Fix restore failures from duplicate and vulnerable package versions - #200
Merged
Merged
Conversation
…rsions Remove the Microsoft.Testing.Extensions.* PackageVersion entries. MSTest.Sdk injects its own PackageVersion for every extension it references under central package management, so the repo-side pins collided with the SDK-owned versions and failed restore with NU1506. KTSU0005 explicitly skips this package prefix, so nothing else depended on them. Pin System.Security.Cryptography.Xml forward to 10.0.10. It arrives transitively via Microsoft.PowerShell.SDK / System.Management.Automation at 10.0.6, which carries five high-severity advisories and failed restore with NU1903.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
dotnet buildwas failing at restore for two independent reasons.NU1506— duplicatePackageVersionitems (CrossRepoActions.Test)Directory.Packages.propspinned sevenMicrosoft.Testing.Extensions.*packages, but MSTest.Sdk 4.3.3 injects its ownPackageVersionfor every extension it references under central package management. CodeCoverage (18.9.0 vs. pinned 17.14.2) and TrxReport (2.3.3 vs. pinned 1.7.2) collided.All seven entries are removed. This is safe because MSTest.Sdk always pairs each injected
PackageReferencewith a matchingPackageVersion, and the ktsu.Sdk KTSU0005 orphan analyzer explicitly skips theMicrosoft.Testing.Extensions.prefix. The supported lever for controlling these versions is theMicrosoftTestingExtensions*Versionproperties, notPackageVersionentries.NU1903— high-severity vulnerability (both projects)System.Security.Cryptography.Xml10.0.6 arrives transitively via Microsoft.PowerShell.SDK / System.Management.Automation and carries five advisories. Pinned forward to 10.0.10, with an explicitPackageReferenceinCrossRepoActions.csprojso KTSU0005 does not flag the version as orphaned. The test project picks it up through itsProjectReference.Test plan
dotnet build— succeeds, 0 warnings, 0 errorsdotnet test— 15/15 passed🤖 Generated with Claude Code
https://claude.ai/code/session_014zdo5ANWj1oVmu3dHVZsuf