Skip to content

Sdk 2805 net security dependency upgrades#545

Open
mehmet-yoti wants to merge 4 commits into
developmentfrom
SDK-2805-net-security-dependency-upgrades
Open

Sdk 2805 net security dependency upgrades#545
mehmet-yoti wants to merge 4 commits into
developmentfrom
SDK-2805-net-security-dependency-upgrades

Conversation

@mehmet-yoti
Copy link
Copy Markdown
Contributor

Summary

Closes all High and Critical CVEs reported by dotnet list package --vulnerable --include-transitive across the core SDK, test project,
and all four example apps. Also performs hygiene bumps on aged-but-unflagged core SDK pins. Work split across 4 commits so each phase can
be reviewed (and reverted) independently.

Baseline scan (before this PR)

Project Package Severity Advisory
CoreExample, DigitalIdentity, DocScan System.Text.Encodings.Web 4.5.0 Critical GHSA-ghhp-997w-qr28
All 4 examples System.Text.RegularExpressions 4.3.0 High GHSA-cmhx-cq75-c4mj

Both pulled in transitively via Microsoft.AspNetCore.Hosting.Abstractions 2.2.0, Microsoft.AspNetCore.StaticFiles 2.2.0,
Microsoft.VisualStudio.Web.CodeGeneration.Design 3.1.4, and DotNetEnv 2.3.0. The core SDK (Yoti.Auth.csproj) and test project
reported zero advisories but had several years-stale pins worth bumping defensively.

Phases

Phase 1 — Example app transitive CVE fixes (0730934)

Example Changes
CoreExample, DigitalIdentity Drop Microsoft.AspNetCore.Hosting.Abstractions 2.2.0 and Microsoft.AspNetCore.StaticFiles 2.2.0
(built-in via Microsoft.NET.Sdk.Web). Drop Microsoft.VisualStudio.Web.CodeGeneration.Design 3.1.4 and deprecated
DotNetCliToolReference (scaffolding-only, not used at runtime). Microsoft.CodeAnalysis.{Common,CSharp,CSharp.Workspaces} 4.9.2/4.2.0
→ 4.13.0. Microsoft.VisualStudio.Azure.Containers.Tools.Targets 1.20.1/1.16.1 → 1.23.0
DocScan Drop Microsoft.VisualStudio.Web.CodeGeneration.Design 3.1.4
Aml Newtonsoft.Json 13.0.3 → 13.0.4
All 4 DotNetEnv 2.3.0 → 3.2.0; explicit System.Text.RegularExpressions 4.3.1 override (because DotNetEnv 3.2.0 still drags in
the vulnerable 4.3.0 via ancient Microsoft.Extensions.Configuration 1.1.2NETStandard.Library 1.6.1)

Phase 2 — Core SDK hygiene bumps (3cf4463)

No advisory reported against src/Yoti.Auth/Yoti.Auth.csproj, but several pins are years out of date. Bumps:

Package Before After Notes
Google.Protobuf 3.26.1 3.30.2 Stay on 3.x; wire/API compatible with existing src/Yoti.Auth/ProtoBuf/**/*.cs, no regen needed
JsonSubTypes 1.9.0 2.0.1 Major bump
Newtonsoft.Json 13.0.3 13.0.4 Latest 13.x patch
NLog 5.0.1 5.5.1 Latest 5.x; holding back from 6.x to keep legacy TFM support
Portable.BouncyCastle 1.8.5 1.9.0 Per-TFM gated: 1.9.0 dropped netstandard1.6, so 1.8.5 is held for that legacy target only
Microsoft.CodeAnalysis.NetAnalyzers 7.0.3 9.0.0 Analyzer only
System.Net.Http 4.3.4 gated Now scoped to net452/462/472/48 and netstandard1.6 only — on
netstandard2.1/netcoreapp3.1/net6.0 the in-box BCL HttpClient is used; the NuGet shim was unnecessary

All 8 SDK target frameworks build clean on Windows (netstandard1.6;netstandard2.1;netcoreapp3.1;net6.0;net452;net462;net472;net48).
On macOS only the modern targets build; Azure Pipelines windows-latest covers the legacy matrix.

