Skip to content

Suppress advisory for Microsoft.Build.Tasks.Core#627

Merged
dfederm merged 1 commit intomainfrom
fix-nuget-audit
May 14, 2025
Merged

Suppress advisory for Microsoft.Build.Tasks.Core#627
dfederm merged 1 commit intomainfrom
fix-nuget-audit

Conversation

@dfederm
Copy link
Member

@dfederm dfederm commented May 14, 2025

The pipeline is currently failing with:

D:\a\_work\1\s\src\CopyOnWrite\Microsoft.Build.CopyOnWrite.csproj : warning NU1901: Package 'Microsoft.Build.Tasks.Core' 16.11.0 has a known low severity vulnerability, https://github.com/advisories/GHSA-h4j7-5rxr-p4wc [D:\a\_work\1\s\MSBuildSdks.sln]
D:\a\_work\1\s\src\Artifacts\Microsoft.Build.Artifacts.csproj : warning NU1901: Package 'Microsoft.Build.Tasks.Core' 16.11.0 has a known low severity vulnerability, https://github.com/advisories/GHSA-h4j7-5rxr-p4wc [D:\a\_work\1\s\MSBuildSdks.sln]
D:\a\_work\1\s\src\RunTests\Microsoft.Build.RunVSTest.csproj : warning NU1901: Package 'Microsoft.Build.Tasks.Core' 17.11.4 has a known low severity vulnerability, https://github.com/advisories/GHSA-h4j7-5rxr-p4wc [D:\a\_work\1\s\MSBuildSdks.sln]
D:\a\_work\1\s\src\Artifacts\Microsoft.Build.Artifacts.csproj : error NU1901: Package 'Microsoft.Build.Tasks.Core' 16.11.0 has a known low severity vulnerability, https://github.com/advisories/GHSA-h4j7-5rxr-p4wc [TargetFramework=netstandard2.0]
D:\a\_work\1\s\src\CopyOnWrite\Microsoft.Build.CopyOnWrite.csproj : error NU1901: Package 'Microsoft.Build.Tasks.Core' 16.11.0 has a known low severity vulnerability, https://github.com/advisories/GHSA-h4j7-5rxr-p4wc
D:\a\_work\1\s\src\RunTests\Microsoft.Build.RunVSTest.csproj : error NU1901: Package 'Microsoft.Build.Tasks.Core' 17.11.4 has a known low severity vulnerability, https://github.com/advisories/GHSA-h4j7-5rxr-p4wc
D:\a\_work\1\s\src\CopyOnWrite\Microsoft.Build.CopyOnWrite.csproj : error NU1901: Package 'Microsoft.Build.Tasks.Core' 16.11.0 has a known low severity vulnerability, https://github.com/advisories/GHSA-h4j7-5rxr-p4wc
D:\a\_work\1\s\src\CopyOnWrite\Microsoft.Build.CopyOnWrite.csproj : error NU1901: Package 'Microsoft.Build.Tasks.Core' 16.11.0 has a known low severity vulnerability, https://github.com/advisories/GHSA-h4j7-5rxr-p4wc
D:\a\_work\1\s\src\Artifacts\Microsoft.Build.Artifacts.csproj : error NU1901: Package 'Microsoft.Build.Tasks.Core' 16.11.0 has a known low severity vulnerability, https://github.com/advisories/GHSA-h4j7-5rxr-p4wc [TargetFramework=netstandard2.0]
D:\a\_work\1\s\src\RunTests\Microsoft.Build.RunVSTest.csproj : error NU1901: Package 'Microsoft.Build.Tasks.Core' 17.11.4 has a known low severity vulnerability, https://github.com/advisories/GHSA-h4j7-5rxr-p4wc

@dfederm dfederm enabled auto-merge (squash) May 14, 2025 22:02
@dfederm dfederm force-pushed the fix-nuget-audit branch from 8af0645 to 07983ca Compare May 14, 2025 22:52
@dfederm dfederm changed the title Upgrade MSBuild dependencies to latest patch version Suppress advisory for Microsoft.Build.Tasks.Core May 14, 2025
<PackageVersion Include="Microsoft.Build.Framework" Version="$(MicrosoftBuildPackageVersion)" />
<!--
Suppress advisory for Microsoft.Build.Tasks.Core as this repo only compiles against these assemblies,
and uses a lower version for compatability. The actual version used at runtime is the version of
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
and uses a lower version for compatability. The actual version used at runtime is the version of
and uses a lower version for compatibility. The actual version used at runtime is the version of

@dfederm dfederm merged commit c8da0a9 into main May 14, 2025
5 checks passed
@dfederm dfederm deleted the fix-nuget-audit branch May 14, 2025 23:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants