@joebigelow / wix-1 / commits / a076b9d7

Audit all transitive dependencies and fix latest vulnerabilities

Also, standardize .NET Core TFMs listed before .NET Framework TFMs for no reason but to be consistent

Rob Mensching committed Dec 27, 2024 at 13:57 UTC a076b9d72486328d8dc95675daae417a3c07d6d6
15 files changed +45 -36
src/Directory.Build.props
+3 -1
@@ -32,7 +32,9 @@
32 <ProjectUrl>https://wixtoolset.org/</ProjectUrl>
33 <PackageIcon>wix.png</PackageIcon>
34
35 - <GitVersionFile>version.txt</GitVersionFile>
35 + <NuGetAudit>true</NuGetAudit>
36 + <NuGetAuditMode>all</NuGetAuditMode>
37 + <NuGetAuditLevel>low</NuGetAuditLevel>
38 </PropertyGroup>
39
40 <Import Project="Directory$(MSBuildProjectExtension).props" Condition=" Exists('Directory$(MSBuildProjectExtension).props') " />
src/api/burn/test/WixToolsetTest.BootstrapperApplicationApi/WixToolsetTest.BootstrapperApplicationApi.csproj
-4
@@ -12,8 +12,4 @@
12 <ItemGroup>
13 <ProjectReference Include="..\..\WixToolset.BootstrapperApplicationApi\WixToolset.BootstrapperApplicationApi.csproj" />
14 </ItemGroup>
15 -
16 - <ItemGroup>
17 - <PackageReference Include="WixInternal.TestSupport" />
18 - </ItemGroup>
15 </Project>
src/internal/SetBuildNumber/Directory.Packages.props.pp
+25 -15
@@ -1,4 +1,13 @@
1 <Project>
2 + <PropertyGroup>
3 + <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
4 + </PropertyGroup>
5 +
6 + <!-- Pinned versions to address security vulnerabilities in transitive dependencies. Review as dependencies update. -->
7 + <ItemGroup>
8 + <PackageVersion Include="System.Private.Uri" Version="4.3.2" />
9 + </ItemGroup>
10 +
11 <ItemGroup>
12 <PackageVersion Include="WixToolset.Dtf.Compression" Version="{packageversion}" />
13 <PackageVersion Include="WixToolset.Dtf.Compression.Cab" Version="{packageversion}" />
@@ -43,35 +52,36 @@
52 </ItemGroup>
53
54 <ItemGroup>
46 - <PackageVersion Include="System.Configuration.ConfigurationManager" Version="6.0.1" />
47 - <PackageVersion Include="System.Diagnostics.PerformanceCounter" Version="4.7.0" />
48 - <PackageVersion Include="System.DirectoryServices" Version="4.7.0" />
49 - <PackageVersion Include="System.DirectoryServices.AccountManagement" Version="4.7.0" />
50 - <PackageVersion Include="System.Management" Version="4.7.0" />
55 + <PackageVersion Include="System.Configuration.ConfigurationManager" Version="6.0.2" />
56 + <PackageVersion Include="System.Diagnostics.PerformanceCounter" Version="6.0.2" />
57 + <PackageVersion Include="System.DirectoryServices" Version="6.0.2" />
58 + <PackageVersion Include="System.DirectoryServices.AccountManagement" Version="6.0.1" />
59 + <PackageVersion Include="System.Management" Version="6.0.2" />
60 <PackageVersion Include="System.IO.Compression" Version="4.3.0" />
52 - <PackageVersion Include="System.IO.FileSystem.AccessControl" Version="4.7.0" />
61 + <PackageVersion Include="System.IO.FileSystem.AccessControl" Version="5.0.0" />
62 <PackageVersion Include="System.Net.NetworkInformation" Version="4.3.0" />
54 - <PackageVersion Include="System.Reflection.Metadata" Version="1.8.1" />
55 - <PackageVersion Include="System.Security.Principal.Windows" Version="4.7.0" />
56 - <PackageVersion Include="System.Text.Encoding.CodePages" Version="4.7.1" />
57 - <PackageVersion Include="System.Text.Json" Version="6.0.10" />
63 + <PackageVersion Include="System.Reflection.Metadata" Version="6.0.2" />
64 + <PackageVersion Include="System.Security.Principal.Windows" Version="5.0.0" />
65 + <PackageVersion Include="System.Text.Encoding.CodePages" Version="6.0.1" />
66 + <PackageVersion Include="System.Text.Json" Version="8.0.5" />
67 + <PackageVersion Include="System.Memory" Version="4.5.5" />
68
69 <PackageVersion Include="Microsoft.AspNetCore.Owin" Version="3.1.13" />
70 <PackageVersion Include="Microsoft.VisualStudio.Setup.Configuration.Native" Version="3.10.2154" />
