Skip to content

Bump Jint and 22 others #403

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Bump Jint and 22 others #403

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 24 additions & 24 deletions Directory.Packages.props
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
<ItemGroup>
<PackageVersion Include="CalloraVoipSdk" Version="4.10.0" />
<PackageVersion Include="coverlet.collector" Version="10.0.1" />
<PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.11" />
<PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.12" />
<!-- Mindestens 10.0.10: zieht System.Security.Cryptography.Xml transitiv auf den
Patch, der die HIGH-Advisory (NU1903, GHSA-mmjf-rqrv-855v u.a.) schließt. Wer diese
Zeile senkt, holt sie zurück — die Untergrenze ist der Punkt, nicht die genaue Zahl.
Expand All @@ -17,8 +17,8 @@
das gegen das veröffentlichte Callora.Core baut, bekam wieder 10.0.9 samt Advisory.
Aufgefallen ist das erst, als ein Plugin AUSSERHALB des Repositories gegen die
Pakete gebaut wurde; im Repo ist der Fehler unsichtbar. -->
<PackageVersion Include="Microsoft.AspNetCore.DataProtection.EntityFrameworkCore" Version="10.0.11" />
<PackageVersion Include="Microsoft.AspNetCore.TestHost" Version="10.0.11" />
<PackageVersion Include="Microsoft.AspNetCore.DataProtection.EntityFrameworkCore" Version="10.0.12" />
<PackageVersion Include="Microsoft.AspNetCore.TestHost" Version="10.0.12" />
<!-- Roslyn analyzer authoring (Callora.Analyzers, REV2 §7). 4.8.0 targets a broadly
compatible Roslyn; analyzers bind to the host compiler, not this version.
NICHT anheben, ohne die Compiler-Version des ÄLTESTEN unterstützten SDK zu kennen:
Expand All @@ -30,51 +30,51 @@
<!-- Surface-Template-Engine (ADR-015 rev.): sandboxbarer .NET-JS-Interpreter,
führt das gebündelte Nunjucks (native Twig-Block-Vererbung) im gehärteten
Modus aus (kein CLR-Interop, Timeout/Memory/Recursion-Limits). -->
<PackageVersion Include="Jint" Version="4.15.3" />
<PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="4.8.0" />
<PackageVersion Include="Microsoft.CodeAnalysis.Analyzers" Version="5.6.0" />
<PackageVersion Include="Jint" Version="4.16.2" />
<PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="5.9.0" />
<PackageVersion Include="Microsoft.CodeAnalysis.Analyzers" Version="5.9.0" />
<!-- Public-API baseline tracking (REV2 §7.3, WP-G2): any change to the public
surface of a framework assembly must show up as a reviewable diff. -->
<PackageVersion Include="Microsoft.CodeAnalysis.PublicApiAnalyzers" Version="5.6.0" />
<PackageVersion Include="Microsoft.EntityFrameworkCore" Version="10.0.11" />
<PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.11" />
<PackageVersion Include="Microsoft.EntityFrameworkCore" Version="10.0.12" />
<PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.12" />
<!-- Nur für Tests: eine Verdrahtungsprüfung, die eine echte Schreiboperation braucht,
soll dafür weder Docker noch Postgres verlangen. -->
<PackageVersion Include="Microsoft.EntityFrameworkCore.InMemory" Version="10.0.11" />
<PackageVersion Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.11" />
<PackageVersion Include="Microsoft.EntityFrameworkCore.InMemory" Version="10.0.12" />
<PackageVersion Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.12" />
<PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.11" />
<PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.11" />
<PackageVersion Include="Microsoft.Extensions.Http.Resilience" Version="10.9.0" />
<PackageVersion Include="Microsoft.Extensions.TimeProvider.Testing" Version="10.9.0" />
<PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
<PackageVersion Include="MinVer" Version="7.0.0" />
<PackageVersion Include="Microsoft.Extensions.Http.Resilience" Version="10.10.0" />
<PackageVersion Include="Microsoft.Extensions.TimeProvider.Testing" Version="10.10.0" />
<PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.10.0" />
<PackageVersion Include="MinVer" Version="8.0.0" />
<PackageVersion Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="10.0.3" />
<PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.17.0" />
<PackageVersion Include="OpenTelemetry.Extensions.Hosting" Version="1.17.0" />
<PackageVersion Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.17.0" />
<PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.18.0" />
<PackageVersion Include="OpenTelemetry.Extensions.Hosting" Version="1.18.0" />
<PackageVersion Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.18.0" />
<PackageVersion Include="OpenTelemetry.Instrumentation.EntityFrameworkCore" Version="1.17.0-beta.1" />
<PackageVersion Include="OpenTelemetry.Instrumentation.Http" Version="1.17.0" />
<PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.11" />
<PackageVersion Include="OpenTelemetry.Instrumentation.Http" Version="1.18.0" />
<PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.12" />
<!-- Pin transitive Microsoft.OpenApi above the vulnerable 2.0.0 (GHSA-v5pm-xwqc-g5wc).
Bleibt auf 2.x, und das ist keine Vorsicht, sondern eine Schranke: Microsoft.AspNetCore.OpenApi
10.0.11 fordert `>= 2.7.5 && < 3.0.0`. Mit 3.x bricht der Restore an NU1608 — hier als Fehler
geschaltet — in JEDEM Projekt der Solution. Der Sprung wird erst möglich, wenn ASP.NET Core
eine Fassung liefert, die 3.x zulässt; Dependabot sieht diese Schranke nicht und wird ihn
weiter vorschlagen. -->
<PackageVersion Include="Microsoft.OpenApi" Version="2.10.0" />
<PackageVersion Include="Microsoft.OpenApi" Version="3.10.2" />
<!-- Offizielles MCP-SDK (ASP.NET-Host): agenten-native Tool-Fläche über /mcp (Streamable HTTP). -->
<PackageVersion Include="ModelContextProtocol.AspNetCore" Version="2.2.0" />
<PackageVersion Include="Scalar.AspNetCore" Version="2.16.19" />
<PackageVersion Include="Scalar.AspNetCore" Version="2.17.3" />
<!-- SemVer parsing/ordering for the plugin dependency install gate (npm-style
ranges). Correct prerelease ordering out of the box — no in-house parser. -->
<PackageVersion Include="Semver" Version="3.0.0" />
<!-- Nur wegen der Advisory hier: transitive Abhängigkeit von Testcontainers, siehe die
Begründung am PackageReference in Callora.Core.Tests.csproj. -->
<PackageVersion Include="SSH.NET" Version="2026.0.0" />
<PackageVersion Include="System.IdentityModel.Tokens.Jwt" Version="8.22.0" />
<PackageVersion Include="Testcontainers.PostgreSql" Version="4.13.0" />
<PackageVersion Include="Testcontainers.PostgreSql" Version="4.15.0" />
<PackageVersion Include="xunit" Version="2.9.3" />
<PackageVersion Include="xunit.runner.visualstudio" Version="3.1.5" />
<PackageVersion Include="Xunit.SkippableFact" Version="1.5.61" />
<PackageVersion Include="xunit.runner.visualstudio" Version="4.0.0" />
<PackageVersion Include="Xunit.SkippableFact" Version="1.5.85" />
</ItemGroup>
</Project>
2 changes: 2 additions & 0 deletions src/Core/Callora.Core.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,8 @@

<ItemGroup>
<PackageReference Include="Microsoft.AspNetCore.DataProtection.EntityFrameworkCore" />
<PackageReference Include="Microsoft.CodeAnalysis.Analyzers" />
<PackageReference Include="Microsoft.CodeAnalysis.CSharp" />
<PackageReference Include="Microsoft.EntityFrameworkCore.Design">
<PrivateAssets>all</PrivateAssets>
<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
Expand Down
1 change: 1 addition & 0 deletions tests/Callora.Analyzers.Tests/Callora.Analyzers.Tests.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@
</PropertyGroup>

<ItemGroup>
<PackageReference Include="Microsoft.CodeAnalysis.Analyzers" />
<PackageReference Include="Microsoft.NET.Test.Sdk" />
<PackageReference Include="xunit" />
<PackageReference Include="xunit.runner.visualstudio" />
Expand Down
Loading