Skip to content

Enable NuGet Audit and fix issues #107639

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 21 commits into from
Sep 25, 2024
Merged

Enable NuGet Audit and fix issues #107639

Show file tree
Hide file tree
Changes from 10 commits
Commits
Show all changes
21 commits
Select commit Hold shift + click to select a range
ef0df64
Enable NuGet Audit and fix issues
ericstj Sep 10, 2024
8bdf2f3
Fix package path on linux
ericstj Sep 10, 2024
8c96173
Only use live JSON from HostModel
ericstj Sep 10, 2024
69e424c
Add a couple missing assembly references
ericstj Sep 10, 2024
6408e8b
Refactor tasks dependencies
ericstj Sep 11, 2024
294f280
Fix audit warnings in tests
ericstj Sep 11, 2024
4453c4f
Remove MetadataLoadContext from WasmAppBuilder package
ericstj Sep 12, 2024
5a22046
Update Analyzer.Testing packages
ericstj Sep 12, 2024
fe775ec
Reduce exposure of Microsoft.Build.Tasks.Core
ericstj Sep 13, 2024
b84f010
Fix audit warnings that only occur on browser
ericstj Sep 13, 2024
c1d3d09
Update Asn1 used by linker analyzer tests
ericstj Sep 17, 2024
c87cdf6
Merge branch 'enableNuGetAudit' of https://github.com/ericstj/runtime…
ericstj Sep 17, 2024
a501794
React to breaking change in analyzer test SDK
ericstj Sep 17, 2024
36a7b29
Enable working DryIoc tests
ericstj Sep 17, 2024
da23192
Fix double-write when LibrariesConfiguration differs from Configuration
ericstj Sep 19, 2024
b365311
Merge branch 'main' of https://github.com/dotnet/runtime into enableN…
ericstj Sep 19, 2024
04ffd0e
Fix LibrariesConfiguration update target
ericstj Sep 20, 2024
72cedfe
Clean up references and add comments.
ericstj Sep 23, 2024
3772ac9
Make HostModel references private
ericstj Sep 23, 2024
d93f35c
Use ProjectReferenceExclusion to avoid framework project references
ericstj Sep 23, 2024
3da813d
Update src/libraries/System.Runtime.InteropServices.JavaScript/tests/…
ericstj Sep 24, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions NuGet.config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,10 @@
<add key="dotnet10" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet10/nuget/v3/index.json" />
<add key="dotnet10-transport" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet10-transport/nuget/v3/index.json" />
</packageSources>
<auditSources>
<clear />
<add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
</auditSources>
<disabledPackageSources>
<clear />
</disabledPackageSources>
Expand Down
18 changes: 18 additions & 0 deletions eng/PackageDownloadAndReference.targets
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
<Project>

<ItemDefinitionGroup>
<PackageDownloadAndReference>
<Folder>lib/$(TargetFramework)</Folder>
<AssemblyName>%(Identity)</AssemblyName>
<Private>false</Private>
</PackageDownloadAndReference>
</ItemDefinitionGroup>

<ItemGroup>
<PackageDownload Include="@(PackageDownloadAndReference)" />
<PackageDownload Update="@(PackageDownloadAndReference)" Version="[%(Version)]"/>
<PackageDownloadAndReference Update="@(PackageDownloadAndReference)" PackageFolder="$([System.String]::new(%(Identity)).ToLowerInvariant())" />
<Reference Include="@(PackageDownloadAndReference->'$(NuGetPackageRoot)%(PackageFolder)/%(Version)/%(Folder)/%(AssemblyName).dll')" />
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Won't this approach break the ability to use CPM and transitive pinning?

Copy link
Member Author

@ericstj ericstj Sep 11, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This doesn't pull any transitive dependencies at all. That's the point. It's a stand-in for a targeting pack. We pull down just single package and use it only for reference. It's very manual, but it avoids accidentally lifting dependencies that aren't in the control of the plugin (or pulling down dependencies just to drop them in favor of a framework library). It should be used sparingly as it is bypassing nuget resolution. It also doesn't persist into a packed project, so it shouldn't be used in "normal" libraries. It's for tasks, analyzers, and private assemblies intended for use in similar circumstances.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure but this means it's a different kind of package reference that you can't manage with CPM correct?

