentity'))" />

‎NuGet.config

+4
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,10 @@
2323
<add key="dotnet10" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet10/nuget/v3/index.json" />
2424
<add key="dotnet10-transport" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet10-transport/nuget/v3/index.json" />
2525
</packageSources>
26+
<auditSources>
27+
<clear />
28+
<add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
29+
</auditSources>
2630
<disabledPackageSources>
2731
<clear />
2832
</disabledPackageSources>

‎eng/PackageDownloadAndReference.targets

+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
<Project>
2+
3+
<!-- These file supports using PackageDownloadAndReference items.
4+
5+
The PackageDownloadAndReference item is used to download a package and reference it in the project, without restoring the package's dependency closure.
6+
7+
When using PackageDownloadAndReference you are responsible for selecting the correct assets from the package and ensuring that the package and it's
8+
dependencies are available at runtime.
9+
10+
The PackageDownloadAndReference item has the following metadata:
11+
- Folder: The folder in the package where the assembly is located.
12+
- AssemblyName: The name of the assembly to reference.
13+
- Private: Whether the reference should be private (copied to the output directory) or not. Default is false.
14+
15+
A common use case for PackageDownloadAndReference is to reference assemblies provided by MSBuild or the .NET SDK.
16+
-->
17+
18+
<ItemDefinitionGroup>
19+
<PackageDownloadAndReference>
20+
<Folder>lib/$(TargetFramework)</Folder>
21+
<AssemblyName>%(Identity)</AssemblyName>
22+
<Private>false</Private>
23+
</PackageDownloadAndReference>
24+
</ItemDefinitionGroup>
25+
26+
<ItemGroup>
27+
<PackageDownload Include="@(PackageDownloadAndReference)" />
28+
<PackageDownload Update="@(PackageDownloadAndReference)" Version="[%(Version)]"/>
29+
<PackageDownloadAndReference Update="@(PackageDownloadAndReference)" PackageFolder="$([System.String]::new(%(Identity)).ToLowerInvariant())" />
30+
<Reference Include="@(PackageDownloadAndReference->'$(NuGetPackageRoot)%(PackageFolder)/%(Version)/%(Folder)/%(AssemblyName).dll')" />
31+
</ItemGroup>
32+
33+
</Project>

‎eng/Version.Details.xml

+12
Original file line numberDiff line numberDiff line change
@@ -398,10 +398,22 @@
398398
</Dependency>
399399
<!-- Necessary for source-build. This allows the package to be retrieved from previously-source-built artifacts
400400
and flow in as dependencies of the packages produced by runtime. -->
401+
<Dependency Name="Nuget.Frameworks" Version="6.2.4">
402+
<Uri>https://github.com/NuGet/NuGet.Client</Uri>
403+
<Sha>8fef55f5a55a3b4f2c96cd1a9b5ddc51d4b927f8</Sha>
404+
</Dependency>
405+
<Dependency Name="Nuget.Packaging" Version="6.2.4">
406+
<Uri>https://github.com/NuGet/NuGet.Client</Uri>
407+
<Sha>8fef55f5a55a3b4f2c96cd1a9b5ddc51d4b927f8</Sha>
408+
</Dependency>
401409
<Dependency Name="Nuget.ProjectModel" Version="6.2.4">
402410
<Uri>https://github.com/NuGet/NuGet.Client</Uri>
403411
<Sha>8fef55f5a55a3b4f2c96cd1a9b5ddc51d4b927f8</Sha>
404412
</Dependency>
413+
<Dependency Name="Nuget.Versioning" Version="6.2.4">
414+
<Uri>https://github.com/NuGet/NuGet.Client</Uri>
415+
<Sha>8fef55f5a55a3b4f2c96cd1a9b5ddc51d4b927f8</Sha>
416+
</Dependency>
405417
<Dependency Name="runtime.linux-arm64.Microsoft.NETCore.Runtime.Wasm.Node.Transport" Version="9.0.0-alpha.1.24175.1">
406418
<Uri>https://github.com/dotnet/node</Uri>
407419
<Sha>308c7d0f1fa19bd1e7b768ad13646f5206133cdb</Sha>