Phase 3 — Test project bumps (d9131c1)

coverlet.msbuild 6.0.2 → 6.0.4 (minor reliability patch).

Attempted broader upgrades but reverted as out-of-scope for a security PR:

  • MSTest.{TestAdapter,TestFramework} 2.2.10 → 3.6.4: surfaces 3 pre-existing test bugs around ThrowsExceptionAsync semantics. No
    advisory against MSTest 2.2.10.
  • Microsoft.NET.Test.Sdk 17.2.0 → 17.13.0: requires MSTest 3.x.
  • Moq 4.18.1 → 4.18.4 (within [4.18.4,4.20.0) to avoid the 4.20+ SponsorLink telemetry): 4.18.4 introduces a regression in
    dynamic-argument serialization that breaks DocScanClientTests.GetSessionConfigurationShouldSucceed (OutOfMemoryException in
    JsonConvert.SerializeObject of a Moq-captured dynamic). Holding 4.18.1; no advisory against it.

Phase 4 — System.Net.Http transitive fix in examples (82ed952)

After Phase 2 gated System.Net.Http 4.3.4 to legacy TFMs in the core SDK, the example apps re-surfaced a High advisory
GHSA-7jgj-8wvc-jh57 via DotNetEnv 3.2.0Microsoft.Extensions.Configuration 1.1.2NETStandard.Library 1.6.1
System.Net.Http 4.3.0.

Added an explicit PackageReference Include="System.Net.Http" Version="4.3.4" to each of the 4 example csproj files to force NuGet to
resolve the patched shim.

Closes the Critical GHSA-ghhp-997w-qr28 (System.Text.Encodings.Web 4.5.0)
in CoreExample/DigitalIdentity/DocScan and the High GHSA-cmhx-cq75-c4mj
(System.Text.RegularExpressions 4.3.0) across all four examples.

CoreExample & DigitalIdentityExample:
- Drop Microsoft.AspNetCore.Hosting.Abstractions 2.2.0 and
  Microsoft.AspNetCore.StaticFiles 2.2.0 (in-box via Microsoft.NET.Sdk.Web)
- Drop Microsoft.VisualStudio.Web.CodeGeneration.Design 3.1.4 and
  deprecated DotNetCliToolReference (scaffolding-only, not used at runtime)
- Microsoft.CodeAnalysis.{Common,CSharp,CSharp.Workspaces} 4.9.2/4.2.0 -> 4.13.0
- Microsoft.VisualStudio.Azure.Containers.Tools.Targets 1.20.1/1.16.1 -> 1.23.0

DocScanExample: drop Microsoft.VisualStudio.Web.CodeGeneration.Design 3.1.4.

AmlExample: Newtonsoft.Json 13.0.3 -> 13.0.4.

All four examples: DotNetEnv 2.3.0 -> 3.2.0, plus explicit
System.Text.RegularExpressions 4.3.1 to override the vulnerable 4.3.0
that DotNetEnv 3.2.0 still drags in transitively via
Microsoft.Extensions.Configuration 1.1.2 -> NETStandard.Library 1.6.1.

Verified: dotnet list package --vulnerable --include-transitive reports
zero findings on all four example projects; all four build clean.
No advisory currently reports against Yoti.Auth.csproj, but several
pins are years out of date. Bumps:

- Google.Protobuf 3.26.1 -> 3.30.2 (stay on 3.x; wire/API compatible
  with existing src/Yoti.Auth/ProtoBuf/**/*.cs, no regen needed)
- JsonSubTypes 1.9.0 -> 2.0.1
- Newtonsoft.Json 13.0.3 -> 13.0.4
- NLog 5.0.1 -> 5.5.1 (latest 5.x; holding back from 6.x to keep
  legacy TFM support)
- Portable.BouncyCastle 1.8.5 -> 1.9.0 (per-TFM gated: 1.9.0 dropped
  netstandard1.6, so we keep 1.8.5 for that legacy target only)
- Microsoft.CodeAnalysis.NetAnalyzers 7.0.3 -> 9.0.0 (analyzer only)
- System.Net.Http 4.3.4: gated to legacy TFMs only (net452/462/472/48
  and netstandard1.6). On netstandard2.1/netcoreapp3.1/net6.0 the
  in-box BCL HttpClient is used; the NuGet shim is unnecessary and
  was causing potential assembly conflicts.

