Dependencies: Update NuGet packages to latest minor and patch versions - #23269
Merged
Conversation
Bump all NuGet dependencies that were behind to their latest available minor or patch release, as reported by dotnet-outdated. No major-version updates are included, and pre-release/intentionally-held packages (Umbraco.Code, StyleCop.Analyzers, transitive security pins for Dazinator/Markdown) are left untouched. The System.Security.Cryptography.Xml transitive pin is bumped in step with the other Microsoft 10.0.x packages, since the updated Examine and OpenIddict now require it at >= 10.0.7. Smoke-tested: full Release solution build (0 errors) and the Umbraco.Tests.UnitTests suite (all green). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Claude finished @AndyButland's task in 2m 33s —— View job PR ReviewTarget: Bumps 31 NuGet packages to their latest minor/patch versions for the 17.6 release; no major-version updates. Suggestions
Approved with Suggestions for improvementGood to go, but please carefully consider the importance of the suggestions. |
Contributor
There was a problem hiding this comment.
Pull request overview
Routine dependency maintenance for the v17/dev (17.6) line, updating centrally-managed NuGet packages (plus a couple of inline/template references) to the latest available minor/patch versions, keeping the repo’s package versions aligned and avoiding downgrade conflicts.
Changes:
- Bumped centrally-managed production dependencies in
Directory.Packages.props(Microsoft 10.0.6→10.0.9, Examine 3.8→3.9, OpenIddict 7.4→7.5, Swashbuckle 10.1.7→10.2.3, etc.). - Updated test package versions in
tests/Directory.Packages.propsto match the newer Microsoft patch levels. - Aligned inline/template package references with the central versions (EFCore.Design in
Umbraco.Web.UI.csproj, Swashbuckle in the extension template).
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
Directory.Packages.props |
Central minor/patch NuGet bumps, incl. transitive pin update and Swashbuckle alignment note. |
tests/Directory.Packages.props |
Test dependency bumps to corresponding patch/minor versions. |
src/Umbraco.Web.UI/Umbraco.Web.UI.csproj |
Inline EF Core Design package version bump (project opts out of central management). |
templates/UmbracoExtension/Umbraco.Extension.csproj |
Swashbuckle version bump to stay aligned with central package version. |
…onale Address PR review feedback on the pinned-dependency comments: - Microsoft.EntityFrameworkCore.Design 10.0.9 no longer pulls a (vulnerable) Microsoft.Build.Tasks.Core transitively, so the direct override reference in Umbraco.Web.UI is removed along with its comment. Verified with `dotnet nuget why` and `dotnet list package --vulnerable`. - The System.Security.Cryptography.Xml transitive pin is still required (removing it resolves the vulnerable 8.0.0). Its comment is corrected to name the real drivers (Examine via Microsoft.AspNetCore.DataProtection and OpenIddict's *.DataProtection packages) and drops the stale "8.0.4". Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Microsoft.AspNetCore.OpenApi / Swashbuckle only require Microsoft.OpenApi >= 2.0.0, which resolves to the vulnerable 2.0.0 (CVE-2026-49451, GHSA-v5pm-xwqc-g5wc: stack overflow on circular schema references). Pin forward to the latest patched 2.x (2.9.0): - transitive pin in Directory.Packages.props for centrally-managed projects - direct reference in Umbraco.Web.UI, which opts out of central package management so the transitive pin does not reach it Verified Microsoft.OpenApi now resolves to 2.9.0 everywhere and the advisory no longer appears in `dotnet list package --vulnerable`. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Zeegaan
added
dependencies
This was referenced Jul 28, 2026
Closed
This was referenced Aug 7, 2026
This was referenced Aug 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Routine dependency maintenance for the 17.6 release (targets
v17/dev). Updates all NuGet packages that were behind to their latest available minor or patch version, as reported bydotnet-outdated. No major-version updates are included.Versions are managed centrally in the two
Directory.Packages.propsfiles, plus the inline version inUmbraco.Web.UI.csprojand thetemplates/UmbracoExtensionproject.A direct dependency to
Microsoft.OpenApihas been added to resolve what is otherwise reported as a vulnerability.Production packages (
Directory.Packages.props)Test packages (
tests/Directory.Packages.props)Inline / template versions
src/Umbraco.Web.UI/Umbraco.Web.UI.csproj:Microsoft.EntityFrameworkCore.Design10.0.6 → 10.0.9templates/UmbracoExtension:Swashbuckle.AspNetCore10.1.7 → 10.2.3 (keeping it aligned with the root file)Deliberately left unchanged
Markdig(held at0.45.0),Microsoft.CodeAnalysis.CSharp(4.x),Microsoft.Build.Tasks.Core(17.x),Asp.Versioning.*(8.x).StyleCop.Analyzers(beta).Dazinator.Extensions.FileProvidersandMarkdown.The
System.Security.Cryptography.Xmltransitive pin was bumped alongside the other Microsoft10.0.xpackages because the updatedExamineandOpenIddictnow require it at>= 10.0.7; keeping it at the old version caused a NuGet downgrade error.Testing
Solution should build and CI checks pass.