Skip to content

Commit d9e4486

Browse files
kevinchaletkevinchalet
committed
Set NuGetAuditMode to "all" to enable vulnerable transitive dependencies warnings
1 parent 362c283 commit d9e4486

File tree

6 files changed

+32
-7
lines changed

6 files changed

+32
-7
lines changed

‎Directory.Build.props‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,9 @@
77
<EnableNETAnalyzers>true</EnableNETAnalyzers>
88
<AnalysisLevel>preview</AnalysisLevel>
99
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
10-
<NoWarn>$(NoWarn);CS1591;NETSDK1206;NU5118;NU5128;xUnit2002</NoWarn>
10+
<NoWarn>$(NoWarn);CS1591;NU5128</NoWarn>
1111
<WarningsNotAsErrors>NU1901;NU1902;NU1903;NU1904</WarningsNotAsErrors>
12-
<NuGetAuditMode>direct</NuGetAuditMode>
12+
<NuGetAuditMode>all</NuGetAuditMode>
1313
<Nullable>enable</Nullable>
1414
<ImplicitUsings>enable</ImplicitUsings>
1515
<DebugSymbols>true</DebugSymbols>

‎Directory.Packages.props‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@
4545
<PackageVersion Include="MongoDB.Driver" Version="3.2.1" />
4646
<PackageVersion Include="Quartz.Extensions.DependencyInjection" Version="3.14.0" />
4747
<PackageVersion Include="System.Collections.Immutable" Version="8.0.0" />
48+
<PackageVersion Include="System.Interactive.Async" Version="3.2.0" />
4849
<PackageVersion Include="System.Net.Http.Json" Version="8.0.1" />
4950

5051
<!--
@@ -76,6 +77,7 @@
7677
<PackageVersion Include="Microsoft.AspNet.WebApi.Owin" Version="5.3.0" />
7778
<PackageVersion Include="Microsoft.AspNetCore" Version="2.3.0" />
7879
<PackageVersion Include="Microsoft.AspNetCore.Authentication.Cookies" Version="2.3.0" />
80+
<PackageVersion Include="Microsoft.AspNetCore.Identity" Version="2.3.1" />
7981
<PackageVersion Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore" Version="2.3.0" />
8082
<PackageVersion Include="Microsoft.AspNetCore.Mvc" Version="2.3.0" />
8183
<PackageVersion Include="Microsoft.AspNetCore.StaticFiles" Version="2.3.0" />
@@ -239,6 +241,7 @@
239241
<PackageVersion Include="Quartz.Extensions.DependencyInjection" Version="3.14.0" />
240242
<PackageVersion Include="System.Collections.Immutable" Version="8.0.0" />
241243
<PackageVersion Include="System.ComponentModel.Annotations" Version="5.0.0" />
244+
<PackageVersion Include="System.Interactive.Async" Version="3.2.0" />
242245
<PackageVersion Include="System.Net.Http.Json" Version="8.0.1" />
243246

244247
<!--
@@ -287,6 +290,7 @@
287290
<PackageVersion Include="Quartz.Extensions.DependencyInjection" Version="3.14.0" />
288291
<PackageVersion Include="System.Collections.Immutable" Version="8.0.0" />
289292
<PackageVersion Include="System.ComponentModel.Annotations" Version="5.0.0" />
293+
<PackageVersion Include="System.Interactive.Async" Version="3.2.0" />
290294
<PackageVersion Include="System.Net.Http.Json" Version="8.0.1" />
291295

292296
<!--

‎sandbox/OpenIddict.Sandbox.AspNetCore.Server/OpenIddict.Sandbox.AspNetCore.Server.csproj‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,13 @@
2020
</ItemGroup>
2121

2222
<ItemGroup Condition=" '$(TargetFrameworkIdentifier)' == '.NETFramework' ">
23+
<!--
24+
Note: Microsoft.AspNetCore.Identity is explicitly referenced to override the vulnerable
25+
2.3.0 version referenced by the Microsoft.AspNetCore.Identity.EntityFrameworkCore package.
26+
-->
27+
2328
<PackageReference Include="Microsoft.AspNetCore" />
29+
<PackageReference Include="Microsoft.AspNetCore.Identity" />
2430
<PackageReference Include="Microsoft.AspNetCore.Mvc" />
2531
<PackageReference Include="Microsoft.AspNetCore.StaticFiles" />
2632
</ItemGroup>

‎src/OpenIddict.EntityFrameworkCore/OpenIddict.EntityFrameworkCore.csproj‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,21 @@
2222
<PackageReference Include="Microsoft.EntityFrameworkCore.Relational" />
2323
</ItemGroup>
2424

25+
<!--
26+
Note: Entity Framework Core 2.3 references an old System.Interactive.Async version
27+
that doesn't include a .NET Standard 2.0 target framework moniker and depends on the
28+
legacy NETStandard.Library 1.6.0 package that references vulnerable versions of the
29+
System.Net.Http and System.Security.Cryptography.X509Certificates packages. While the
30+
inbox implementation of these packages is always going to be preferred in practice,
31+
OpenIddict explicitly references a newer version of System.Interactive.Async that is
32+
natively compatible with .NET Standard 2.0 to avoid having to ignore NuGet warnings.
33+
-->
34+
35+
<ItemGroup
36+
Condition=" '$(TargetFrameworkIdentifier)' == '.NETFramework' Or '$(TargetFrameworkIdentifier)' == '.NETStandard' ">
37+
<PackageReference Include="System.Interactive.Async" />
38+
</ItemGroup>
39+
2540
<ItemGroup>
2641
<Using Include="OpenIddict.Abstractions" />
2742
<Using Include="OpenIddict.Abstractions.OpenIddictConstants" Static="true" />

‎test/OpenIddict.Abstractions.Tests/Primitives/OpenIddictConverterTests.cs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -150,8 +150,8 @@ public void Read_PreservesEmptyParameters()
150150
Assert.NotNull(message.GetParameter("array"));
151151
Assert.NotNull(message.GetParameter("object"));
152152
Assert.Empty(((string?) message.GetParameter("string"))!);
153-
Assert.NotNull((JsonElement?) message.GetParameter("array"));
154-
Assert.NotNull((JsonElement?) message.GetParameter("object"));
153+
Assert.True(((JsonElement?) message.GetParameter("array")).HasValue);
154+
Assert.True(((JsonElement?) message.GetParameter("object")).HasValue);
155155
Assert.NotNull((JsonNode?) message.GetParameter("array"));
156156
Assert.NotNull((JsonNode?) message.GetParameter("object"));
157157
}

‎test/OpenIddict.Abstractions.Tests/Primitives/OpenIddictMessageTests.cs‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -194,9 +194,9 @@ public void AddParameter_PreservesEmptyParameters()
194194

195195
// Assert
196196
Assert.Empty(((string?) message.GetParameter("string"))!);
197-
Assert.NotNull((JsonElement?) message.GetParameter("array"));
198-
Assert.NotNull((JsonElement?) message.GetParameter("object"));
199-
Assert.NotNull((JsonElement?) message.GetParameter("value"));
197+
Assert.True(((JsonElement?) message.GetParameter("array")).HasValue);
198+
Assert.True(((JsonElement?) message.GetParameter("object")).HasValue);
199+
Assert.True(((JsonElement?) message.GetParameter("value")).HasValue);
200200
Assert.NotNull((JsonNode?) message.GetParameter("node_array"));
201201
Assert.NotNull((JsonNode?) message.GetParameter("node_object"));
202202
Assert.NotNull((JsonNode?) message.GetParameter("node_value"));

0 commit comments

Comments
 (0)