Copy link
Member Author

@ericstj ericstj Sep 12, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We'd just use the same properties when setting these that we'd feed into CPM. It's a temporary solution. We need an official package or SDK from MSBuild (and roslyn) for targeting hosts.

Nonetheless I added a note to NuGet/Home#8476 that would improve PackageDownload if it didn't need to mention versions.

If you felt strongly about making this hack honor CPM I could add that functionality by merging the version defined in @(PackageVersion) when not specified.

</ItemGroup>

</Project>
12 changes: 12 additions & 0 deletions eng/Version.Details.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -402,10 +402,22 @@
</Dependency>
<!-- Necessary for source-build. This allows the package to be retrieved from previously-source-built artifacts
and flow in as dependencies of the packages produced by runtime. -->
<Dependency Name="Nuget.Frameworks" Version="6.2.4">
<Uri>https://github.com/NuGet/NuGet.Client</Uri>
<Sha>8fef55f5a55a3b4f2c96cd1a9b5ddc51d4b927f8</Sha>
</Dependency>
<Dependency Name="Nuget.Packaging" Version="6.2.4">
<Uri>https://github.com/NuGet/NuGet.Client</Uri>
<Sha>8fef55f5a55a3b4f2c96cd1a9b5ddc51d4b927f8</Sha>
</Dependency>
<Dependency Name="Nuget.ProjectModel" Version="6.2.4">
<Uri>https://github.com/NuGet/NuGet.Client</Uri>
<Sha>8fef55f5a55a3b4f2c96cd1a9b5ddc51d4b927f8</Sha>
</Dependency>
<Dependency Name="Nuget.Versioning" Version="6.2.4">
<Uri>https://github.com/NuGet/NuGet.Client</Uri>
<Sha>8fef55f5a55a3b4f2c96cd1a9b5ddc51d4b927f8</Sha>
</Dependency>
<Dependency Name="runtime.linux-arm64.Microsoft.NETCore.Runtime.Wasm.Node.Transport" Version="9.0.0-alpha.1.24175.1">
<Uri>https://github.com/dotnet/node</Uri>
<Sha>308c7d0f1fa19bd1e7b768ad13646f5206133cdb</Sha>
Expand Down
7 changes: 5 additions & 2 deletions eng/Versions.props
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,6 +118,7 @@
<SystemComponentModelAnnotationsVersion>5.0.0</SystemComponentModelAnnotationsVersion>
<SystemDataSqlClientVersion>4.8.6</SystemDataSqlClientVersion>
<SystemDrawingCommonVersion>8.0.0</SystemDrawingCommonVersion>
<SystemFormatsAsn1Version>8.0.1</SystemFormatsAsn1Version>
<SystemIOFileSystemAccessControlVersion>5.0.0</SystemIOFileSystemAccessControlVersion>
<SystemMemoryVersion>4.5.5</SystemMemoryVersion>
<SystemReflectionMetadataVersion>9.0.0-rc.1.24410.5</SystemReflectionMetadataVersion>
Expand All @@ -135,7 +136,7 @@
<runtimenativeSystemIOPortsVersion>9.0.0-rc.1.24410.5</runtimenativeSystemIOPortsVersion>
<!-- Keep toolset versions in sync with dotnet/msbuild and dotnet/sdk -->
<SystemCollectionsImmutableToolsetVersion>8.0.0</SystemCollectionsImmutableToolsetVersion>
<SystemTextJsonToolsetVersion>8.0.0</SystemTextJsonToolsetVersion>
<SystemTextJsonToolsetVersion>8.0.4</SystemTextJsonToolsetVersion>
<SystemReflectionMetadataToolsetVersion>8.0.0</SystemReflectionMetadataToolsetVersion>
<SystemReflectionMetadataLoadContextToolsetVersion>8.0.0</SystemReflectionMetadataLoadContextToolsetVersion>
<!-- Runtime-Assets dependencies -->
Expand Down Expand Up @@ -173,8 +174,10 @@
<MicrosoftBuildTasksCoreVersion>$(MicrosoftBuildVersion)</MicrosoftBuildTasksCoreVersion>
<MicrosoftBuildFrameworkVersion>$(MicrosoftBuildVersion)</MicrosoftBuildFrameworkVersion>
<MicrosoftBuildUtilitiesCoreVersion>$(MicrosoftBuildVersion)</MicrosoftBuildUtilitiesCoreVersion>
<NugetFrameworksVersion>6.2.4</NugetFrameworksVersion>
<NugetProjectModelVersion>6.2.4</NugetProjectModelVersion>
<NugetPackagingVersion>6.2.4</NugetPackagingVersion>
<NugetVersioningVersion>6.2.4</NugetVersioningVersion>
<DotnetSosVersion>7.0.412701</DotnetSosVersion>
<DotnetSosTargetFrameworkVersion>6.0</DotnetSosTargetFrameworkVersion>
<!-- Testing -->
Expand Down Expand Up @@ -204,7 +207,7 @@
<GrpcCoreVersion>2.46.3</GrpcCoreVersion>
<GrpcDotnetClientVersion>2.45.0</GrpcDotnetClientVersion>
<GrpcToolsVersion>2.45.0</GrpcToolsVersion>
<CompilerPlatformTestingVersion>1.1.2-beta1.23323.1</CompilerPlatformTestingVersion>
<CompilerPlatformTestingVersion>1.1.3-beta1.24423.1</CompilerPlatformTestingVersion>
<CompilerPlatformTestingDiffPlexVersion>1.7.2</CompilerPlatformTestingDiffPlexVersion>
<CompilerPlatformTestingMicrosoftVisualBasicVersion>10.2.0</CompilerPlatformTestingMicrosoftVisualBasicVersion>
<CompilerPlatformTestingMicrosoftVisualStudioCompositionVersion>17.0.46</CompilerPlatformTestingMicrosoftVisualStudioCompositionVersion>
Expand Down
3 changes: 2 additions & 1 deletion src/installer/managed/Microsoft.NET.HostModel/Microsoft.NET.HostModel.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,8 +19,9 @@
</PropertyGroup>

