Add a direct reference to System.Configuration.ConfigurationManager v…#2886
Add a direct reference to System.Configuration.ConfigurationManager v…#2886Numpsy wants to merge 1 commit into
Conversation
|
This shouldn't be need after the .NET 8 update as all the transient dependencies are using newer versions anyway, so it's a question of if it's useful for a 6.1.5 before that. |
There was a problem hiding this comment.
Pull request overview
This PR aims to mitigate a transitive dependency chain that pulls in older, vulnerable .NET assemblies by making Fake.DotNet.MSBuild explicitly reference System.Configuration.ConfigurationManager (intended to align with the v6.x already used elsewhere, per the PR description).
Changes:
- Added
System.Configuration.ConfigurationManagertoFake.DotNet.MSBuild’spaket.references.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| NETStandard.Library | ||
| MSBuild.StructuredLogger | ||
| BlackFox.VsWhere | ||
| System.Configuration.ConfigurationManager |
| FSharp.Core | ||
| NETStandard.Library | ||
| MSBuild.StructuredLogger | ||
| BlackFox.VsWhere | ||
| System.Configuration.ConfigurationManager |
There was a problem hiding this comment.
I would prefer some order like System, FSharp, Microsoft, Other
| System.Configuration.ConfigurationManager | |
| System.Configuration.ConfigurationManager | |
| FSharp.Core | |
| NETStandard.Library | |
| MSBuild.StructuredLogger | |
| BlackFox.VsWhere |
…6.0.0 to Fake.DotNet.MSBuild refs fsprojects#2871 This attempts to remove a transient reference to old versions of System.Drawing.Common with known CVEs by directly referencing a newer version of ConfigurationManager fake-cli is already using v6 (it's included in the fake-cli tool nuget package) which hopefully means it's already had some testing with that version
xperiandri
force-pushed
the
update_systemconfig
branch
from
5274e61 to
1c78682
Compare
|
Anyway, this won't be needed if #2852 is finished, so do we want it, or not? |
…6.0.0 to Fake.DotNet.MSBuild
refs #2871
This attempts to remove a transient reference to old versions of System.Drawing.Common with known CVEs by directly referencing a newer version of ConfigurationManager
fake-cli is already using v6 (it's included in the fake-cli tool nuget package) which hopefully means it's already had some testing with that version