‎eng/Versions.props

+5-2
Original file line numberDiff line numberDiff line change
@@ -119,6 +119,7 @@
119119
<SystemComponentModelAnnotationsVersion>5.0.0</SystemComponentModelAnnotationsVersion>
120120
<SystemDataSqlClientVersion>4.8.6</SystemDataSqlClientVersion>
121121
<SystemDrawingCommonVersion>8.0.0</SystemDrawingCommonVersion>
122+
<SystemFormatsAsn1Version>8.0.1</SystemFormatsAsn1Version>
122123
<SystemIOFileSystemAccessControlVersion>5.0.0</SystemIOFileSystemAccessControlVersion>
123124
<SystemMemoryVersion>4.5.5</SystemMemoryVersion>
124125
<SystemReflectionMetadataVersion>10.0.0-alpha.1.24472.5</SystemReflectionMetadataVersion>
@@ -136,7 +137,7 @@
136137
<runtimenativeSystemIOPortsVersion>10.0.0-alpha.1.24472.5</runtimenativeSystemIOPortsVersion>
137138
<!-- Keep toolset versions in sync with dotnet/msbuild and dotnet/sdk -->
138139
<SystemCollectionsImmutableToolsetVersion>8.0.0</SystemCollectionsImmutableToolsetVersion>
139-
<SystemTextJsonToolsetVersion>8.0.0</SystemTextJsonToolsetVersion>
140+
<SystemTextJsonToolsetVersion>8.0.4</SystemTextJsonToolsetVersion>
140141
<SystemReflectionMetadataToolsetVersion>8.0.0</SystemReflectionMetadataToolsetVersion>
141142
<SystemReflectionMetadataLoadContextToolsetVersion>8.0.0</SystemReflectionMetadataLoadContextToolsetVersion>
142143
<!-- Runtime-Assets dependencies -->
@@ -174,8 +175,10 @@
174175
<MicrosoftBuildTasksCoreVersion>$(MicrosoftBuildVersion)</MicrosoftBuildTasksCoreVersion>
175176
<MicrosoftBuildFrameworkVersion>$(MicrosoftBuildVersion)</MicrosoftBuildFrameworkVersion>
176177
<MicrosoftBuildUtilitiesCoreVersion>$(MicrosoftBuildVersion)</MicrosoftBuildUtilitiesCoreVersion>
178+
<NugetFrameworksVersion>6.2.4</NugetFrameworksVersion>
177179
<NugetProjectModelVersion>6.2.4</NugetProjectModelVersion>
178180
<NugetPackagingVersion>6.2.4</NugetPackagingVersion>
181+
<NugetVersioningVersion>6.2.4</NugetVersioningVersion>
179182
<DotnetSosVersion>7.0.412701</DotnetSosVersion>
180183
<DotnetSosTargetFrameworkVersion>6.0</DotnetSosTargetFrameworkVersion>
181184
<!-- Testing -->
@@ -205,7 +208,7 @@
205208
<GrpcCoreVersion>2.46.3</GrpcCoreVersion>
206209
<GrpcDotnetClientVersion>2.45.0</GrpcDotnetClientVersion>
207210
<GrpcToolsVersion>2.45.0</GrpcToolsVersion>
208-
<CompilerPlatformTestingVersion>1.1.2-beta1.23323.1</CompilerPlatformTestingVersion>
211+
<CompilerPlatformTestingVersion>1.1.3-beta1.24423.1</CompilerPlatformTestingVersion>
209212
<CompilerPlatformTestingDiffPlexVersion>1.7.2</CompilerPlatformTestingDiffPlexVersion>
210213
<CompilerPlatformTestingMicrosoftVisualBasicVersion>10.2.0</CompilerPlatformTestingMicrosoftVisualBasicVersion>
211214
<CompilerPlatformTestingMicrosoftVisualStudioCompositionVersion>17.0.46</CompilerPlatformTestingMicrosoftVisualStudioCompositionVersion>

‎src/installer/Directory.Build.targets

+12
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,18 @@
55
<ArchiveName Condition="'$(PgoInstrument)' != ''">$(ArchiveName)-pgo</ArchiveName>
66
</PropertyGroup>
77

8+
<!-- Libraries might be built with a different Configuration,,
9+
make sure we honor that when building ProjectReferences. -->
10+
<Target Name="UpdateLibrariesProjectReferenceConfiguration" AfterTargets="IncludeTransitiveProjectReferences">
11+
<FindUnderPath Files="@(ProjectReference)" Path="$(LibrariesProjectRoot)">
12+
<Output TaskParameter="InPath" ItemName="LibrariesProjectReference" />
13+
</FindUnderPath>
14+
<ItemGroup>
15+
<ProjectReference Remove="@(LibrariesProjectReference)" />
16+
<ProjectReference Include="@(LibrariesProjectReference)" SetConfiguration="Configuration=$(LibrariesConfiguration)"/>
17+
</ItemGroup>
18+
</Target>
19+
820
<!--
921
Import stubs for compatibility with packaging tools, if not building a pkgproj. Ordinarily,
1022
listing this before the ../Directory.Build.targets import would be sufficient, but the packaging

‎src/installer/managed/Microsoft.NET.HostModel/Microsoft.NET.HostModel.csproj

+2-1
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,9 @@
1919
</PropertyGroup>
2020

2121
<ItemGroup>
22+
<!-- SDK pins this to a lower version https://github.com/dotnet/sdk/issues/43325 -->
2223
<PackageReference Include="System.Reflection.Metadata" Version="$(SystemReflectionMetadataToolsetVersion)" />
23-
<PackageReference Include="System.Text.Json" Version="$(SystemTextJsonToolsetVersion)" />
24+
<ProjectReference Include="$(LibrariesProjectRoot)System.Text.Json\src\System.Text.Json.csproj" />
2425
</ItemGroup>
2526

2627
<ItemGroup>

‎src/installer/tests/Directory.Build.targets

+6
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,11 @@
11
<Project>
22

3+
<!-- Exclude any ProjectReferences to framework assemblies on the latest framework -->
4+
<Import Project="$(LibrariesProjectRoot)NetCoreAppLibrary.props" Condition="'$(TargetFramework)' == '$(NetCoreAppCurrent)'" />
5+
<ItemGroup Condition="'$(TargetFramework)' == '$(NetCoreAppCurrent)'">
6+
<ProjectReferenceExclusion Include="@(NetCoreAppLibrary)" />
7+
</ItemGroup>
8+
39
<Target Name="SetupTestContextVariables"
410
Condition="'$(IsTestProject)' == 'true'"
511
DependsOnTargets="

‎src/installer/tests/Microsoft.DotNet.CoreSetup.Packaging.Tests/Microsoft.DotNet.CoreSetup.Packaging.Tests.csproj

+4
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,12 @@
88

99
<ItemGroup>
1010
<PackageReference Include="NuGet.Packaging" Version="$(NugetPackagingVersion)" />
11+
<!-- Upgrade to a non-vulnerable version of Asn1 - which will be ignored in favor of the framework copy -->
12+
<PackageReference Include="System.Formats.Asn1" Version="$(SystemFormatsAsn1Version)" ExcludeAssets="All" />
1113
</ItemGroup>
1214

15+
<Import Project="$(RepositoryEngineeringDir)PackageDownloadAndReference.targets" />
16+
1317
<ItemGroup>
1418
<ProjectReference Include="..\TestUtils\TestUtils.csproj" />
1519
<OrderProjectReference Include="@(PkgprojProjectToBuild)" />

‎src/libraries/Common/tests/System/Net/Security/Kerberos/System.Net.Security.Kerberos.Shared.projitems

+1
Original file line numberDiff line numberDiff line change
@@ -36,5 +36,6 @@
3636
</ItemGroup>
3737
<ItemGroup>
3838
<PackageReference Include="Kerberos.NET" Version="4.5.178" />
39+
<ProjectReference Include="$(LibrariesProjectRoot)System.Security.Cryptography.Pkcs\src\System.Security.Cryptography.Pkcs.csproj" />
3940
</ItemGroup>
4041
</Project>

‎src/libraries/Microsoft.Extensions.DependencyInjection/tests/DI.External.Tests/DryIoc.cs

+1-6
Original file line numberDiff line numberDiff line change
@@ -9,12 +9,7 @@ namespace Microsoft.Extensions.DependencyInjection.Specification
99
{
1010
public class DryIocDependencyInjectionSpecificationTests : SkippableDependencyInjectionSpecificationTests
1111
{
12-
public override bool SupportsIServiceProviderIsService => false;
13-
14-
public override string[] SkippedTests => new[]
15-
{
16-
"ServiceScopeFactoryIsSingleton"
17-
};
12+
public override string[] SkippedTests => [];
1813

1914
protected override IServiceProvider CreateServiceProviderImpl(IServiceCollection serviceCollection)
2015
{

‎src/libraries/Microsoft.Extensions.DependencyInjection/tests/DI.External.Tests/Microsoft.Extensions.DependencyInjection.ExternalContainers.Tests.csproj