<ItemGroup>
<!-- SDK pins this to a lower version https://github.com/dotnet/sdk/issues/43325 -->
<PackageReference Include="System.Reflection.Metadata" Version="$(SystemReflectionMetadataToolsetVersion)" />
<PackageReference Include="System.Text.Json" Version="$(SystemTextJsonToolsetVersion)" />
<ProjectReference Include="$(LibrariesProjectRoot)System.Text.Json\src\System.Text.Json.csproj" />
</ItemGroup>

<ItemGroup>
Expand Down
9 changes: 8 additions & 1 deletion ...rosoft.DotNet.CoreSetup.Packaging.Tests/Microsoft.DotNet.CoreSetup.Packaging.Tests.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,8 +7,15 @@
</PropertyGroup>

<ItemGroup>
<PackageReference Include="NuGet.Packaging" Version="$(NugetPackagingVersion)" />
<!-- reference nuget binaries directly to avoid restoring it's package dependency closure -->
<PackageDownloadAndReference Include="NuGet.Common" Version="$(NugetFrameworksVersion)" Folder="lib/netstandard2.0" Private="true" />
<PackageDownloadAndReference Include="NuGet.Frameworks" Version="$(NugetFrameworksVersion)" Folder="lib/netstandard2.0" Private="true" />
<PackageDownloadAndReference Include="NuGet.Packaging" Version="$(NugetPackagingVersion)" Folder="lib/netstandard2.0" Private="true" />
<PackageDownloadAndReference Include="NuGet.ProjectModel" Version="$(NugetProjectModelVersion)" Folder="lib/netstandard2.0" Private="true" />
<PackageDownloadAndReference Include="NuGet.Versioning" Version="$(NugetVersioningVersion)" Folder="lib/netstandard2.0" Private="true" />
</ItemGroup>

<Import Project="$(RepositoryEngineeringDir)PackageDownloadAndReference.targets" />

<ItemGroup>
<ProjectReference Include="..\TestUtils\TestUtils.csproj" />
Expand Down
1 change: 1 addition & 0 deletions ...s/Common/tests/System/Net/Security/Kerberos/System.Net.Security.Kerberos.Shared.projitems
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,5 +36,6 @@
</ItemGroup>
<ItemGroup>
<PackageReference Include="Kerberos.NET" Version="4.5.178" />
<ProjectReference Include="$(LibrariesProjectRoot)System.Security.Cryptography.Pkcs\src\System.Security.Cryptography.Pkcs.csproj" />
</ItemGroup>
</Project>
10 changes: 7 additions & 3 deletions ...I.External.Tests/Microsoft.Extensions.DependencyInjection.ExternalContainers.Tests.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
<Project Sdk="Microsoft.NET.Sdk">

<PropertyGroup>
Expand All @@ -18,16 +18,20 @@
<ProjectReference Include="$(LibrariesProjectRoot)Microsoft.Extensions.DependencyInjection\src\Microsoft.Extensions.DependencyInjection.csproj" SkipUseReferenceAssembly="true" />
<ProjectReference Include="$(LibrariesProjectRoot)Microsoft.Extensions.DependencyInjection.Abstractions\src\Microsoft.Extensions.DependencyInjection.Abstractions.csproj" SkipUseReferenceAssembly="true" />
<ProjectReference Include="$(LibrariesProjectRoot)Microsoft.Extensions.DependencyInjection.Specification.Tests\src\Microsoft.Extensions.DependencyInjection.Specification.Tests.csproj" />
<PackageReference Include="Autofac.Extensions.DependencyInjection" Version="8.0.0" />
<PackageReference Include="DryIoc.Microsoft.DependencyInjection" Version="5.1.0" />
<PackageReference Include="LightInject.Microsoft.DependencyInjection" Version="3.5.0" />
<PackageReference Include="Autofac.Extensions.DependencyInjection" Version="10.0.0" />
<PackageReference Include="DryIoc.Microsoft.DependencyInjection" Version="6.2.0" />
<PackageReference Include="LightInject.Microsoft.DependencyInjection" Version="3.7.1" />
<PackageReference Include="Grace.DependencyInjection.Extensions" Version="7.1.0" />
<PackageReference Include="Stashbox.Extensions.Dependencyinjection" Version="4.2.3" />
</ItemGroup>

<!-- These packages don't support .NETFramework -->
<ItemGroup Condition="'$(TargetFrameworkIdentifier)' == '.NETCoreApp'">
<PackageReference Include="Lamar.Microsoft.DependencyInjection" Version="8.0.1" />
<!-- Lamar depends on System.Runtime.Loader which brings in 1.x packages.
Those have audit warnings when runtime.* packages are brought in for RID-specific restore.
Avoid by referencing the latest Microsoft.NETCore.Targets which will prevent all 1.x runtime.* packages from being referenced. -->
<PackageReference Include="Microsoft.NETCore.Targets" Version="5.0.0" />
</ItemGroup>

</Project>
5 changes: 5 additions & 0 deletions ...osoft.Extensions.Logging.Generators.Tests/Microsoft.Extensions.Logging.Generators.targets
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,11 @@
<ItemGroup>
<ProjectReference Include="$(LibrariesProjectRoot)Microsoft.Extensions.Logging.Abstractions\src\Microsoft.Extensions.Logging.Abstractions.csproj" />
<PackageReference Include="Microsoft.CodeAnalysis" Version="$(RoslynApiVersion)" />
<!-- Ensure we are using live dependencies for CodeAnalysis rather than old packages -->
<PackageReference Include="NETStandard.Library" Version="$(NETStandardLibraryVersion)" />
<ProjectReference Include="$(LibrariesProjectRoot)System.Composition\src\System.Composition.csproj" />
<ProjectReference Include="$(LibrariesProjectRoot)System.IO.Pipelines\src\System.IO.Pipelines.csproj" />
<ProjectReference Include="$(LibrariesProjectRoot)System.Reflection.Metadata\src\System.Reflection.Metadata.csproj" />
<PackageReference Include="SQLitePCLRaw.bundle_green" Version="$(SQLitePCLRawbundle_greenVersion)" />
</ItemGroup>

Expand Down
9 changes: 7 additions & 2 deletions src/libraries/Microsoft.NETCore.Platforms/src/Microsoft.NETCore.Platforms.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,10 +41,15 @@
</ItemGroup>

<ItemGroup>
<PackageReference Include="Microsoft.Build.Tasks.Core" Version="$(MicrosoftBuildTasksCoreVersion)" />
<PackageReference Include="Newtonsoft.Json" Version="$(NewtonsoftJsonVersion)" />
<PackageDownloadAndReference Include="Microsoft.Build.Framework" Version="$(MicrosoftBuildFrameworkVersion)" Folder="ref/net472" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net472'))" />
<PackageDownloadAndReference Include="Microsoft.Build.Framework" Version="$(MicrosoftBuildFrameworkVersion)" Folder="ref/net8.0" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net8.0'))" />
<PackageDownloadAndReference Include="Microsoft.Build.Utilities.Core" Version="$(MicrosoftBuildUtilitiesCoreVersion)" Folder="ref/net472" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net472'))" />
<PackageDownloadAndReference Include="Microsoft.Build.Utilities.Core" Version="$(MicrosoftBuildUtilitiesCoreVersion)" Folder="ref/net8.0" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net8.0'))" />
<PackageDownloadAndReference Include="Newtonsoft.Json" Version="$(NewtonsoftJsonVersion)" Folder="lib/netstandard2.0" />
</ItemGroup>

<Import Project="$(RepositoryEngineeringDir)PackageDownloadAndReference.targets" />

<UsingTask TaskName="UpdateRuntimeIdentifierGraph" AssemblyFile="$(_generateRuntimeGraphTask)"/>
<Target Name="UpdateRuntimeIdentifierGraph"
AfterTargets="Build"
Expand Down
4 changes: 1 addition & 3 deletions src/libraries/Microsoft.XmlSerializer.Generator/tests/SerializableAssembly.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,9 +8,7 @@
</PropertyGroup>

<ItemGroup>
<PackageReference Include="Microsoft.Build.Tasks.Core" Version="$(MicrosoftBuildTasksCoreVersion)">
<PrivateAssets>all</PrivateAssets>
</PackageReference>
<ProjectReference Include="$(LibrariesProjectRoot)System.Reflection.Metadata\src\System.Reflection.Metadata.csproj" />
</ItemGroup>

<ItemGroup>
Expand Down
2 changes: 2 additions & 0 deletions ...rinsicsInSystemPrivatecoreLibAnalyzer.Tests/IntrinsicsInSystemPrivateCoreLib.Tests.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,8 @@
<PackageReference Include="DiffPlex" Version="$(CompilerPlatformTestingDiffPlexVersion)" />
<PackageReference Include="Microsoft.VisualBasic" Version="$(CompilerPlatformTestingMicrosoftVisualBasicVersion)" />
<PackageReference Include="Microsoft.VisualStudio.Composition" Version="$(CompilerPlatformTestingMicrosoftVisualStudioCompositionVersion)" />
<!-- Upgrade to a non-vulnerable version of Asn1 - which will be dropped by conflict resolution -->
<PackageReference Include="System.Formats.Asn1" Version="$(SystemFormatsAsn1Version)" />
</ItemGroup>

<ItemGroup>
Expand Down
3 changes: 3 additions & 0 deletions ...pServices.JavaScript/tests/JSImportGenerator.UnitTest/JSImportGenerator.Unit.Tests.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,9 @@
<PackageReference Include="Microsoft.VisualBasic" Version="$(CompilerPlatformTestingMicrosoftVisualBasicVersion)" />
<PackageReference Include="Microsoft.VisualStudio.Composition" Version="$(CompilerPlatformTestingMicrosoftVisualStudioCompositionVersion)" />

<!-- Upgrade to a non-vulnerable version of Asn1 - which will be dropped by conflict resolution -->
<PackageReference Include="System.Formats.Asn1" Version="$(SystemFormatsAsn1Version)" />

<None Include="$(RepoRoot)/NuGet.config" Link="NuGet.config" CopyToOutputDirectory="PreserveNewest" />
</ItemGroup>
</Project>
3 changes: 3 additions & 0 deletions ...opServices/tests/ComInterfaceGenerator.Unit.Tests/ComInterfaceGenerator.Unit.Tests.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,9 @@
<PackageReference Include="DiffPlex" Version="$(CompilerPlatformTestingDiffPlexVersion)" />
<PackageReference Include="Microsoft.VisualBasic" Version="$(CompilerPlatformTestingMicrosoftVisualBasicVersion)" />
<PackageReference Include="Microsoft.VisualStudio.Composition" Version="$(CompilerPlatformTestingMicrosoftVisualStudioCompositionVersion)" />

<!-- Upgrade to a non-vulnerable version of Asn1 - which will be dropped by conflict resolution -->
<PackageReference Include="System.Formats.Asn1" Version="$(SystemFormatsAsn1Version)" />
</ItemGroup>

