fix(deps): bump System.Security.Cryptography.Xml 8.0.3 → 8.0.4 to clear NU1903 CVE advisories - #1482
Merged
aaronpowell merged 1 commit intoJul 27, 2026
Conversation
Clears NU1903 build errors from six published high-severity advisories against 8.0.3 (GHSA-23rf-6693-g89p, GHSA-8q5v-6pqq-x66h, GHSA-cvvh-rhrc-wg4q, GHSA-g8r8-53c2-pm3f, GHSA-mmjf-rqrv-855v, and one more). 8.0.4 is Microsoft's CVE patch release. Affects only projects that transitively pull the package — currently Microsoft.PowerShell.SDK 7.4.10 in the Kind PowerShell integration — but is felt on every whole-solution build because <NuGetAudit>true and <TreatWarningsAsErrors>true are enabled repo-wide. Verified locally: full restore + build succeeds, no new errors, no version conflicts, all affected projects build cleanly. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7c8c8109-2ae6-407b-8740-8c3018abe8f1
Contributor
|
🚀 Dogfood this PR with:
curl -fsSL https://raw.githubusercontent.com/CommunityToolkit/Aspire/main/eng/scripts/dogfood-pr.sh | bash -s -- 1482Or
iex "& { $(irm https://raw.githubusercontent.com/CommunityToolkit/Aspire/main/eng/scripts/dogfood-pr.ps1) } 1482" |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the repo-wide pinned NuGet dependency System.Security.Cryptography.Xml to a patched version to eliminate NU1903 audit advisory build breaks under the repository’s NuGetAudit + TreatWarningsAsErrors configuration.
Changes:
- Bump
System.Security.Cryptography.Xmlfrom8.0.3to8.0.4in central package management (Directory.Packages.props) to clear high-severity advisory warnings.
tamirdresher
pushed a commit
to tamirdresher/Aspire-1
that referenced
this pull request
Jul 26, 2026
Temporary hunk to unblock CI for this PR. See CommunityToolkit#1482 for the standalone fix. If that PR merges first, this commit can be reverted with `git revert HEAD` before this PR is merged. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7c8c8109-2ae6-407b-8740-8c3018abe8f1
4 tasks
aaronpowell
approved these changes
Jul 27, 2026
edmondshtogu
pushed a commit
to edmondshtogu/CommunityToolkit-Aspire
that referenced
this pull request
Jul 27, 2026
…nityToolkit#1482) Clears NU1903 build errors from six published high-severity advisories against 8.0.3 (GHSA-23rf-6693-g89p, GHSA-8q5v-6pqq-x66h, GHSA-cvvh-rhrc-wg4q, GHSA-g8r8-53c2-pm3f, GHSA-mmjf-rqrv-855v, and one more). 8.0.4 is Microsoft's CVE patch release. Affects only projects that transitively pull the package — currently Microsoft.PowerShell.SDK 7.4.10 in the Kind PowerShell integration — but is felt on every whole-solution build because <NuGetAudit>true and <TreatWarningsAsErrors>true are enabled repo-wide. Verified locally: full restore + build succeeds, no new errors, no version conflicts, all affected projects build cleanly. Co-authored-by: Copilot <Copilot@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7c8c8109-2ae6-407b-8740-8c3018abe8f1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
Directory.Packages.propscurrently pinsSystem.Security.Cryptography.Xmlat8.0.3, which has six published high-severity advisories (GHSA-23rf-6693-g89p,GHSA-8q5v-6pqq-x66h,GHSA-cvvh-rhrc-wg4q,GHSA-g8r8-53c2-pm3f,GHSA-mmjf-rqrv-855v, and one more). With<NuGetAudit>trueand<TreatWarningsAsErrors>trueenabled repo-wide, these becomeNU1903build errors on every whole-solution CI job.Every open PR that touches anything is currently failing on this, including Dependabot bumps (#1476, #1477, #1478) that don't touch PowerShell at all.
Fix
Bump to
8.0.4— Microsoft's CVE patch release, stillnet8.0-compatible.Verification
dotnet restore CommunityToolkit.Aspire.slnx— 0 errors, 0 NU1903dotnet build src/…/PowerShell/…csproj— succeedsdotnet build src/…/Kind/…csproj— succeedsdotnet test tests/…/Kind.Tests/…csproj— 149/149 pass (spot check for no regression)Scope
Directory.Packages.props— single line. Nothing else touched.