Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Framework package updates #1308

Merged
merged 2 commits into from
Nov 18, 2024
Merged

Framework package updates #1308

merged 2 commits into from
Nov 18, 2024

Commits on Nov 18, 2024

  1. Include non-implementation packages on .NETCore 2.x 

    Microsoft.NETCore.App contains only reference assemblies, but it was listed in CVEs, so should be excluded.  The same is true for System.Private.Uri.

I did not include these previously because they weren't part of package overrides list, nor were they found through package comparisons - since conflict resolution doesn't need to do anything with non-implementation packages.  They are important for CG though since they've been used in CVE reports.
    @ericstj
    ericstj committed Nov 18, 2024
    Configuration menu
    Copy the full SHA
    ad2ba9d View commit details
    Browse the repository at this point in the history

  2. Include framework packages for .NET 4.6.1 

    .NET 4.6.1 supports .NET Standard and has built in support for it that will win over nuget packages.

In .NET 4.6.1 - .NET 4.7.1 this comes from the Microsoft.NET.Build.Extensions component, after that it's built into the framework itself.
    @ericstj
    ericstj committed Nov 18, 2024
    Configuration menu
    Copy the full SHA
    4ce149c View commit details
    Browse the repository at this point in the history