diff --git a/eng/Npm.Workspace.nodeproj b/eng/Npm.Workspace.nodeproj
index 58722e78cc3a..c168ca2728e7 100644
--- a/eng/Npm.Workspace.nodeproj
+++ b/eng/Npm.Workspace.nodeproj
@@ -36,7 +36,7 @@
-
diff --git a/eng/Versions.props b/eng/Versions.props
index 56c700a54d46..9530049a5162 100644
--- a/eng/Versions.props
+++ b/eng/Versions.props
@@ -282,7 +282,7 @@
$(MicrosoftAspNetCoreAzureAppServicesSiteExtension80Version)
$(MicrosoftAspNetCoreAzureAppServicesSiteExtension80Version)
- 1.11.3
+ 1.11.4
0.9.9
0.13.0
4.2.1
@@ -328,7 +328,7 @@
$(XunitVersion)
$(XunitVersion)
2.4.3
- 4.0.5
+ 5.2.2
1.6.17
1.6.17
diff --git a/eng/scripts/npm/update-dependency-versions.mjs b/eng/scripts/npm/update-dependency-versions.mjs
index ce8b9b42c6d7..3cee60be697c 100644
--- a/eng/scripts/npm/update-dependency-versions.mjs
+++ b/eng/scripts/npm/update-dependency-versions.mjs
@@ -38,19 +38,25 @@ export function applyVersions(defaultPackageVersion, workspacePath) {
return [packagesToPack, renames];
}
-function applyPackageVersion(packagesToPack, defaultPackageVersion) {
+function applyPackageVersion(packagesToPack, packageVersion) {
const currentDir = process.cwd();
const renames = [];
for (const [packagePath, packageJson] of packagesToPack) {
- const packageName = packageJson.name;
- const packageVersion = defaultPackageVersion;
- const packageDir = path.dirname(packagePath);
// Run npm version packageVersion --no-git-tag-version
// This will update the package.json version to the specified version without creating a git tag
// Make a backup of the package.json
fs.copyFileSync(packagePath, `${packagePath}.bak`);
renames.push([`${packagePath}.bak`, packagePath]);
+ // "npm version ..." fails if it wouldn't change the version which is common for local builds.
+ // Rather than fail the build, we'll produce packages versions with the "-dev" suffix.
+ if (packageJson.version === packageVersion) {
+ continue;
+ }
+
+ const packageName = packageJson.name;
+ const packageDir = path.dirname(packagePath);
+
process.chdir(packageDir);
execSync(`npm version ${packageVersion} --no-git-tag-version`, { stdio: 'inherit' });
process.chdir(currentDir);
diff --git a/src/ProjectTemplates/Shared/Project.cs b/src/ProjectTemplates/Shared/Project.cs
index ed00a32f7f8e..8fc9a152dc2f 100644
--- a/src/ProjectTemplates/Shared/Project.cs
+++ b/src/ProjectTemplates/Shared/Project.cs
@@ -142,6 +142,20 @@ internal async Task RunDotNetNewAsync(
CaptureBinLogOnFailure(restoreExecution);
Assert.True(0 == restoreResult.ExitCode, ErrorMessages.GetFailedProcessMessage("restore", this, restoreResult));
+
+ // We must specify nuget.org as a source because the Azure DevOps feeds do not support the --vulnerable flag.
+ // If we restored packages from nuget.org, we could remove the following check since the restore itself would produce
+ // NuGet vulnerability warnings, but we avoid using nuget.org as a source for the restore to avoid supply chain attacks.
+ // https://learn.microsoft.com/nuget/reference/errors-and-warnings/nu1901-nu1904
+ argString = "list package --vulnerable --include-transitive --source https://api.nuget.org/v3/index.json";
+ using var listVulnerableExecution = ProcessEx.Run(Output, TemplateOutputDir, DotNetMuxer.MuxerPathOrDefault(), argString, environmentVariables);
+ await listVulnerableExecution.Exited;
+
+ if (listVulnerableExecution.ExitCode != 0 || !listVulnerableExecution.Output.Contains("has no vulnerable packages"))
+ {
+ // We consider this part of the build step, since the build would normally warn about vulnerable packages if not for --no-restore.
