Skip to content

Add NuGet.*.6.2.4 packages #740

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jul 6, 2023
Merged

Add NuGet.*.6.2.4 packages #740

merged 1 commit into from
Jul 6, 2023

Conversation

mthalman
Copy link
Member

@mthalman mthalman commented Jul 6, 2023

Updates the package versions due to reporting of CVE-2023-29337 for 6.2.2 version.

There were no packages outside of this set of NuGet packages that had any dependencies on these updated packages, so there was no need to update any references.

Fixes dotnet/source-build#3541

@MichaelSimons
Copy link
Member

This is going to have to happen in multiple stages.

  1. Add the new package so that arcade can upgrade
  2. Once arcade upgrades and flows into the VMR, remove the vulnerable version.

If done in once stage, SBRP won't be able to flow into the VMR until arcade does. This would effectively block all other SBRP changes from flowing into the VMR which could be bad and block other work.

@mthalman mthalman changed the title Upgrade NuGet.* packages from 6.2.2 to 6.2.4 Add NuGet.*.6.2.4 packages Jul 6, 2023
@mthalman
Copy link
Member Author

mthalman commented Jul 6, 2023

I've updated to include these as new packages instead of upgrading 6.2.2 to 6.2.4.

Adds the following packages:

  • NuGet.Frameworks.6.2.4
  • NuGet.Common.6.2.4
  • NuGet.Versioning.6.2.4
  • NuGet.Configuration.6.2.4
  • NuGet.Packaging.6.2.4
  • NuGet.LibraryModel.6.2.4
  • NuGet.Protocol.6.2.4
  • NuGet.DependencyResolver.Core.6.2.4
  • NuGet.ProjectModel.6.2.4
  • NuGet.Credentials.6.2.4
  • NuGet.Commands.6.2.4

@mthalman mthalman merged commit 81a9aad into main Jul 6, 2023
@mthalman mthalman deleted the nuget-upgrade branch July 6, 2023 21:03
@mthalman mthalman mentioned this pull request Sep 14, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Component governance report on NuGet.Commands.6.2.2 in SBRP
2 participants