61 - <PackageVersion Include="Microsoft.Win32.Registry" Version="4.7.0" />
71 + <PackageVersion Include="Microsoft.Win32.Registry" Version="5.0.0" />
72 </ItemGroup>
73
74 <ItemGroup>
65 - <PackageVersion Include="NuGet.Credentials" Version="6.10.1" />
66 - <PackageVersion Include="NuGet.Protocol" Version="6.10.1" />
67 - <PackageVersion Include="NuGet.Versioning" Version="6.10.1" />
75 + <PackageVersion Include="NuGet.Credentials" Version="6.12.1" />
76 + <PackageVersion Include="NuGet.Protocol" Version="6.12.1" />
77 + <PackageVersion Include="NuGet.Versioning" Version="6.12.1" />
78 </ItemGroup>
79
80 <!--
81 These MSBuild versions are trapped in antiquity for heat.exe.
82 -->
83 <ItemGroup Condition="'$(TargetFrameworkIdentifier)' == '.NETFramework'">
74 - <PackageVersion Include="Microsoft.Build.Tasks.Core" Version="14.3" />
84 + <PackageVersion Include="Microsoft.Build.Tasks.Core" Version="14.3.0" />
85 </ItemGroup>
86 <ItemGroup Condition="'$(TargetFrameworkIdentifier)' != '.NETFramework'">
87 <PackageVersion Include="Microsoft.Build.Tasks.Core" Version="15.7.179" />
src/internal/WixInternal.TestSupport/Builder.cs
+4 -4
@@ -64,7 +64,7 @@ namespace WixInternal.TestSupport
64 foreach (var ext in this.ExtensionTypes)
65 {
66 args.Add("-ext");
67 - args.Add(Path.GetFullPath(new Uri(ext.Assembly.CodeBase).LocalPath));
67 + args.Add(Path.GetFullPath(ext.Assembly.Location));
68 }
69
70 args.AddRange(sourceFiles);
@@ -126,7 +126,7 @@ namespace WixInternal.TestSupport
126 foreach (var ext in this.ExtensionTypes)
127 {
128 firstBuildArgs.Add("-ext");
129 - firstBuildArgs.Add(Path.GetFullPath(new Uri(ext.Assembly.CodeBase).LocalPath));
129 + firstBuildArgs.Add(Path.GetFullPath(ext.Assembly.Location));
130 }
131
132 firstBuildArgs.AddRange(sourceFiles);
@@ -171,7 +171,7 @@ namespace WixInternal.TestSupport
171 foreach (var ext in this.ExtensionTypes)
172 {
173 decompileArgs.Add("-ext");
174 - decompileArgs.Add(Path.GetFullPath(new Uri(ext.Assembly.CodeBase).LocalPath));
174 + decompileArgs.Add(Path.GetFullPath(ext.Assembly.Location));
175 }
176
177 decompileFunc(decompileArgs.ToArray());
@@ -188,7 +188,7 @@ namespace WixInternal.TestSupport
188 foreach (var ext in this.ExtensionTypes)
189 {
190 secondBuildArgs.Add("-ext");
191 - secondBuildArgs.Add(Path.GetFullPath(new Uri(ext.Assembly.CodeBase).LocalPath));
191 + secondBuildArgs.Add(Path.GetFullPath(ext.Assembly.Location));
192 }
193
194 secondBuildArgs.Add("-bindpath");
src/internal/WixInternal.TestSupport/TestData.cs
+2 -2
@@ -44,13 +44,13 @@ namespace WixInternal.TestSupport
44
45 public static string Get(params string[] paths)
46 {
47 - var localPath = Path.GetDirectoryName(new Uri(Assembly.GetCallingAssembly().CodeBase).LocalPath);
47 + var localPath = AppDomain.CurrentDomain.BaseDirectory;
48 return Path.Combine(localPath, Path.Combine(paths));
49 }
50
51 public static string GetUnitTestLogsFolder([CallerFilePath] string path = "", [CallerMemberName] string method = "")
52 {
53 - var startingPath = Path.GetDirectoryName(new Uri(Assembly.GetCallingAssembly().CodeBase).LocalPath);
53 + var startingPath = AppDomain.CurrentDomain.BaseDirectory;
54 var buildPath = startingPath;
55
56 while (!String.IsNullOrEmpty(buildPath))
src/internal/WixInternal.TestSupport/WixInternal.TestSupport.csproj
+1 -1
@@ -4,7 +4,7 @@
4 <Project Sdk="Microsoft.NET.Sdk">
5
6 <PropertyGroup>
7 - <TargetFrameworks>netstandard2.0;net472</TargetFrameworks>