+ Assert.Fail(ErrorMessages.GetFailedProcessMessage("restore", this, new ProcessResult(listVulnerableExecution)));
+ }
}
}
diff --git a/src/ProjectTemplates/TestInfrastructure/PrepareForTest.targets b/src/ProjectTemplates/TestInfrastructure/PrepareForTest.targets
index 4e1a98035f07..d332234acaa5 100644
--- a/src/ProjectTemplates/TestInfrastructure/PrepareForTest.targets
+++ b/src/ProjectTemplates/TestInfrastructure/PrepareForTest.targets
@@ -88,7 +88,10 @@
<_FilesToCopy Include="$(LocalDotNetRoot)sdk\**\*" DestinationRelativeFolder="sdk\" />
<_FilesToCopy Include="$(SharedFrameworkLayoutRoot)\**\*" />
- <_DestinationFiles Include="@(_FilesToCopy->'$(TemplateTestDotNetRoot)%(DestinationRelativeFolder)%(RecursiveDir)%(Filename)%(Extension)')" />
+ <_PrelimDestinationFiles Include="@(_FilesToCopy->'$(TemplateTestDotNetRoot)%(DestinationRelativeFolder)%(RecursiveDir)%(Filename)%(Extension)')" />
+ <_DestinationFiles Include="@(_PrelimDestinationFiles)" Condition="!$([MSBuild]::IsOSPlatform(`Windows`))" />
+
+ <_DestinationFiles Include="@(_PrelimDestinationFiles->'\\?\%(Identity)')" Condition="$([MSBuild]::IsOSPlatform(`Windows`))" />
-
-
+
+
+
diff --git a/src/ProjectTemplates/Web.ProjectTemplates/Microsoft.DotNet.Web.ProjectTemplates.csproj b/src/ProjectTemplates/Web.ProjectTemplates/Microsoft.DotNet.Web.ProjectTemplates.csproj
index 01fd5e06eafd..9ba5a7cb108c 100644
--- a/src/ProjectTemplates/Web.ProjectTemplates/Microsoft.DotNet.Web.ProjectTemplates.csproj
+++ b/src/ProjectTemplates/Web.ProjectTemplates/Microsoft.DotNet.Web.ProjectTemplates.csproj
@@ -6,6 +6,9 @@
ASP.NET Core Web Template Pack for Microsoft Template Engine
$(RepoRoot)src\Components\WebAssembly\
true
+
+
+ true
@@ -14,6 +17,7 @@
DefaultNetCoreTargetFramework=$(DefaultNetCoreTargetFramework);
GrpcAspNetCoreVersion=$(GrpcAspNetCoreVersion);
MicrosoftAspNetCoreMvcRazorRuntimeCompilationVersion=$(MicrosoftAspNetCoreMvcRazorRuntimeCompilationVersion);
+ MicrosoftDataSqlClientVersion=$(MicrosoftDataSqlClientVersion);
MicrosoftEntityFrameworkCoreSqliteVersion=$(MicrosoftEntityFrameworkCoreSqliteVersion);
MicrosoftEntityFrameworkCoreSqlServerVersion=$(MicrosoftEntityFrameworkCoreSqlServerVersion);
MicrosoftEntityFrameworkCoreToolsVersion=$(MicrosoftEntityFrameworkCoreToolsVersion);
@@ -24,8 +28,9 @@
MicrosoftIdentityWebUIVersion=$(MicrosoftIdentityWebUIVersion);
MicrosoftIdentityWebDownstreamApiVersion=$(MicrosoftIdentityWebDownstreamApiVersion);
MicrosoftNETCoreAppRuntimeVersion=$(MicrosoftNETCoreAppRuntimeVersion);
- SystemNetHttpJsonVersion=$(SystemNetHttpJsonVersion);
MicrosoftGraphVersion=$(MicrosoftGraphVersion);
+ SystemDrawingCommonVersion=$(SystemDrawingCommonVersion);
+ SystemTextJsonVersion=$(SystemTextJsonVersion);
@@ -64,6 +69,11 @@
+
+
+
+
+
diff --git a/src/ProjectTemplates/Web.ProjectTemplates/RazorPagesWeb-CSharp.csproj.in b/src/ProjectTemplates/Web.ProjectTemplates/RazorPagesWeb-CSharp.csproj.in
index 2ed95f454912..6a5f32095f7e 100644
--- a/src/ProjectTemplates/Web.ProjectTemplates/RazorPagesWeb-CSharp.csproj.in
+++ b/src/ProjectTemplates/Web.ProjectTemplates/RazorPagesWeb-CSharp.csproj.in
@@ -20,6 +20,7 @@
+
@@ -30,6 +31,8 @@
+
+
diff --git a/src/ProjectTemplates/Web.ProjectTemplates/StarterWeb-CSharp.csproj.in b/src/ProjectTemplates/Web.ProjectTemplates/StarterWeb-CSharp.csproj.in
index c900105fff89..515b1ecebba0 100644
--- a/src/ProjectTemplates/Web.ProjectTemplates/StarterWeb-CSharp.csproj.in
+++ b/src/ProjectTemplates/Web.ProjectTemplates/StarterWeb-CSharp.csproj.in
@@ -20,6 +20,7 @@
+
@@ -30,6 +31,8 @@
+
+