+7-3
Original file line numberDiff line numberDiff line change
@@ -18,16 +18,20 @@
1818
<ProjectReference Include="$(LibrariesProjectRoot)Microsoft.Extensions.DependencyInjection\src\Microsoft.Extensions.DependencyInjection.csproj" SkipUseReferenceAssembly="true" />
1919
<ProjectReference Include="$(LibrariesProjectRoot)Microsoft.Extensions.DependencyInjection.Abstractions\src\Microsoft.Extensions.DependencyInjection.Abstractions.csproj" SkipUseReferenceAssembly="true" />
2020
<ProjectReference Include="$(LibrariesProjectRoot)Microsoft.Extensions.DependencyInjection.Specification.Tests\src\Microsoft.Extensions.DependencyInjection.Specification.Tests.csproj" />
21-
<PackageReference Include="Autofac.Extensions.DependencyInjection" Version="8.0.0" />
22-
<PackageReference Include="DryIoc.Microsoft.DependencyInjection" Version="5.1.0" />
23-
<PackageReference Include="LightInject.Microsoft.DependencyInjection" Version="3.5.0" />
21+
<PackageReference Include="Autofac.Extensions.DependencyInjection" Version="10.0.0" />
22+
<PackageReference Include="DryIoc.Microsoft.DependencyInjection" Version="6.2.0" />
23+
<PackageReference Include="LightInject.Microsoft.DependencyInjection" Version="3.7.1" />
2424
<PackageReference Include="Grace.DependencyInjection.Extensions" Version="7.1.0" />
2525
<PackageReference Include="Stashbox.Extensions.Dependencyinjection" Version="4.2.3" />
2626
</ItemGroup>
2727

2828
<!-- These packages don't support .NETFramework -->
2929
<ItemGroup Condition="'$(TargetFrameworkIdentifier)' == '.NETCoreApp'">
3030
<PackageReference Include="Lamar.Microsoft.DependencyInjection" Version="8.0.1" />
31+
<!-- Lamar depends on System.Runtime.Loader which brings in 1.x packages.
32+
Those have audit warnings when runtime.* packages are brought in for RID-specific restore.
33+
Avoid by referencing the latest Microsoft.NETCore.Targets which will prevent all 1.x runtime.* packages from being referenced. -->
34+
<PackageReference Include="Microsoft.NETCore.Targets" Version="5.0.0" />
3135
</ItemGroup>
3236

3337
</Project>

‎src/libraries/Microsoft.Extensions.Logging.Abstractions/tests/Microsoft.Extensions.Logging.Generators.Tests/Microsoft.Extensions.Logging.Generators.targets

+5
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,11 @@
1919
<ItemGroup>
2020
<ProjectReference Include="$(LibrariesProjectRoot)Microsoft.Extensions.Logging.Abstractions\src\Microsoft.Extensions.Logging.Abstractions.csproj" />
2121
<PackageReference Include="Microsoft.CodeAnalysis" Version="$(RoslynApiVersion)" />
22+
<!-- Ensure we are using live dependencies for CodeAnalysis rather than old packages -->
23+
<PackageReference Include="NETStandard.Library" Version="$(NETStandardLibraryVersion)" />
24+
<ProjectReference Include="$(LibrariesProjectRoot)System.Composition\src\System.Composition.csproj" />
25+
<ProjectReference Include="$(LibrariesProjectRoot)System.IO.Pipelines\src\System.IO.Pipelines.csproj" />
26+
<ProjectReference Include="$(LibrariesProjectRoot)System.Reflection.Metadata\src\System.Reflection.Metadata.csproj" />
2227
<PackageReference Include="SQLitePCLRaw.bundle_green" Version="$(SQLitePCLRawbundle_greenVersion)" />
2328
</ItemGroup>
2429

‎src/libraries/Microsoft.NETCore.Platforms/src/Microsoft.NETCore.Platforms.csproj

+9-3
Original file line numberDiff line numberDiff line change
@@ -41,10 +41,16 @@
4141
</ItemGroup>
4242

