From 8a51b61c754291994c98d3efb778c0b00beaed0e Mon Sep 17 00:00:00 2001
From: David Fowler <davidfowl@gmail.com>
Date: Sun, 17 May 2026 08:13:03 -0700
Subject: [PATCH] Fix Component Governance warnings

Bump the repo-local .NET SDK to 10.0.300 and clean up dependency inputs that were still producing Component Governance warnings in AzDO pipeline 1602.

Pin MongoDB.Driver compression transitives to patched versions, remove unused Swashbuckle from the JavaScript playground, and adjust the Java playground dependency management to avoid stale Maven and Netty/Reactor pins.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 Directory.Packages.props                      |  4 +-
 global.json                                   |  4 +-
 .../AspireJavaScript.MinimalApi.csproj        |  1 -
 .../PostgresEndToEnd.JavaService/pom.xml      | 49 ++++++-------------
 4 files changed, 19 insertions(+), 39 deletions(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index 146466c3d82..9ef05d3a892 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -184,10 +184,12 @@
     <PackageVersion Include="Microsoft.Azure.Functions.Worker.Extensions.DurableTask" Version="1.16.5" />
     <PackageVersion Include="Microsoft.Azure.Functions.Worker.Extensions.DurableTask.AzureManaged" Version="1.0.1" />
     <!-- playground apps dependencies for javascript -->
-    <PackageVersion Include="Swashbuckle.AspNetCore" Version="10.1.7" />
     <!-- Pinned versions for Component Governance - Remove when root dependencies are updated -->
     <PackageVersion Include="Azure.Core" Version="1.55.0" />
     <PackageVersion Include="Azure.Identity" Version="1.21.0" />
+    <!-- MongoDB.Driver pulls these compression packages transitively; pin them here until its dependency metadata no longer requests CG-flagged versions. -->
+    <PackageVersion Include="SharpCompress" Version="1.0.0" />
+    <PackageVersion Include="Snappier" Version="1.3.1" />
     <!-- https://github.com/Azure/azure-cosmos-dotnet-v3/pull/3313 -->
     <PackageVersion Include="Newtonsoft.Json" Version="13.0.4" />
   </ItemGroup>
diff --git a/global.json b/global.json
index 0527dc9d64d..c45b51bd7d9 100644
--- a/global.json
+++ b/global.json
@@ -1,6 +1,6 @@
 {
   "sdk": {
-    "version": "10.0.201",
+    "version": "10.0.300",
     "rollForward": "major",
     "allowPrerelease": true,
     "paths": [
@@ -10,7 +10,7 @@
     "errorMessage": "The .NET SDK could not be found. Run ./restore.sh (Linux/macOS) or ./restore.cmd (Windows) to install the local SDK."
   },
   "tools": {
-    "dotnet": "10.0.201",
+    "dotnet": "10.0.300",
     "runtimes": {
       "dotnet/x64": [
         "$(DotNetRuntimePreviousVersionForTesting)",
diff --git a/playground/AspireWithJavaScript/AspireJavaScript.MinimalApi/AspireJavaScript.MinimalApi.csproj b/playground/AspireWithJavaScript/AspireJavaScript.MinimalApi/AspireJavaScript.MinimalApi.csproj
index 47b19cfaecf..6a2ddd703ff 100644
--- a/playground/AspireWithJavaScript/AspireJavaScript.MinimalApi/AspireJavaScript.MinimalApi.csproj
+++ b/playground/AspireWithJavaScript/AspireJavaScript.MinimalApi/AspireJavaScript.MinimalApi.csproj
@@ -9,7 +9,6 @@
 
   <ItemGroup>
     <PackageReference Include="Microsoft.AspNetCore.OpenApi" />
-    <PackageReference Include="Swashbuckle.AspNetCore" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/playground/PostgresEndToEnd/PostgresEndToEnd.JavaService/pom.xml b/playground/PostgresEndToEnd/PostgresEndToEnd.JavaService/pom.xml
index dc5b406197d..17657d085fb 100644
--- a/playground/PostgresEndToEnd/PostgresEndToEnd.JavaService/pom.xml
+++ b/playground/PostgresEndToEnd/PostgresEndToEnd.JavaService/pom.xml
@@ -13,59 +13,38 @@
         <maven.compiler.source>17</maven.compiler.source>
         <maven.compiler.target>17</maven.compiler.target>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+        <netty.version>4.1.133.Final</netty.version>
+        <reactor-netty.version>1.2.17</reactor-netty.version>
     </properties>
 
-    <repositories>
-        <repository>
-            <id>central</id>
-            <url>https://repo.maven.apache.org/maven2</url>
-        </repository>
-    </repositories>
-
-    <pluginRepositories>
-        <pluginRepository>
-            <id>central</id>
-            <url>https://repo.maven.apache.org/maven2</url>
-        </pluginRepository>
-    </pluginRepositories>
-
     <dependencyManagement>
         <dependencies>
             <!--
-                These overrides pin transitive versions brought in by azure-identity (via azure-core,
-                msal4j, reactor-netty, etc.) and the PostgreSQL JDBC driver. They exist so Component
-                Governance sees the patched versions rather than whatever older versions the upstream
-                BOMs would otherwise resolve.
+                These overrides pin transitive versions brought in by azure-identity, Javalin,
+                and the PostgreSQL JDBC driver so Component Governance sees patched versions
+                rather than older versions from upstream dependency metadata.
             -->
-            <dependency>
-                <groupId>org.postgresql</groupId>
-                <artifactId>postgresql</artifactId>
-                <version>42.7.11</version>
-            </dependency>
             <dependency>
                 <groupId>io.netty</groupId>
-                <artifactId>netty-codec-http2</artifactId>
-                <version>4.1.133.Final</version>
+                <artifactId>netty-bom</artifactId>
+                <version>${netty.version}</version>
+                <type>pom</type>
+                <scope>import</scope>
             </dependency>
             <dependency>
-                <groupId>com.nimbusds</groupId>
-                <artifactId>nimbus-jose-jwt</artifactId>
-                <version>9.48</version>
+                <groupId>org.postgresql</groupId>
+                <artifactId>postgresql</artifactId>
+                <version>42.7.11</version>
             </dependency>
             <dependency>
                 <groupId>io.projectreactor.netty</groupId>
                 <artifactId>reactor-netty-core</artifactId>
-                <version>1.0.48</version>
+                <version>${reactor-netty.version}</version>
             </dependency>
             <dependency>
                 <groupId>io.projectreactor.netty</groupId>
                 <artifactId>reactor-netty-http</artifactId>
-                <version>1.0.48</version>
-            </dependency>
-            <dependency>
-                <groupId>io.netty</groupId>
-                <artifactId>netty-handler</artifactId>
-                <version>4.1.133.Final</version>
+                <version>${reactor-netty.version}</version>
             </dependency>
         </dependencies>
     </dependencyManagement>