Fix Component Governance warnings#17190
Merged
Merged
Conversation
Bump the repo-local .NET SDK to 10.0.300 and clean up dependency inputs that were still producing Component Governance warnings in AzDO pipeline 1602. Pin MongoDB.Driver compression transitives to patched versions, remove unused Swashbuckle from the JavaScript playground, and adjust the Java playground dependency management to avoid stale Maven and Netty/Reactor pins. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
|
🚀 Dogfood this PR with:
curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 17190Or
iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 17190" |
Contributor
There was a problem hiding this comment.
Pull request overview
Addresses Component Governance alerts by bumping the local .NET SDK, removing an unused NuGet from a JavaScript playground project, adding central transitive pins for MongoDB.Driver's compression dependencies, and modernizing the Java playground POM (Netty BOM, Reactor Netty 1.2, dropped explicit Maven Central repos).
Changes:
- Bump local SDK + bundled
dotnettools to10.0.300inglobal.json. - Add transitive CG pins (
SharpCompress,Snappier) and drop the unusedSwashbuckle.AspNetCoreentry inDirectory.Packages.props; remove thePackageReferencefromAspireJavaScript.MinimalApi.csproj. - In the Java playground POM: import
netty-bom, move pinned versions to properties, upgrade Reactor Netty to1.2.17, and remove explicit<repositories>/<pluginRepositories>blocks so CI uses the configured mirror policy.
Show a summary per file
| File | Description |
|---|---|
global.json |
Updates SDK and bundled dotnet tool versions to 10.0.300. |
Directory.Packages.props |
Removes Swashbuckle.AspNetCore; adds transitive CG pins for SharpCompress and Snappier. |
playground/AspireWithJavaScript/AspireJavaScript.MinimalApi/AspireJavaScript.MinimalApi.csproj |
Drops the now-unused Swashbuckle.AspNetCore reference. |
playground/PostgresEndToEnd/PostgresEndToEnd.JavaService/pom.xml |
Switches to Netty BOM, bumps Reactor Netty to 1.2.17, removes explicit Maven Central repo declarations. |
Copilot's findings
- Files reviewed: 4/4 changed files
- Comments generated: 0
Contributor
|
❓ CLI E2E Tests unknown — 86 passed, 0 failed, 1 unknown (commit View all recordings
📹 Recordings uploaded automatically from CI run #25994596730 |
JamesNK
approved these changes
May 18, 2026
Contributor
|
✅ No documentation update needed. docs_required → already documented by name (both triggered signals are false positives; no user-facing surface was introduced) Triggered signals (2): Signal analysis:
Supporting evidence: Advisory signal |
14 tasks
nellshamrell
pushed a commit
to nellshamrell/aspire
that referenced
this pull request
May 18, 2026
Bump the repo-local .NET SDK to 10.0.300 and clean up dependency inputs that were still producing Component Governance warnings in AzDO pipeline 1602. Pin MongoDB.Driver compression transitives to patched versions, remove unused Swashbuckle from the JavaScript playground, and adjust the Java playground dependency management to avoid stale Maven and Netty/Reactor pins. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
davidfowl
added a commit
that referenced
this pull request
May 18, 2026
Revert the SDK and tools dotnet version in global.json back to 10.0.201 to unblock Azure DevOps pipeline 1602 while preserving the other dependency updates from PR #17190. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This was referenced Jun 5, 2026
14 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
AzDO pipeline 1602 was still reporting Component Governance and CFS warnings after the previous cleanup because a few build inputs were still pinned to flagged versions or resolving vulnerable transitives from upstream dependency metadata.
This change updates those inputs without adding new direct dependencies:
AddSwaggerGen,UseSwagger,UseSwaggerUI, orWithOpenApi; it only retains the template Swagger comment and the existingMicrosoft.AspNetCore.OpenApireference.SharpCompressandSnappier) through NuGet Central Package Management transitive pinning, with comments explaining why they are present.Validation:
restore.cmdbuild.cmd /p:SkipNativeBuild=truedotnet build playground\AspireWithJavaScript\AspireJavaScript.MinimalApi\AspireJavaScript.MinimalApi.csproj --no-restore /p:SkipNativeBuild=truedotnet list Aspire.slnx package --include-transitiveconfirmedSharpCompress 1.0.0andSnappier 1.3.1resolve.Fixes # (issue)
Checklist
<remarks />and<code />elements on your triple slash comments?