Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[build] Update NuGet package versions (#196)
Context: https://dev.azure.com/xamarin/public/_componentGovernance/115226/alert/3150206?typeId=5477311 Context: https://dev.azure.com/xamarin/public/_componentGovernance/115226/alert/6875331?typeId=5477311 Context: dotnet/java-interop@5318261 [Component Governance][0] is a Microsoft internal tool which checks for known security issues in product dependencies. It is currently reporting a defects in xamarin-android-tools due to use of older `System.Net.Http` packages ([CVE-2018-8292][0]) and older `System.Security.Cryptography.X509Certificates` packages ([CVE-2017-11770][1]): > **Location** > > * /s/packages/system.net.http/4.1.0/system.net.http.4.1.0.nupkg > * /s/packages/system.net.http/4.1.0/system.net.http.nuspec > * /s/packages/system.security.cryptography.x509certificates/4.1.0/system.security.cryptography.x509certificates.4.1.0.nupkg > * /s/packages/system.security.cryptography.x509certificates/4.1.0/system.security.cryptography.x509certificates.nuspec The "odd" thing is that xamarin-android-tools doesn't *use* either of these dependencies! They appear to be pulled in via package dependencies. Rework how we use `@(PackageReference)` so that `Directory.Build.targets` uses [the `Update` attribute][2] to centralize package version specification, except within `MSBuildReferences.projitems` as it's `<Import/>`ed by xamarin-android. Update most NuGet package versions to the latest versions provided by `dotnet-public` or `dotnet-eng` (which may not be the latest versions on NuGet.org). While stable versions are generally preferred, we use Microsoft.NET.Test.Sdk version 17.5.0-preview-20221003-04 to ensure that we avoid Newtonsoft.Json 9.0.1 issues a'la dotnet/java-interop@53182615. NuGet Package Version Bumps: * Microsoft.Build : `16.10.0` -> `17.3.2` * Microsoft.Build.Framework : `16.10.0` -> `17.3.2` * Microsoft.Build.Tasks.Core : `16.10.0` -> `17.3.2` * Microsoft.Build.Utilities.Core : `16.10.0` -> `17.3.2` * Microsoft.NET.Test.Sdk : `16.5.0` -> `17.5.0-preview-20221003-04` * nunit : `3.12.0` -> `3.13.2` * NUnit3TestAdapter : `3.16.1` -> `4.0.0` [0]: https://nvd.nist.gov/vuln/detail/CVE-2018-8292 [1]: https://nvd.nist.gov/vuln/detail/CVE-2017-11770 [2]: https://learn.microsoft.com/en-us/visualstudio/msbuild/item-element-msbuild?view=vs-2022#attributes-and-elements
- Loading branch information