<ItemGroup>
Expand Down
2 changes: 1 addition & 1 deletion ...eropServices/tests/LibraryImportGenerator.UnitTests/CustomMarshallerAttributeFixerTest.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ internal class CustomMarshallerAttributeFixerTest : CSharpCodeFixVerifier<Custom
// In particular, sort the equivalent subgroups by their diagnostic descriptor in the order that the fixer's fix-all provider
// will add the methods.
// This ensures that the iterative code-fix test will produce the same (deterministic) output as the fix-all tests.
protected override ImmutableArray<(Project project, Diagnostic diagnostic)> SortDistinctDiagnostics(IEnumerable<(Project project, Diagnostic diagnostic)> diagnostics)
protected override ImmutableArray<(Project project, Diagnostic diagnostic)> SortDistinctDiagnostics(ImmutableArray<(Project project, Diagnostic diagnostic)> diagnostics)
=> diagnostics.OrderBy(d => d.diagnostic.Location.GetLineSpan().Path, StringComparer.Ordinal)
.ThenBy(d => d.diagnostic.Location.SourceSpan.Start)
.ThenBy(d => d.diagnostic.Location.SourceSpan.End)
Expand Down
3 changes: 3 additions & 0 deletions ...pServices/tests/LibraryImportGenerator.UnitTests/LibraryImportGenerator.Unit.Tests.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,9 @@
<PackageReference Include="DiffPlex" Version="$(CompilerPlatformTestingDiffPlexVersion)" />
<PackageReference Include="Microsoft.VisualBasic" Version="$(CompilerPlatformTestingMicrosoftVisualBasicVersion)" />
<PackageReference Include="Microsoft.VisualStudio.Composition" Version="$(CompilerPlatformTestingMicrosoftVisualStudioCompositionVersion)" />

<!-- Upgrade to a non-vulnerable version of Asn1 - which will be dropped by conflict resolution -->
<PackageReference Include="System.Formats.Asn1" Version="$(SystemFormatsAsn1Version)" />
</ItemGroup>

<ItemGroup>
Expand Down
6 changes: 0 additions & 6 deletions ...ation.Xml/tests/XsdDataContractExporterTests/SerializationTypes/SerializationTypes.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,12 +13,6 @@
<EnableLibraryImportGenerator>false</EnableLibraryImportGenerator>
</PropertyGroup>

<ItemGroup>
<PackageReference Include="Microsoft.Build.Tasks.Core" Version="$(MicrosoftBuildTasksCoreVersion)">
<PrivateAssets>all</PrivateAssets>
</PackageReference>
</ItemGroup>

<ItemGroup>
<Compile Include="*.cs" />
</ItemGroup>
Expand Down
5 changes: 5 additions & 0 deletions ...ext.Json.SourceGeneration.Unit.Tests/System.Text.Json.SourceGeneration.Unit.Tests.targets
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,11 @@

<ItemGroup>
<PackageReference Include="Microsoft.CodeAnalysis" Version="$(RoslynApiVersion)" />
<!-- Ensure we are using live dependencies for CodeAnalysis rather than old packages -->
<PackageReference Include="NETStandard.Library" Version="$(NETStandardLibraryVersion)" />
<ProjectReference Include="$(LibrariesProjectRoot)System.Composition\src\System.Composition.csproj" />
<ProjectReference Include="$(LibrariesProjectRoot)System.IO.Pipelines\src\System.IO.Pipelines.csproj" />
<ProjectReference Include="$(LibrariesProjectRoot)System.Reflection.Metadata\src\System.Reflection.Metadata.csproj" />

<ProjectReference Include="..\..\src\System.Text.Json.csproj" />
</ItemGroup>
Expand Down
3 changes: 3 additions & 0 deletions ...Text.RegularExpressions/tests/FunctionalTests/System.Text.RegularExpressions.Tests.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,6 +81,9 @@
<PackageReference Include="Microsoft.VisualBasic" Version="$(CompilerPlatformTestingMicrosoftVisualBasicVersion)" />
<PackageReference Include="Microsoft.VisualStudio.Composition" Version="$(CompilerPlatformTestingMicrosoftVisualStudioCompositionVersion)" />

<!-- Upgrade to a non-vulnerable version of Asn1 - which will be dropped by conflict resolution -->
<PackageReference Include="System.Formats.Asn1" Version="$(SystemFormatsAsn1Version)" />

