chore: pin NuGet transitives in build/ to clear 8 advisories - #585
Merged
Conversation
build/Build.csproj pulled 7 high-severity advisories (NU1903) on System.Security.Cryptography.Xml 9.0.0 and 1 low (NU1901) on NuGet.Packaging 6.12.1, both transitively through Nuke.Common 10.1.0. Nuke.Common 10.1.0 is already the latest release, so bumping it isn't an option - pin both transitives up directly instead. 9.0.18 is the patched floor covering all seven crypto advisories (9.0.15 clears only four); NuGet.Packaging 6.12.5 is the patched release on the same 6.12.x line Nuke builds against. These never showed up in a local solution restore because Build.csproj is marked <Build Project="false" /> in jasperfx.slnx, so `dotnet restore jasperfx.slnx` skips it entirely - they were only visible in CI logs. `dotnet restore build/Build.csproj` is now fully clean, and `./build.sh` still bootstraps and runs. Closes #584 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #584
What
build/Build.csprojpulled 8 advisories transitively throughNuke.Common 10.1.0:Nuke.Common 10.1.0is already the latest release, so this can't be fixed by bumping Nuke. Both transitives are pinned up directly instead:System.Security.Cryptography.Xml→ 9.0.18, the patched floor covering all seven high-severity advisories (9.0.15clears only four of them).NuGet.Packaging→ 6.12.5, the patched release on the same6.12.xline Nuke already builds against.The issue only proposed the crypto pin and left the low-severity
NuGet.Packagingone open pending Nuke. It turned out to be fixable the same way —6.12.5is a patch on the line Nuke targets, not a line move — so restore now comes back completely clean rather than one-warning clean.Why it was invisible locally
build/Build.csprojis marked<Build Project="false" />injasperfx.slnx, sodotnet restore jasperfx.slnxskips it. Only./build.shrestores it, which is why these showed up in CI logs but never in a local solution restore.Risk
Contained. Nothing is shipped from
build/— it's the dev/CI-time Nuke orchestrator only, so adding dependencies there has zero consumer impact.build/already opts out of central package management via its ownDirectory.Packages.props, so inline versions are the established pattern in that directory.Verification
The Nuke host still bootstraps and runs against the pinned
NuGet.Packaging. Full./build.sh testruns in CI on this PR.🤖 Generated with Claude Code