4343
<ItemGroup>
44-
<PackageReference Include="Microsoft.Build.Tasks.Core" Version="$(MicrosoftBuildTasksCoreVersion)" />
45-
<PackageReference Include="Newtonsoft.Json" Version="$(NewtonsoftJsonVersion)" />
44+
<!-- Manually reference these assemblies which are provided by MSBuild / .NET SDK -->
45+
<PackageDownloadAndReference Include="Microsoft.Build.Framework" Version="$(MicrosoftBuildFrameworkVersion)" Folder="ref/net472" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net472'))" />
46+
<PackageDownloadAndReference Include="Microsoft.Build.Framework" Version="$(MicrosoftBuildFrameworkVersion)" Folder="ref/net8.0" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net8.0'))" />
47+
<PackageDownloadAndReference Include="Microsoft.Build.Utilities.Core" Version="$(MicrosoftBuildUtilitiesCoreVersion)" Folder="ref/net472" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net472'))" />
48+
<PackageDownloadAndReference Include="Microsoft.Build.Utilities.Core" Version="$(MicrosoftBuildUtilitiesCoreVersion)" Folder="ref/net8.0" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net8.0'))" />
49+
<PackageDownloadAndReference Include="Newtonsoft.Json" Version="$(NewtonsoftJsonVersion)" Folder="lib/netstandard2.0" />
4650
</ItemGroup>
47-
51+
52+
<Import Project="$(RepositoryEngineeringDir)PackageDownloadAndReference.targets" />
53+
4854
<UsingTask TaskName="UpdateRuntimeIdentifierGraph" AssemblyFile="$(_generateRuntimeGraphTask)"/>
4955
<Target Name="UpdateRuntimeIdentifierGraph"
5056
AfterTargets="Build"

‎src/libraries/Microsoft.XmlSerializer.Generator/tests/SerializableAssembly.csproj

+1-3
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,7 @@
88
</PropertyGroup>
99

1010
<ItemGroup>
11-
<PackageReference Include="Microsoft.Build.Tasks.Core" Version="$(MicrosoftBuildTasksCoreVersion)">
12-
<PrivateAssets>all</PrivateAssets>
13-
</PackageReference>
11+
<ProjectReference Include="$(LibrariesProjectRoot)System.Reflection.Metadata\src\System.Reflection.Metadata.csproj" />
1412
</ItemGroup>
1513

1614
<ItemGroup>

‎src/libraries/System.Private.CoreLib/tests/IntrinsicsInSystemPrivatecoreLibAnalyzer.Tests/IntrinsicsInSystemPrivateCoreLib.Tests.csproj

+2
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,8 @@
1515
<PackageReference Include="DiffPlex" Version="$(CompilerPlatformTestingDiffPlexVersion)" />
1616
<PackageReference Include="Microsoft.VisualBasic" Version="$(CompilerPlatformTestingMicrosoftVisualBasicVersion)" />
1717
<PackageReference Include="Microsoft.VisualStudio.Composition" Version="$(CompilerPlatformTestingMicrosoftVisualStudioCompositionVersion)" />
18+
<!-- Upgrade to a non-vulnerable version of Asn1 - which will be ignored in favor of the framework copy -->
19+
<PackageReference Include="System.Formats.Asn1" Version="$(SystemFormatsAsn1Version)" ExcludeAssets="All" />
1820
</ItemGroup>
1921

2022
<ItemGroup>

‎src/libraries/System.Runtime.InteropServices.JavaScript/tests/JSImportGenerator.UnitTest/JSImportGenerator.Unit.Tests.csproj

+4-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
<TargetFramework>$(NetCoreAppCurrent)</TargetFramework>
44
<Nullable>enable</Nullable>
55
<TestRunRequiresLiveRefPack>true</TestRunRequiresLiveRefPack>
6-
<IgnoreForCI Condition="'$(TargetsMobile)' == 'true' or '$(TargetsLinuxBionic)' == 'true' or '$(TargetArchitecture)' == 'ARMv6'">true</IgnoreForCI>
6+
<IgnoreForCI Condition="'$(TargetsMobile)' == 'true' or '$(TargetsLinuxBionic)' == 'true' or '$(TargetArchitecture)' == 'ARMv6'">true</IgnoreForCI>
77
</PropertyGroup>
88
<ItemGroup>
99
<Compile Include="$(CommonTestPath)SourceGenerators\LiveReferencePack.cs" Link="Common\SourceGenerators\LiveReferencePack.cs" />
@@ -25,6 +25,9 @@
2525
<PackageReference Include="Microsoft.VisualBasic" Version="$(CompilerPlatformTestingMicrosoftVisualBasicVersion)" />
2626
<PackageReference Include="Microsoft.VisualStudio.Composition" Version="$(CompilerPlatformTestingMicrosoftVisualStudioCompositionVersion)" />
2727

