Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Pin transitive dependencies to mitigate CVEs #284

Merged
merged 1 commit into from
Jan 23, 2025
Merged

Pin transitive dependencies to mitigate CVEs #284

merged 1 commit into from
Jan 23, 2025

Conversation

cgillum
Copy link
Member

@cgillum cgillum commented Jan 23, 2025

Dependency management:

  • Resolve CVEs by pinning transitive dependencies via explicit references to Azure.Core, Azure.Identity, Microsoft.IdentityModel.JsonWebTokens, System.IdentityModel.Tokens.Jwt, and System.Text.Json in DurableTask.SqlServer.csproj and TestDBGenerator.csproj.
  • Added Directory.Packages.props to the solution file to use central package management.

Code cleanup:

  • Removed the AsyncQueue class from AsyncQueue.cs as it is no longer needed (this allowed us to also remove dependency on System.Threading.Channels).
  • Fixed nullable reference types warnings found by updated dependency analyzers

Version updates:

  • Updated the patch version from 1.5.0 to 1.5.1 in common.props

Increment package version number
Fix build warnings found by updated dependency analyzers
@cgillum cgillum merged commit ce114d5 into main Jan 23, 2025
2 checks passed
@cgillum cgillum deleted the cgillum/cves branch January 23, 2025 22:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants