Repository navigation
Move Aspire to 13.6.4, and what it pulls along - #9
Merged
Merged
Conversation
Aspire.Hosting.AppHost 13.6.4 depends on Microsoft.Extensions.* 10.0.12, and with central transitive pinning the 10.0.11 pins turned that into NU1109 downgrade errors on the AppHost restore. Every 10.0.11 pin moves to 10.0.12 together, as they did for 13.5, so Microsoft.Extensions, EF Core, OpenApi and the test hosts stay on one patch level. That raises the dependency floor of the published packages by one patch. The comment above the pins now gives Aspire as the reason for 10.0.12 and keeps 10.0.11 as the OpenApi security floor, which was the reason it gave before. Microsoft.Data.SqlClient goes from 6.1.6 to 6.1.8 in the same change, for a different reason: NuGet now flags System.Security.Cryptography.Pkcs 9.0.11, which 6.1.6 brings in, under CVE-2026-70162 and CVE-2026-84008 (both affect <= 9.0.20). Warnings-as-errors made that a restore failure in the integration tests, and since restore runs solution-wide it stopped the whole build, with or without the Aspire bump. 6.1.8 depends on Pkcs 9.0.21, which is patched, so there is no need to pin Pkcs directly. 7.1.1 would not have helped, because it depends on 9.0.18. Only the integration tests and the sample use SqlClient, so no published package changes. Verified: the solution builds with 0 warnings, `dotnet list package --vulnerable --include-transitive` is clean, and unit (188 x2), provider (54 x2), API (51 x2) and integration (140, against Testcontainers Postgres, SQL Server and MongoDB) tests all pass. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
Aspire.*packages, plusAspire.AppHost.Sdkin the AppHost.[Unreleased].Why
10.0.12 is required by Aspire.
Aspire.Hosting.AppHost13.6.4 depends on Microsoft.Extensions 10.0.12. With central transitive pinning, the 10.0.11 pins made the AppHost restore fail with NU1109 downgrade errors. As with the 13.5 bump, every 10.0.11 pin moves together so everything stays on one patch level. The comment above the pins now gives Aspire as the reason for 10.0.12 and keeps 10.0.11 as the OpenApi security floor (GHSA-v5pm-xwqc-g5wc).SqlClient is a separate problem that was already blocking the build. NuGet now flags
System.Security.Cryptography.Pkcs9.0.11, which SqlClient 6.1.6 brings in, under CVE-2026-70162 and CVE-2026-84008 (both affect ≤ 9.0.20). Warnings-as-errors turns that into a restore failure in the integration tests, and since restore runs solution-wide it stopped the whole build. This happens onmaintoday. SqlClient 6.1.8 depends on Pkcs 9.0.21, which is patched, so Pkcs doesn't need its own pin. 7.1.1 wouldn't help, because it depends on 9.0.18.For reviewers
Verification
dotnet build: 0 warnings, 0 errors.dotnet list package --vulnerable --include-transitive: clean.🤖 Generated with Claude Code