<ProjectReference Include="..\..\gen\System.Text.RegularExpressions.Generator.csproj"
SetTargetFramework="TargetFramework=netstandard2.0"
OutputItemType="Analyzer"
Expand Down
2 changes: 2 additions & 0 deletions src/mono/wasm/symbolicator/WasmSymbolicator.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,8 @@

<ItemGroup>
<PackageReference Include="Microsoft.DotNet.XHarness.Common" Version="$(MicrosoftDotNetXHarnessTestRunnersCommonVersion)" />
<!-- Update and drop package assets from Json, we'll use the framework version -->
<PackageReference Include="System.Text.Json" Version="$(SystemTextJsonToolsetVersion)" PrivateAssets="All" ExcludeAssets="All" />
</ItemGroup>

<ItemGroup>
Expand Down
3 changes: 0 additions & 3 deletions src/tasks/AndroidAppBuilder/AndroidAppBuilder.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,9 +10,6 @@
<ItemGroup>
<EmbeddedResource Include="Templates\*.*" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="Microsoft.Build.Tasks.Core" Version="$(MicrosoftBuildTasksCoreVersion)" />
</ItemGroup>
<ItemGroup>
<ProjectReference Include="$(RepoRoot)src\tasks\MobileBuildTasks\MobileBuildTasks.csproj" />
</ItemGroup>
Expand Down
5 changes: 0 additions & 5 deletions src/tasks/AotCompilerTask/MonoAOTCompiler.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,11 +11,6 @@
<NoWarn Condition="$(TargetFramework.StartsWith('net4'))">$(NoWarn),CS8604,CS8602</NoWarn>
<CopyLocalLockFileAssemblies>true</CopyLocalLockFileAssemblies>
</PropertyGroup>
<ItemGroup>
<PackageReference Include="Microsoft.Build" Version="$(MicrosoftBuildVersion)" />
<PackageReference Include="Microsoft.Build.Tasks.Core" Version="$(MicrosoftBuildTasksCoreVersion)" />
<PackageReference Include="System.Reflection.Metadata" Version="$(SystemReflectionMetadataToolsetVersion)" />
</ItemGroup>
<ItemGroup>
<Compile Include="MonoAOTCompiler.cs" />
<Compile Include="..\Common\CompilerCache.cs" />
Expand Down
3 changes: 0 additions & 3 deletions src/tasks/AppleAppBuilder/AppleAppBuilder.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,9 +10,6 @@
<ItemGroup>
<EmbeddedResource Include="Templates\*.*" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="Microsoft.Build.Tasks.Core" Version="$(MicrosoftBuildTasksCoreVersion)" />
</ItemGroup>
<ItemGroup>
<Compile Include="AppleAppBuilder.cs" />
<Compile Include="..\Common\Utils.cs" />
Expand Down
9 changes: 6 additions & 3 deletions src/tasks/Crossgen2Tasks/Crossgen2Tasks.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,12 @@
<NoWarn>$(NoWarn),CA1050</NoWarn>
</PropertyGroup>
<ItemGroup>
<PackageReference Include="Microsoft.Build.Tasks.Core" Version="$(MicrosoftBuildTasksCoreVersion)" />
<PackageReference Include="NuGet.ProjectModel" Version="$(NugetProjectModelVersion)" />
</ItemGroup>
<PackageDownloadAndReference Include="Newtonsoft.Json" Version="$(NewtonsoftJsonVersion)" Folder="lib/netstandard2.0" />
<PackageDownloadAndReference Include="NuGet.Frameworks" Version="$(NugetFrameworksVersion)" Folder="lib/netstandard2.0" />
<PackageDownloadAndReference Include="NuGet.Packaging" Version="$(NugetPackagingVersion)" Folder="lib/netstandard2.0" />
<PackageDownloadAndReference Include="NuGet.ProjectModel" Version="$(NugetProjectModelVersion)" Folder="lib/netstandard2.0" />
<PackageDownloadAndReference Include="NuGet.Versioning" Version="$(NugetVersioningVersion)" Folder="lib/netstandard2.0" />
</ItemGroup>
<ItemGroup>
<Content Include="Microsoft.NET.CrossGen.targets">
<CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
Expand Down
Loading
Loading