Skip to content

Commit fa0072f

Browse files
jeffhandleyjeffhandley
committed
Lift CVE-impacted transitive dependencies in test projects
Lift CVE-impacted transitive dependencies in test projects * eng/packages/Tests.props: pin OpenTelemetry.Api 1.15.3, NuGet.Packaging 6.8.2, and NuGet.Protocol 6.8.2 (keep OpenTelemetry.Exporter.InMemory at 1.9.0). * Add explicit OpenTelemetry.Api PackageReference to AI.Tests, AI.Integration.Tests, AI.OllamaSharp.Integration.Tests, and DataIngestion.Tests to lift the vulnerable transitive (GHSA-g94r-2vxg-569j). * Add explicit NuGet.Packaging and NuGet.Protocol PackageReferences to the AI/McpServer/Agents.AI template integration tests to lift the vulnerable transitive (GHSA-g4vj-cjjj-v7hg). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent a16b420 commit fa0072f

8 files changed

Lines changed: 26 additions & 0 deletions

File tree

‎eng/packages/Tests.props‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,12 @@
2222
<PackageVersion Include="Moq" Version="4.18.4" />
2323
<PackageVersion Include="Moq.AutoMock" Version="3.1.0" />
2424
<PackageVersion Include="Newtonsoft.Json" Version="13.0.3" />
25+
<!-- Lift CVE-impacted transitive dependency; remove once the direct dependency updates. -->
26+
<PackageVersion Include="NuGet.Packaging" Version="6.8.2" />
27+
<!-- Lift CVE-impacted transitive dependency; remove once the direct dependency updates. -->
28+
<PackageVersion Include="NuGet.Protocol" Version="6.8.2" />
29+
<!-- Lift CVE-impacted transitive dependency; remove once the direct dependency updates. -->
30+
<PackageVersion Include="OpenTelemetry.Api" Version="1.15.3" />
2531
<PackageVersion Include="OpenTelemetry.Exporter.InMemory" Version="1.9.0" />
2632
<PackageVersion Include="Polly.Testing" Version="8.4.2" />
2733
<PackageVersion Include="SharpFuzz" Version="2.1.1" />

‎test/Libraries/Microsoft.Extensions.AI.Integration.Tests/Microsoft.Extensions.AI.Integration.Tests.csproj‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,8 @@
4545
<PackageReference Include="Microsoft.Extensions.Options" />
4646
<PackageReference Include="Microsoft.ML.Tokenizers" />
4747
<PackageReference Include="Microsoft.ML.Tokenizers.Data.O200kBase" />
48+
<!-- Lift CVE-impacted transitive dependency; remove once the direct dependency updates. -->
49+
<PackageReference Include="OpenTelemetry.Api" />
4850
<PackageReference Include="OpenTelemetry.Exporter.InMemory" />
4951
<PackageReference Include="PdfPig" />
5052
</ItemGroup>

‎test/Libraries/Microsoft.Extensions.AI.OllamaSharp.Integration.Tests/Microsoft.Extensions.AI.OllamaSharp.Integration.Tests.csproj‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@
1313
</ItemGroup>
1414

1515
<ItemGroup>
16+
<!-- Lift CVE-impacted transitive dependency; remove once the direct dependency updates. -->
17+
<PackageReference Include="OpenTelemetry.Api" />
1618
<PackageReference Include="OllamaSharp" />
1719
</ItemGroup>
1820
</Project>

‎test/Libraries/Microsoft.Extensions.AI.Tests/Microsoft.Extensions.AI.Tests.csproj‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@
3131

3232
<ItemGroup>
3333
<PackageReference Include="Microsoft.Extensions.DependencyInjection" />
34+
<!-- Lift CVE-impacted transitive dependency; remove once the direct dependency updates. -->
35+
<PackageReference Include="OpenTelemetry.Api" />
3436
<PackageReference Include="OpenTelemetry.Exporter.InMemory" />
3537
</ItemGroup>
3638

‎test/Libraries/Microsoft.Extensions.DataIngestion.Tests/Microsoft.Extensions.DataIngestion.Tests.csproj‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,8 @@
2424
<PackageReference Include="Microsoft.ML.Tokenizers.Data.O200kBase" />
2525
<PackageReference Include="Microsoft.SemanticKernel.Connectors.InMemory" />
2626
<PackageReference Include="Microsoft.SemanticKernel.Connectors.SqliteVec" />
27+
<!-- Lift CVE-impacted transitive dependency; remove once the direct dependency updates. -->
28+
<PackageReference Include="OpenTelemetry.Api" />
2729
<PackageReference Include="OpenTelemetry.Exporter.InMemory" />
2830
<!-- Override transitive dependency to fix vulnerability in 8.0.0 -->
2931
<PackageReference Include="System.IO.Packaging" />

‎test/ProjectTemplates/Microsoft.Agents.AI.ProjectTemplates.IntegrationTests/Microsoft.Agents.AI.ProjectTemplates.Tests.csproj‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,10 @@
1313
<ItemGroup>
1414
<PackageReference Include="Microsoft.TemplateEngine.Authoring.TemplateVerifier" />
1515
<PackageReference Include="Microsoft.TemplateEngine.TestHelper" />
16+
<!-- Lift CVE-impacted transitive dependency; remove once the direct dependency updates. -->
17+
<PackageReference Include="NuGet.Packaging" />
18+
<!-- Lift CVE-impacted transitive dependency; remove once the direct dependency updates. -->
19+
<PackageReference Include="NuGet.Protocol" />
1620
</ItemGroup>
1721

1822
<ItemGroup>

‎test/ProjectTemplates/Microsoft.Extensions.AI.Templates.IntegrationTests/Microsoft.Extensions.AI.Templates.Tests.csproj‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,10 @@
1313
<ItemGroup>
1414
<PackageReference Include="Microsoft.TemplateEngine.Authoring.TemplateVerifier" />
1515
<PackageReference Include="Microsoft.TemplateEngine.TestHelper" />
16+
<!-- Lift CVE-impacted transitive dependency; remove once the direct dependency updates. -->
17+
<PackageReference Include="NuGet.Packaging" />
18+
<!-- Lift CVE-impacted transitive dependency; remove once the direct dependency updates. -->
19+
<PackageReference Include="NuGet.Protocol" />
1620
</ItemGroup>
1721

1822
<ItemGroup>

‎test/ProjectTemplates/Microsoft.McpServer.ProjectTemplates.IntegrationTests/Microsoft.McpServer.ProjectTemplates.Tests.csproj‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,10 @@
1313
<ItemGroup>
1414
<PackageReference Include="Microsoft.TemplateEngine.Authoring.TemplateVerifier" />
1515
<PackageReference Include="Microsoft.TemplateEngine.TestHelper" />
16+
<!-- Lift CVE-impacted transitive dependency; remove once the direct dependency updates. -->
17+
<PackageReference Include="NuGet.Packaging" />
18+
<!-- Lift CVE-impacted transitive dependency; remove once the direct dependency updates. -->
19+
<PackageReference Include="NuGet.Protocol" />
1620
</ItemGroup>
1721

1822
<ItemGroup>

0 commit comments

Comments
 (0)