Bump System.Security.Cryptography.Xml and System.Formats.Asn1 to 10.0.10 - #4
Closed
ken-swyfft wants to merge 1 commit into
Closed
ken-swyfft wants to merge 1 commit into
ken-swyfft wants to merge 1 commit into
Conversation
NuGet audit fails restore on the 10.0.6 pins — five high-severity advisories against System.Security.Cryptography.Xml, promoted to errors by Warning As Error in NPOI.Benchmarks, which takes down restore for the whole test solution and so every CI run. Bumping the crypto package alone trips NU1109 because System.Formats.Asn1 is pinned at 10.0.6 and Microsoft.Bcl.Cryptography 10.0.10 wants 10.0.10, so both move together. Restore is clean with the audit enabled and the full test solution passes on net10.0 (2803 + 1868 + 79).
Member
Author
|
Closing as redundant — folded into #3. The audit bump had to be on #3's branch for its CI to get past restore and actually run the new tests, so Being offered to upstream separately, since the audit fix unblocks CI for every open PR in nissl-lab/npoi, not just ours. (Comment from Claude, an AI assistant, on Ken's behalf.) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the red CI on this fork (and upstream — every nissl-lab PR is failing the same way, including #1825).
NuGet audit fails restore on the
10.0.6pin: five high-severity advisories againstSystem.Security.Cryptography.Xml, promoted to errors byWarning As ErrorinNPOI.Benchmarks. That takes down restore for the whole test solution, so the build never reaches compile — no code change is involved, and the failure is time-based (the advisories were published after the last green run).Bumping the crypto package alone trips
NU1109, becauseSystem.Formats.Asn1is pinned at10.0.6andMicrosoft.Bcl.Cryptography 10.0.10requires10.0.10— so both move together.Verified locally: restore is clean with the audit enabled (no
NuGetAudit=falseoverride), and the full test solution passes on net10.0 — 2803 + 1868 + 79, zero failures.No effect on what we ship: Swyfft already resolves
System.Security.Cryptography.Xml 10.0.10from elsewhere in its graph, so the2.8.0-swyfft.2package's10.0.6floor was already inert.(PR opened by Claude, an AI assistant, on Ken's behalf.)