You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@lucenenet.apache.org by "paulirwin (via GitHub)" <gi...@apache.org> on 2026/08/09 20:57:42 UTC
[PR] Bump Microsoft.Extensions parent version to 10.0.10 [lucenenet]
paulirwin opened a new pull request, #1435:
URL: https://github.com/apache/lucenenet/pull/1435
- [X] You've read the [Contributor Guide](https://github.com/apache/lucenenet/blob/master/CONTRIBUTING.md) and [Code of Conduct](https://www.apache.org/foundation/policies/conduct.html).
- [ ] You've included unit or integration tests for your change, where applicable.
- [ ] You've included inline docs for your change, where applicable.
- [ ] There's an open issue for the PR that you are making. If you'd like to propose a change, please [open an issue](https://github.com/apache/lucenenet/issues/new/choose) to discuss the change or find an existing issue.
Bump Microsoft.Extensions parent version to 10.0.10
## Description
This fixes a few vulnerabilities in System.Security.Cryptography.Xml 10.0.7.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@lucenenet.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Bump Microsoft.Extensions parent version to 10.0.10 [lucenenet]
Posted by "paulirwin (via GitHub)" <gi...@apache.org>.
paulirwin commented on code in PR #1435:
URL: https://github.com/apache/lucenenet/pull/1435#discussion_r3745258394
##########
.build/dependencies.props:
##########
@@ -49,7 +49,7 @@
<MicrosoftCodeAnalysisCSharpWorkspacesPackageVersion>$(MicrosoftCodeAnalysisCSharpPackageVersion)</MicrosoftCodeAnalysisCSharpWorkspacesPackageVersion>
<MicrosoftCodeAnalysisVisualBasicPackageVersion>2.6.1</MicrosoftCodeAnalysisVisualBasicPackageVersion>
<MicrosoftCodeAnalysisVisualBasicWorkspacesPackageVersion>$(MicrosoftCodeAnalysisVisualBasicPackageVersion)</MicrosoftCodeAnalysisVisualBasicWorkspacesPackageVersion>
- <MicrosoftExtensionsParentVersion>10.0.7</MicrosoftExtensionsParentVersion>
+ <MicrosoftExtensionsParentVersion>10.0.10</MicrosoftExtensionsParentVersion>
Review Comment:
It is a transitive dependency. Anyone building the code would have seen the warnings. I do not think the proper solution is to pin an explicit reference. We already have established via these variables that upgrading all at once is what we want to do.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@lucenenet.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Bump Microsoft.Extensions parent version to 10.0.10 [lucenenet]
Posted by "paulirwin (via GitHub)" <gi...@apache.org>.
paulirwin merged PR #1435:
URL: https://github.com/apache/lucenenet/pull/1435
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@lucenenet.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Bump Microsoft.Extensions parent version to 10.0.10 [lucenenet]
Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #1435:
URL: https://github.com/apache/lucenenet/pull/1435#discussion_r3745255652
##########
.build/dependencies.props:
##########
@@ -49,7 +49,7 @@
<MicrosoftCodeAnalysisCSharpWorkspacesPackageVersion>$(MicrosoftCodeAnalysisCSharpPackageVersion)</MicrosoftCodeAnalysisCSharpWorkspacesPackageVersion>
<MicrosoftCodeAnalysisVisualBasicPackageVersion>2.6.1</MicrosoftCodeAnalysisVisualBasicPackageVersion>
<MicrosoftCodeAnalysisVisualBasicWorkspacesPackageVersion>$(MicrosoftCodeAnalysisVisualBasicPackageVersion)</MicrosoftCodeAnalysisVisualBasicWorkspacesPackageVersion>
- <MicrosoftExtensionsParentVersion>10.0.7</MicrosoftExtensionsParentVersion>
+ <MicrosoftExtensionsParentVersion>10.0.10</MicrosoftExtensionsParentVersion>
Review Comment:
PR description claims this bump fixes vulnerabilities in `System.Security.Cryptography.Xml 10.0.7`, but this repo doesn’t appear to reference `System.Security.Cryptography.Xml` anywhere (no direct PackageReference or version property found). This change only bumps the shared `MicrosoftExtensionsParentVersion` used for `Microsoft.Extensions.*` packages, so please either (a) clarify/update the PR description to reference the actual vulnerable dependency being addressed, or (b) add/update an explicit reference/version pin for `System.Security.Cryptography.Xml` if that is truly the affected package (e.g., via a direct PackageReference or central version management).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@lucenenet.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org