From e667b42ae394cd19d283c44f0456311e773c0e9d Mon Sep 17 00:00:00 2001 From: Sadeq Abu-Hattem Date: Mon, 2 Nov 2026 20:25:16 +0200 Subject: [PATCH] Move Aspire to 13.6.4, and what it pulls along Aspire.Hosting.AppHost 13.6.4 depends on Microsoft.Extensions.* 10.0.12, and with central transitive pinning the 10.0.11 pins turned that into NU1109 downgrade errors on the AppHost restore. Every 10.0.11 pin moves to 10.0.12 together, as they did for 13.5, so Microsoft.Extensions, EF Core, OpenApi and the test hosts stay on one patch level. That raises the dependency floor of the published packages by one patch. The comment above the pins now gives Aspire as the reason for 10.0.12 and keeps 10.0.11 as the OpenApi security floor, which was the reason it gave before. Microsoft.Data.SqlClient goes from 6.1.6 to 6.1.8 in the same change, for a different reason: NuGet now flags System.Security.Cryptography.Pkcs 9.0.11, which 6.1.6 brings in, under CVE-2026-70162 and CVE-2026-84008 (both affect <= 9.0.20). Warnings-as-errors made that a restore failure in the integration tests, and since restore runs solution-wide it stopped the whole build, with or without the Aspire bump. 6.1.8 depends on Pkcs 9.0.21, which is patched, so there is no need to pin Pkcs directly. 7.1.1 would not have helped, because it depends on 9.0.18. Only the integration tests and the sample use SqlClient, so no published package changes. Verified: the solution builds with 0 warnings, `dotnet list package --vulnerable --include-transitive` is clean, and unit (188 x2), provider (54 x2), API (51 x2) and integration (140, against Testcontainers Postgres, SQL Server and MongoDB) tests all pass. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 4 +- Directory.Packages.props | 54 +++++++++---------- .../DotNetBoost.Settings.AppHost.csproj | 2 +- 3 files changed, 31 insertions(+), 29 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index afe530b..28acb94 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,7 +5,9 @@ This project follows [Semantic Versioning](https://semver.org/). ## [Unreleased] -_Nothing yet._ +### Changed +- Aspire moved from 13.5.2 to 13.6.4, and Microsoft.Extensions.* and EF Core packages from 10.0.11 to 10.0.12 — the floor Aspire 13.6 requires. +- Microsoft.Data.SqlClient (integration tests and sample only) moved from 6.1.6 to 6.1.8, which takes System.Security.Cryptography.Pkcs 9.0.21 and clears CVE-2026-70162 and CVE-2026-84008. ## [1.0.0-preview.2] — 2026-10-10 diff --git a/Directory.Packages.props b/Directory.Packages.props index 73276d1..21af109 100644 --- a/Directory.Packages.props +++ b/Directory.Packages.props @@ -5,38 +5,38 @@ - - - - - - + + + + + + - - + + - - - - + + + + - - + + - - + + - - + + @@ -80,7 +80,7 @@ - + @@ -111,11 +111,11 @@ - - - - - - + + + + + + diff --git a/aspire/DotNetBoost.Settings.AppHost/DotNetBoost.Settings.AppHost.csproj b/aspire/DotNetBoost.Settings.AppHost/DotNetBoost.Settings.AppHost.csproj index d3a8621..a915e22 100644 --- a/aspire/DotNetBoost.Settings.AppHost/DotNetBoost.Settings.AppHost.csproj +++ b/aspire/DotNetBoost.Settings.AppHost/DotNetBoost.Settings.AppHost.csproj @@ -2,7 +2,7 @@ - + Exe