7 + <TargetFrameworks>net6.0;net472</TargetFrameworks>
8 <IsPackable>true</IsPackable>
9 <DebugType>embedded</DebugType>
10 <PublishRepositoryUrl>true</PublishRepositoryUrl>
src/test/burn/TestBA/TestBA.csproj
+1 -1
@@ -3,7 +3,7 @@
3
4 <Project Sdk="Microsoft.NET.Sdk">
5 <PropertyGroup>
6 - <TargetFrameworks>net462;net6.0-windows</TargetFrameworks>
6 + <TargetFrameworks>net6.0-windows;net462</TargetFrameworks>
7 <OutputType>WinExe</OutputType>
8 <AssemblyName>TestBA</AssemblyName>
9 <RootNamespace>WixToolset.Test.BA</RootNamespace>
src/test/burn/TestBA/TestBA_x64.csproj
+1 -1
@@ -3,7 +3,7 @@
3
4 <Project Sdk="Microsoft.NET.Sdk">
5 <PropertyGroup>
6 - <TargetFrameworks>net462;net6.0-windows</TargetFrameworks>
6 + <TargetFrameworks>net6.0-windows;net462</TargetFrameworks>
7 <OutputType>WinExe</OutputType>
8 <AssemblyName>TestBA</AssemblyName>
9 <RootNamespace>WixToolset.Test.BA</RootNamespace>
src/test/burn/TestExe/TestExe.csproj
+1 -1
@@ -3,7 +3,7 @@
3
4 <Project Sdk="Microsoft.NET.Sdk">
5 <PropertyGroup>
6 - <TargetFrameworks>net462;net6.0</TargetFrameworks>
6 + <TargetFrameworks>net6.0;net462</TargetFrameworks>
7 <AssemblyName>TestExe</AssemblyName>
8 <RootNamespace>TestExe</RootNamespace>
9 <OutputType>Exe</OutputType>
src/test/burn/WixToolset.WixBA/WixToolset.WixBA.csproj
+1 -1
@@ -3,7 +3,7 @@
3
4 <Project Sdk="Microsoft.NET.Sdk">
5 <PropertyGroup>
6 - <TargetFrameworks>net472;net6.0-windows</TargetFrameworks>
6 + <TargetFrameworks>net6.0-windows;net472</TargetFrameworks>
7 <OutputType>WinExe</OutputType>
8 <AssemblyName>WixToolset.WixBA</AssemblyName>
9 <RootNamespace>WixToolset.WixBA</RootNamespace>
src/test/burn/WixToolset.WixBA/WixToolset.WixBA_x64.csproj
+1 -1
@@ -3,7 +3,7 @@
3
4 <Project Sdk="Microsoft.NET.Sdk">
5 <PropertyGroup>
6 - <TargetFrameworks>net472;net6.0-windows</TargetFrameworks>
6 + <TargetFrameworks>net6.0-windows;net472</TargetFrameworks>
7 <OutputType>WinExe</OutputType>
8 <AssemblyName>WixToolset.WixBA</AssemblyName>
9 <RootNamespace>WixToolset.WixBA</RootNamespace>
src/test/wix/TestData/CsprojClassLibraryMultiTarget/CsprojClassLibraryMultiTarget.csproj
+1 -1
@@ -1,7 +1,7 @@
1 <Project Sdk="Microsoft.NET.Sdk">
2
3 <PropertyGroup>
4 - <TargetFrameworks>net472;net6.0</TargetFrameworks>
4 + <TargetFrameworks>net6.0;net472</TargetFrameworks>
5 </PropertyGroup>
6
7 <ItemGroup>
src/tools/heat/heat.csproj
+1
@@ -39,5 +39,6 @@
39 <PackageReference Include="System.Configuration.ConfigurationManager" />
40 <PackageReference Include="System.Diagnostics.PerformanceCounter" />
41 <PackageReference Include="System.DirectoryServices" />
42 + <PackageReference Include="System.Memory" />
43 </ItemGroup>
44 </Project>
src/tools/test/WixToolsetTest.HeatTasks/WixToolsetTest.HeatTasks.csproj
+2 -2
@@ -14,7 +14,7 @@
14 </ItemGroup>
15
16 <ItemGroup>
17 - <PackageReference Include="WixInternal.TestSupport" />
18 - <PackageReference Include="WixInternal.Core.TestPackage" />
17 + <PackageReference Include="WixInternal.TestSupport" />
18 + <PackageReference Include="WixInternal.Core.TestPackage" />
19 </ItemGroup>
20 </Project>
src/wix/WixInternal.Core.TestPackage/WixInternal.Core.TestPackage.csproj
+1 -1
@@ -3,7 +3,7 @@
3
4 <Project Sdk="Microsoft.NET.Sdk">
5 <PropertyGroup>
6 - <TargetFrameworks>netstandard2.0</TargetFrameworks>
6 + <TargetFrameworks>net6.0;net472</TargetFrameworks>
7 <Description>Internal WiX Toolset Test Package</Description>
8 <DebugType>embedded</DebugType>
9 <PublishRepositoryUrl>true</PublishRepositoryUrl>