Verified: all 8 TFMs build clean; dotnet list --vulnerable reports
zero findings.
Conservative test-project bump. Attempted broader upgrades but reverted:

- MSTest.{TestAdapter,TestFramework} 2.2.10 -> 3.6.4: surfaces 3 pre-
  existing test bugs around ThrowsExceptionAsync semantics. Out of
  scope for a security PR; MSTest 2.2.10 has no advisory.
- Microsoft.NET.Test.Sdk 17.2.0 -> 17.13.0: requires MSTest 3.x.
- Moq 4.18.1 -> 4.18.4 (within [4.18.4,4.20.0) range to avoid the 4.20+
  SponsorLink telemetry): 4.18.4 introduces a regression in dynamic-
  argument serialization that breaks DocScanClientTests
  (OutOfMemoryException in JsonConvert.SerializeObject of a Moq-captured
  dynamic). Holding 4.18.1; no advisory against it.

All 811 tests pass.
GHSA-7jgj-8wvc-jh57

After Phase 2 gated System.Net.Http 4.3.4 to legacy TFMs only in the
core SDK, the four example apps re-surfaced the High advisory via
DotNetEnv 3.2.0 -> Microsoft.Extensions.Configuration 1.1.2 ->
NETStandard.Library 1.6.1 -> System.Net.Http 4.3.0 (the vulnerable
pre-patch version).

Adding an explicit PackageReference for 4.3.4 (the fixed shim) in
each example forces NuGet to resolve the patched version transitively.

Verified: dotnet list --vulnerable --include-transitive reports zero
findings across all 6 projects (core, tests, 4 examples). All 811
tests pass; all 5 buildable projects compile clean.
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR resolves all High/Critical CVEs reported by dotnet list package --vulnerable --include-transitive across the SDK, test project, and example apps, while also doing defensive hygiene bumps on aged pins in the core SDK. The changes are split into four phases (example transitive CVE fixes, core SDK hygiene bumps, test project bumps, and a follow-up System.Net.Http transitive fix in examples).

Changes:

  • Replace vulnerable transitive packages in the four example projects by removing redundant Microsoft.AspNetCore.*/Microsoft.VisualStudio.Web.CodeGeneration.Design/DotNetCliToolReference, upgrading DotNetEnv/Microsoft.CodeAnalysis.*/Microsoft.VisualStudio.Azure.Containers.Tools.Targets, and pinning explicit System.Text.RegularExpressions 4.3.1 and System.Net.Http 4.3.4 overrides.
  • Bump core SDK pins (Google.Protobuf, JsonSubTypes 1.9→2.0.1 major, Newtonsoft.Json, NLog, Microsoft.CodeAnalysis.NetAnalyzers) and gate Portable.BouncyCastle 1.9.0/System.Net.Http 4.3.4 per-TFM so legacy targets keep working.
  • Bump coverlet.msbuild 6.0.2 → 6.0.4 in the test project.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file
File Description
src/Yoti.Auth/Yoti.Auth.csproj Core SDK package bumps; per-TFM gating for Portable.BouncyCastle and System.Net.Http; JsonSubTypes major version bump
src/Examples/Profile/CoreExample/CoreExample.csproj Drop redundant ASP.NET/scaffolding refs, bump DotNetEnv/CodeAnalysis/Containers.Tools, add explicit System.Net.Http/System.Text.RegularExpressions overrides
src/Examples/DigitalIdentity/DigitalIdentity/DigitalIdentityExample.csproj Same pattern as CoreExample
src/Examples/DocScan/DocScanExample/DocScanExample.csproj Drop CodeGeneration.Design, bump DotNetEnv, add transitive CVE override pins
src/Examples/Aml/AmlExample/AmlExample.csproj Bump DotNetEnv/Newtonsoft.Json, add transitive CVE override pins
test/Yoti.Auth.Tests/Yoti.Auth.Tests.csproj Patch bump of coverlet.msbuild

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants