Updating versions of transitive dependencies (#126)

Updating versions of transitive dependencies to their latest stable versions. Updating relevant comments. Internal ADO work item: https://dev.azure.com/msazure/One/_workitems/edit/29603592
microsoft · Oct 11, 2024 · 8b700f1 · 8b700f1
1 parent 98460e1
commit 8b700f1
Show file tree

Hide file tree

Showing 3 changed files with 11 additions and 3 deletions.
diff --git a/properties/service_fabric_common.props b/properties/service_fabric_common.props
@@ -27,7 +27,7 @@
     <!-- TODO: Versions numbers are changed here manually for now, Integrate this with GitVersion. -->
     <MajorVersion>8</MajorVersion>
     <MinorVersion>0</MinorVersion>
-    <BuildVersion>5</BuildVersion>
+    <BuildVersion>6</BuildVersion>
     <Revision>0</Revision>
 
   </PropertyGroup>

diff --git a/...rosoft.ServiceFabric.AspNetCore.Kestrel/Microsoft.ServiceFabric.AspNetCore.Kestrel.csproj b/...rosoft.ServiceFabric.AspNetCore.Kestrel/Microsoft.ServiceFabric.AspNetCore.Kestrel.csproj
@@ -18,9 +18,13 @@
     <!-- Direct dependencies -->
     <PackageReference Include="Microsoft.AspNetCore.Server.Kestrel" Version="2.1.0" />
     <!-- Overriding versions of transitive dependencies -->
+    <!-- 
+      Some versions of transitive dependencies have to be overwritten, since the default versions
+      defined by the direct dependencies are marked as vulnerable packages on nuget.org.
+    -->
     <PackageReference Include="Microsoft.AspNetCore.Server.Kestrel.Core" Version="2.1.25"/>
     <PackageReference Include="Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets" Version="2.1.40" />
-    <PackageReference Include="System.IO.Pipelines" Version="4.5.1" />
+    <PackageReference Include="System.IO.Pipelines" Version="8.0.0" />
   </ItemGroup>
   <ItemGroup>
     <ProjectReference Include="..\Microsoft.ServiceFabric.AspNetCore\Microsoft.ServiceFabric.AspNetCore.csproj" />

diff --git a/src/Microsoft.ServiceFabric.AspNetCore/Microsoft.ServiceFabric.AspNetCore.csproj b/src/Microsoft.ServiceFabric.AspNetCore/Microsoft.ServiceFabric.AspNetCore.csproj
@@ -18,7 +18,11 @@
     <!-- Direct dependencies -->
     <PackageReference Include="Microsoft.AspNetCore.Hosting" Version="2.2.7" />
     <!-- Overriding versions of transitive dependencies -->
-    <PackageReference Include="System.Text.Encodings.Web" Version="4.5.1"/>
+    <!-- 
+      Some versions of transitive dependencies have to be overwritten, since the default versions
+      defined by the direct dependencies are marked as vulnerable packages on nuget.org.
+    -->
+    <PackageReference Include="System.Text.Encodings.Web" Version="8.0.0"/>
   </ItemGroup>
   <ItemGroup>
     <Compile Update="SR.Designer.cs">