tsai
/
openiddict-core
mirror of https://github.com/openiddict/openiddict-core.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
Browse Source

Explicitly reference the latest SharpCompress and Snappier versions to mitigate recent security issues

pull/2367/head
Kévin Chalet 5 months ago
parent
b29c22721b
commit
0e1110c0e7
8 changed files with 31 additions and 6 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Split View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 16
      Directory.Packages.props
  2. 2
      src/OpenIddict.Client.AspNetCore/OpenIddict.Client.AspNetCore.csproj
  3. 2
      src/OpenIddict.Client.DataProtection/OpenIddict.Client.DataProtection.csproj
  4. 9
      src/OpenIddict.MongoDb/OpenIddict.MongoDb.csproj
  5. 2
      src/OpenIddict.Server.AspNetCore/OpenIddict.Server.AspNetCore.csproj
  6. 2
      src/OpenIddict.Server.DataProtection/OpenIddict.Server.DataProtection.csproj
  7. 2
      src/OpenIddict.Validation.AspNetCore/OpenIddict.Validation.AspNetCore.csproj
  8. 2
      src/OpenIddict.Validation.DataProtection/OpenIddict.Validation.DataProtection.csproj

16
Directory.Packages.props
View File

@ -43,6 +43,8 @@
<PackageVersion Include="MongoDB.Bson" Version="3.6.0" />
<PackageVersion Include="MongoDB.Driver" Version="3.6.0" />
<PackageVersion Include="Quartz.Extensions.DependencyInjection" Version="3.15.1" />
<PackageVersion Include="SharpCompress" Version="0.48.0" />
<PackageVersion Include="Snappier" Version="1.3.1" />
<PackageVersion Include="System.Buffers" Version="4.6.1" />
<PackageVersion Include="System.Collections.Immutable" Version="8.0.0" />
<PackageVersion Include="System.Interactive.Async" Version="3.2.0" />
@ -83,6 +85,8 @@
<PackageVersion Include="MongoDB.Bson" Version="3.6.0" />
<PackageVersion Include="MongoDB.Driver" Version="3.6.0" />
<PackageVersion Include="Quartz.Extensions.DependencyInjection" Version="3.15.1" />
<PackageVersion Include="SharpCompress" Version="0.48.0" />
<PackageVersion Include="Snappier" Version="1.3.1" />
<PackageVersion Include="System.Buffers" Version="4.6.1" />
<PackageVersion Include="System.Collections.Immutable" Version="8.0.0" />
<PackageVersion Include="System.Interactive.Async" Version="3.2.0" />
@ -134,6 +138,8 @@
<PackageVersion Include="MongoDB.Bson" Version="3.6.0" />
<PackageVersion Include="MongoDB.Driver" Version="3.6.0" />
<PackageVersion Include="Quartz.Extensions.DependencyInjection" Version="3.15.1" />
<PackageVersion Include="SharpCompress" Version="0.48.0" />
<PackageVersion Include="Snappier" Version="1.3.1" />
<PackageVersion Include="System.Buffers" Version="4.6.1" />
<PackageVersion Include="System.Collections.Immutable" Version="8.0.0" />
<PackageVersion Include="System.Interactive.Async" Version="3.2.0" />
@ -216,6 +222,8 @@
<PackageVersion Include="MongoDB.Bson" Version="3.6.0" />
<PackageVersion Include="MongoDB.Driver" Version="3.6.0" />
<PackageVersion Include="Quartz.Extensions.DependencyInjection" Version="3.15.1" />
<PackageVersion Include="SharpCompress" Version="0.48.0" />
<PackageVersion Include="Snappier" Version="1.3.1" />
<PackageVersion Include="System.Security.Cryptography.Xml" Version="8.0.3" />
<PackageVersion Include="Xamarin.AndroidX.Browser" Version="1.9.0.2" />
@ -257,6 +265,8 @@
<PackageVersion Include="MongoDB.Bson" Version="3.6.0" />
<PackageVersion Include="MongoDB.Driver" Version="3.6.0" />
<PackageVersion Include="Quartz.Extensions.DependencyInjection" Version="3.15.1" />
<PackageVersion Include="SharpCompress" Version="0.48.0" />
<PackageVersion Include="Snappier" Version="1.3.1" />
<PackageVersion Include="System.Security.Cryptography.Xml" Version="9.0.15" />
<PackageVersion Include="Xamarin.AndroidX.Browser" Version="1.9.0.2" />
@ -298,6 +308,8 @@
<PackageVersion Include="MongoDB.Bson" Version="3.6.0" />
<PackageVersion Include="MongoDB.Driver" Version="3.6.0" />
<PackageVersion Include="Quartz.Extensions.DependencyInjection" Version="3.15.1" />
<PackageVersion Include="SharpCompress" Version="0.48.0" />
<PackageVersion Include="Snappier" Version="1.3.1" />
<PackageVersion Include="System.Security.Cryptography.Xml" Version="10.0.7" />
<PackageVersion Include="Xamarin.AndroidX.Browser" Version="1.9.0.2" />
@ -355,6 +367,8 @@
<PackageVersion Include="MongoDB.Driver" Version="3.6.0" />
<PackageVersion Include="NamedPipeServerStream.NetFrameworkVersion" Version="1.1.13" />
<PackageVersion Include="Quartz.Extensions.DependencyInjection" Version="3.15.1" />
<PackageVersion Include="SharpCompress" Version="0.48.0" />
<PackageVersion Include="Snappier" Version="1.3.1" />
<PackageVersion Include="System.Buffers" Version="4.6.1" />
<PackageVersion Include="System.Collections.Immutable" Version="8.0.0" />
<PackageVersion Include="System.ComponentModel.Annotations" Version="5.0.0" />
@ -399,6 +413,8 @@
<PackageVersion Include="MongoDB.Driver" Version="3.6.0" />
<PackageVersion Include="NamedPipeServerStream.NetFrameworkVersion" Version="1.1.13" />
<PackageVersion Include="Quartz.Extensions.DependencyInjection" Version="3.15.1" />
<PackageVersion Include="SharpCompress" Version="0.48.0" />
<PackageVersion Include="Snappier" Version="1.3.1" />
<PackageVersion Include="System.Buffers" Version="4.6.1" />
<PackageVersion Include="System.Collections.Immutable" Version="8.0.0" />
<PackageVersion Include="System.ComponentModel.Annotations" Version="5.0.0" />

