Skip to content

Conversation

@mthalman
Copy link
Member

@mthalman mthalman commented Jul 6, 2023

Updates the package versions due to reporting of CVE-2023-29337 for 6.2.2 version.

There were no packages outside of this set of NuGet packages that had any dependencies on these updated packages, so there was no need to update any references.

Fixes dotnet/source-build#3541

@MichaelSimons
Copy link
Member

This is going to have to happen in multiple stages.

  1. Add the new package so that arcade can upgrade
  2. Once arcade upgrades and flows into the VMR, remove the vulnerable version.

If done in once stage, SBRP won't be able to flow into the VMR until arcade does. This would effectively block all other SBRP changes from flowing into the VMR which could be bad and block other work.

@mthalman mthalman changed the title Upgrade NuGet.* packages from 6.2.2 to 6.2.4 Add NuGet.*.6.2.4 packages Jul 6, 2023
@mthalman
Copy link
Member Author

mthalman commented Jul 6, 2023

I've updated to include these as new packages instead of upgrading 6.2.2 to 6.2.4.

Adds the following packages:

  • NuGet.Frameworks.6.2.4
  • NuGet.Common.6.2.4
  • NuGet.Versioning.6.2.4
  • NuGet.Configuration.6.2.4
  • NuGet.Packaging.6.2.4
  • NuGet.LibraryModel.6.2.4
  • NuGet.Protocol.6.2.4
  • NuGet.DependencyResolver.Core.6.2.4
  • NuGet.ProjectModel.6.2.4
  • NuGet.Credentials.6.2.4
  • NuGet.Commands.6.2.4

@mthalman mthalman merged commit 81a9aad into main Jul 6, 2023
@mthalman mthalman deleted the nuget-upgrade branch July 6, 2023 21:03
@mthalman mthalman mentioned this pull request Sep 14, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Component governance report on NuGet.Commands.6.2.2 in SBRP

3 participants