28+
<!-- Upgrade to a non-vulnerable version of Asn1 - which will be ignored in favor of the framework copy -->
29+
<PackageReference Include="System.Formats.Asn1" Version="$(SystemFormatsAsn1Version)" ExcludeAssets="all" />
30+
2831
<None Include="$(RepoRoot)/NuGet.config" Link="NuGet.config" CopyToOutputDirectory="PreserveNewest" />
2932
</ItemGroup>
3033
</Project>

‎src/libraries/System.Runtime.InteropServices/tests/ComInterfaceGenerator.Unit.Tests/ComInterfaceGenerator.Unit.Tests.csproj

+3
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,9 @@
3232
<PackageReference Include="DiffPlex" Version="$(CompilerPlatformTestingDiffPlexVersion)" />
3333
<PackageReference Include="Microsoft.VisualBasic" Version="$(CompilerPlatformTestingMicrosoftVisualBasicVersion)" />
3434
<PackageReference Include="Microsoft.VisualStudio.Composition" Version="$(CompilerPlatformTestingMicrosoftVisualStudioCompositionVersion)" />
35+
36+
<!-- Upgrade to a non-vulnerable version of Asn1 - which will be ignored in favor of the framework copy -->
37+
<PackageReference Include="System.Formats.Asn1" Version="$(SystemFormatsAsn1Version)" ExcludeAssets="All" />
3538
</ItemGroup>
3639

3740
<ItemGroup>

‎src/libraries/System.Runtime.InteropServices/tests/LibraryImportGenerator.UnitTests/CustomMarshallerAttributeFixerTest.cs

+1-1
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ internal class CustomMarshallerAttributeFixerTest : CSharpCodeFixVerifier<Custom
2222
// In particular, sort the equivalent subgroups by their diagnostic descriptor in the order that the fixer's fix-all provider
2323
// will add the methods.
2424
// This ensures that the iterative code-fix test will produce the same (deterministic) output as the fix-all tests.
25-
protected override ImmutableArray<(Project project, Diagnostic diagnostic)> SortDistinctDiagnostics(IEnumerable<(Project project, Diagnostic diagnostic)> diagnostics)
25+
protected override ImmutableArray<(Project project, Diagnostic diagnostic)> SortDistinctDiagnostics(ImmutableArray<(Project project, Diagnostic diagnostic)> diagnostics)
2626
=> diagnostics.OrderBy(d => d.diagnostic.Location.GetLineSpan().Path, StringComparer.Ordinal)
2727
.ThenBy(d => d.diagnostic.Location.SourceSpan.Start)
2828
.ThenBy(d => d.diagnostic.Location.SourceSpan.End)

‎src/libraries/System.Runtime.InteropServices/tests/LibraryImportGenerator.UnitTests/LibraryImportGenerator.Unit.Tests.csproj

+3
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,9 @@
3636
<PackageReference Include="DiffPlex" Version="$(CompilerPlatformTestingDiffPlexVersion)" />
3737
<PackageReference Include="Microsoft.VisualBasic" Version="$(CompilerPlatformTestingMicrosoftVisualBasicVersion)" />
3838
<PackageReference Include="Microsoft.VisualStudio.Composition" Version="$(CompilerPlatformTestingMicrosoftVisualStudioCompositionVersion)" />
39+
40+
<!-- Upgrade to a non-vulnerable version of Asn1 - which will be ignored in favor of the framework copy -->
41+
<PackageReference Include="System.Formats.Asn1" Version="$(SystemFormatsAsn1Version)" ExcludeAssets="All" />
3942
</ItemGroup>
4043

4144
<ItemGroup>

‎src/libraries/System.Runtime.Serialization.Xml/tests/XsdDataContractExporterTests/SerializationTypes/SerializationTypes.csproj

-6
Original file line numberDiff line numberDiff line change
@@ -13,12 +13,6 @@
1313
<EnableLibraryImportGenerator>false</EnableLibraryImportGenerator>
1414
</PropertyGroup>
1515

16-
<ItemGroup>
17-
<PackageReference Include="Microsoft.Build.Tasks.Core" Version="$(MicrosoftBuildTasksCoreVersion)">
18-
<PrivateAssets>all</PrivateAssets>
19-
</PackageReference>
20-
</ItemGroup>
21-
2216
<ItemGroup>
2317
<Compile Include="*.cs" />
2418
</ItemGroup>

0 commit comments

Comments
 (0)