2
src/OpenIddict.Client.AspNetCore/OpenIddict.Client.AspNetCore.csproj
View File

@ -20,7 +20,7 @@
<ItemGroup>
<!--
Note: the versions of the System.Security.Cryptography.Xml package that are transitively referenced are
known to be affected by different vulnerabilities (see https://github.com/advisories/GHSA-w3x6-4m5h-cxqf
known to be affected by security vulnerabilities (see https://github.com/advisories/GHSA-w3x6-4m5h-cxqf
and https://github.com/advisories/GHSA-37gx-xxp4-5rgx for more information). To mitigate this issue,
the package is explicitly referenced here to ensure that a fixed version is used.
-->

2
src/OpenIddict.Client.DataProtection/OpenIddict.Client.DataProtection.csproj
View File

@ -20,7 +20,7 @@
<ItemGroup>
<!--
Note: the versions of the System.Security.Cryptography.Xml package that are transitively referenced are
known to be affected by different vulnerabilities (see https://github.com/advisories/GHSA-w3x6-4m5h-cxqf
known to be affected by security vulnerabilities (see https://github.com/advisories/GHSA-w3x6-4m5h-cxqf
and https://github.com/advisories/GHSA-37gx-xxp4-5rgx for more information). To mitigate this issue,
the package is explicitly referenced here to ensure that a fixed version is used.
-->

9
src/OpenIddict.MongoDb/OpenIddict.MongoDb.csproj
View File

@ -20,7 +20,16 @@
</ItemGroup>
<ItemGroup>
<!--
Note: the versions of the SharpCompress and Snappier packages that are transitively referenced are
known to be affected by security vulnerabilities (see https://github.com/advisories/GHSA-6c8g-7p36-r338
and https://github.com/advisories/GHSA-pggp-6c3x-2xmx for more information). To mitigate this issue,
the packages are explicitly referenced here to ensure that fixed versions are used.
-->
<PackageReference Include="MongoDB.Driver" />
<PackageReference Include="SharpCompress" />
<PackageReference Include="Snappier" />
</ItemGroup>
<ItemGroup>

2
src/OpenIddict.Server.AspNetCore/OpenIddict.Server.AspNetCore.csproj
View File

@ -20,7 +20,7 @@
<ItemGroup>
<!--
Note: the versions of the System.Security.Cryptography.Xml package that are transitively referenced are
known to be affected by different vulnerabilities (see https://github.com/advisories/GHSA-w3x6-4m5h-cxqf
known to be affected by security vulnerabilities (see https://github.com/advisories/GHSA-w3x6-4m5h-cxqf
and https://github.com/advisories/GHSA-37gx-xxp4-5rgx for more information). To mitigate this issue,
the package is explicitly referenced here to ensure that a fixed version is used.
-->

2
src/OpenIddict.Server.DataProtection/OpenIddict.Server.DataProtection.csproj
View File

@ -20,7 +20,7 @@
<ItemGroup>
<!--
Note: the versions of the System.Security.Cryptography.Xml package that are transitively referenced are
known to be affected by different vulnerabilities (see https://github.com/advisories/GHSA-w3x6-4m5h-cxqf
known to be affected by security vulnerabilities (see https://github.com/advisories/GHSA-w3x6-4m5h-cxqf
and https://github.com/advisories/GHSA-37gx-xxp4-5rgx for more information). To mitigate this issue,
the package is explicitly referenced here to ensure that a fixed version is used.
-->

2
src/OpenIddict.Validation.AspNetCore/OpenIddict.Validation.AspNetCore.csproj
View File

@ -20,7 +20,7 @@
<ItemGroup>
<!--
Note: the versions of the System.Security.Cryptography.Xml package that are transitively referenced are
known to be affected by different vulnerabilities (see https://github.com/advisories/GHSA-w3x6-4m5h-cxqf
known to be affected by security vulnerabilities (see https://github.com/advisories/GHSA-w3x6-4m5h-cxqf
and https://github.com/advisories/GHSA-37gx-xxp4-5rgx for more information). To mitigate this issue,
the package is explicitly referenced here to ensure that a fixed version is used.
-->

2
src/OpenIddict.Validation.DataProtection/OpenIddict.Validation.DataProtection.csproj
View File

@ -20,7 +20,7 @@
<ItemGroup>
<!--
Note: the versions of the System.Security.Cryptography.Xml package that are transitively referenced are
known to be affected by different vulnerabilities (see https://github.com/advisories/GHSA-w3x6-4m5h-cxqf
known to be affected by security vulnerabilities (see https://github.com/advisories/GHSA-w3x6-4m5h-cxqf
and https://github.com/advisories/GHSA-37gx-xxp4-5rgx for more information). To mitigate this issue,
the package is explicitly referenced here to ensure that a fixed version is used.
-->

Write Preview
Loading…
Cancel
Save