Update dependency packages and address transitive dependencies with v…

…ulnerabilities
pakrym · Dec 17, 2024 · 4989ec7 · 4989ec7
1 parent 64ed230
commit 4989ec7
Show file tree

Hide file tree

Showing 5 changed files with 20 additions and 17 deletions.
diff --git a/src/Jab.FunctionalTests.Common/Jab.FunctionalTests.Common.props b/src/Jab.FunctionalTests.Common/Jab.FunctionalTests.Common.props
@@ -3,20 +3,21 @@
   <Import Project="$(MSBuildThisFileDirectory)/Jab.FunctionalTest.props" />
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.4.0" />
-    <PackageReference Include="xunit" Version="2.4.2" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="2.4.5" Condition="'$(TargetFramework)' != 'netstandard2.0'">
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.12.0" />
+    <PackageReference Include="xunit" Version="2.9.2" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="3.0.0" Condition="'$(TargetFramework)' != 'netstandard2.0'">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>
-    <PackageReference Include="coverlet.collector" Version="1.3.0">
+    <PackageReference Include="coverlet.collector" Version="6.0.2">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>
-    <PackageReference Include="Microsoft.CodeAnalysis.CSharp.Analyzer.Testing.XUnit" Version="1.1.1" />
+    <PackageReference Include="Microsoft.CodeAnalysis.CSharp.Analyzer.Testing.XUnit" Version="1.1.2" />
+	<!-- Override transitive package version System.Formats.Asn1 to address vulnerability: https://github.com/advisories/GHSA-447r-wph3-92pm -->
+	<PackageReference Include="System.Formats.Asn1" Version="9.0.0" />
     <PackageReference Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="4.4.0" />
-
-    <ProjectReference Include="..\Jab.FunctionalTests.Module\Jab.FunctionalTests.Module.csproj" />
+	  <ProjectReference Include="..\Jab.FunctionalTests.Module\Jab.FunctionalTests.Module.csproj" />
     <Compile Include="$(MSBuildThisFileDirectory)\**\*.cs" />
   </ItemGroup>
 

diff --git a/src/Jab.FunctionalTests.MEDI/Jab.FunctionalTests.MEDI.csproj b/src/Jab.FunctionalTests.MEDI/Jab.FunctionalTests.MEDI.csproj
@@ -9,7 +9,7 @@
   <ItemGroup>
     <PackageReference Condition="'$(TargetFramework)' == 'net472'" Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="2.1.0"/>
     <PackageReference Condition="'$(TargetFramework)' == 'netstandard2.0'" Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="2.1.0"/>
-    <PackageReference Condition="'$(TargetFramework)' == 'net8.0'" Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="8.0.0"/>
+    <PackageReference Condition="'$(TargetFramework)' == 'net8.0'" Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="8.0.2"/>
     <PackageReference Condition="'$(TargetFramework)' == 'net9.0'" Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="9.0.0"/>
   </ItemGroup>
 </Project>
diff --git a/src/Jab.Performance/Jab.Performance.csproj b/src/Jab.Performance/Jab.Performance.csproj
@@ -8,8 +8,8 @@
 
   <ItemGroup>
     <PackageReference Include="Jab" Version="0.10.2" PrivateAssets="all" />
-    <PackageReference Include="BenchmarkDotNet" Version="0.12.1" />
-    <PackageReference Include="Microsoft.Extensions.DependencyInjection" Version="5.0.1" />
+    <PackageReference Include="BenchmarkDotNet" Version="0.14.0" />
+    <PackageReference Include="Microsoft.Extensions.DependencyInjection" Version="9.0.0" />
   </ItemGroup>
 
 </Project>
diff --git a/src/Jab.Tests/Jab.Tests.csproj b/src/Jab.Tests/Jab.Tests.csproj
@@ -9,17 +9,19 @@
 
     <Content Include="..\Jab\Attributes.cs" CopyToOutputDirectory="PreserveNewest" />
 
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.4.0" />
-    <PackageReference Include="xunit" Version="2.4.2" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="2.4.5">
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.12.0" />
+    <PackageReference Include="xunit" Version="2.9.2" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="3.0.0">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>
-    <PackageReference Include="coverlet.collector" Version="1.3.0">
+    <PackageReference Include="coverlet.collector" Version="6.0.2">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>
-    <PackageReference Include="Microsoft.CodeAnalysis.CSharp.Analyzer.Testing.XUnit" Version="1.1.1" />
+    <PackageReference Include="Microsoft.CodeAnalysis.CSharp.Analyzer.Testing.XUnit" Version="1.1.2" />
+	<!-- Override transitive package version System.Formats.Asn1 to address vulnerability: https://github.com/advisories/GHSA-447r-wph3-92pm -->
+	<PackageReference Include="System.Formats.Asn1" Version="9.0.0" />
     <PackageReference Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="4.4.0" />
   </ItemGroup>
 </Project>
diff --git a/src/Jab/Jab.csproj b/src/Jab/Jab.csproj
@@ -1,4 +1,4 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
 
     <PropertyGroup>
         <TargetFramework>netstandard2.0</TargetFramework>
@@ -36,7 +36,7 @@
     </ItemGroup>
 
     <ItemGroup>
-        <PackageReference Include="Microsoft.SourceLink.GitHub" Version="1.1.1" PrivateAssets="All" />
+        <PackageReference Include="Microsoft.SourceLink.GitHub" Version="8.0.0" PrivateAssets="All" />
     </ItemGroup>
 
     <Import Project="Jab.Common.props" />