Skip to content

Commit 6d8eeff

Browse files
bart-vmwarebart-vmware
authored
Bump 3x vulnerable dependencies; drop net60 (#1688)
* Update GHA workflow to detect vulnerable dependencies * Update GHA package workflow * Target .NET 8 for Integration/Messaging/Stream * Drop .NET 6 * Update to non-vulnerable OpenTelemetry 1.15.x version line The following projects now target net8.0 instead of netstandard: - Steeltoe.Management.OpenTelemetryBase - Steeltoe.Management.TracingBase - Steeltoe.Management.EndpointBase.csproj This was done because OpenTelemetry packages on netstandard depend on 10.0 assemblies from System/Microsoft libraries * Bump System/Microsoft dependencies to consistent 8.x release line, to avoid versioning conflicts and clean up leftovers from the time when netstandard matched netcore3.1 * Upgrade KubernetesClient to 19.0.2; retarget Common.Kubernetes, Configuration.KubernetesBase, and Discovery.Kubernetes to net8.0 only, because there no non-vulnerable version of KubernetesClient exists that targets netstandard * Target net8.0 in addition to netstandard, to get the richer API surface of third-party dependencies in downstream dependencies that target net8.0 * Pin transitive System.Security.Cryptography.Xml to a patched 8.x release * Pin transitive System.Net.Http and System.Text.RegularExpressions in HystrixBase
1 parent 3e1cb39 commit 6d8eeff

185 files changed

Lines changed: 609 additions & 572 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/package.yml‎

Lines changed: 21 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -31,17 +31,19 @@ jobs:
3131

3232
steps:
3333
- name: Setup .NET
34-
uses: actions/setup-dotnet@v4
34+
uses: actions/setup-dotnet@v5
3535
with:
3636
dotnet-version: |
37-
6.0.*
3837
8.0.*
38+
10.0.*
3939
4040
- name: Git checkout
41-
uses: actions/checkout@v4
41+
uses: actions/checkout@v6
42+
with:
43+
persist-credentials: false
4244

4345
- name: Restore packages
44-
run: dotnet restore ${{ env.SOLUTION_FILE }} --verbosity minimal
46+
run: dotnet restore ${{ env.SOLUTION_FILE }} /p:Configuration=Release /p:NuGetAudit=false --verbosity minimal
4547

4648
- name: Calculate package version (for release)
4749
if: ${{ github.event_name == 'release' }}
@@ -108,7 +110,7 @@ jobs:
108110
run: dotnet pack ${{ env.SOLUTION_FILE }} --no-build --configuration Release --output ${{ github.workspace }}/packages /p:VersionSuffix=${{ env.PACKAGE_VERSION_SUFFIX }}
109111

110112
- name: Upload unsigned packages
111-
uses: actions/upload-artifact@v4
113+
uses: actions/upload-artifact@v7
112114
with:
113115
if-no-files-found: error
114116
name: unsigned-packages
@@ -126,21 +128,21 @@ jobs:
126128

127129
steps:
128130
- name: Download unsigned packages
129-
uses: actions/download-artifact@v4
131+
uses: actions/download-artifact@v8
130132
with:
131133
name: unsigned-packages
132134
path: packages
133135

134136
- name: Setup .NET
135-
uses: actions/setup-dotnet@v4
137+
uses: actions/setup-dotnet@v5
136138
with:
137139
dotnet-version: 8.0.*
138140

139141
- name: Install code signing tool
140142
run: dotnet tool install --global sign --prerelease
141143

142144
- name: Azure login
143-
uses: azure/login@v2
145+
uses: azure/login@v3
144146
with:
145147
client-id: ${{ secrets.AZURE_CLIENT_ID }}
146148
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -159,7 +161,7 @@ jobs:
159161
--description-url 'https://steeltoe.io/'
160162
161163
- name: Upload signed packages
162-
uses: actions/upload-artifact@v4
164+
uses: actions/upload-artifact@v7
163165
with:
164166
if-no-files-found: error
165167
name: signed-packages
@@ -179,22 +181,22 @@ jobs:
179181

180182
steps:
181183
- name: Azure login
182-
uses: azure/login@v2
184+
uses: azure/login@v3
183185
with:
184186
client-id: ${{ secrets.AZURE_CLIENT_ID }}
185187
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
186188
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
187189

188190
- name: Download signed packages
189-
uses: actions/download-artifact@v4
191+
uses: actions/download-artifact@v8
190192
with:
191193
name: signed-packages
192194
path: packages
193195

194196
- name: Setup .NET
195-
uses: actions/setup-dotnet@v4
197+
uses: actions/setup-dotnet@v5
196198
with:
197-
dotnet-version: 8.0.x
199+
dotnet-version: 8.0.*
198200
source-url: ${{ vars.AZURE_ARTIFACTS_FEED_URL }}
199201
env:
200202
NUGET_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -223,12 +225,12 @@ jobs:
223225

224226
steps:
225227
- name: Setup .NET
226-
uses: actions/setup-dotnet@v4
228+
uses: actions/setup-dotnet@v5
227229
with:
228-
dotnet-version: 8.0.x
230+
dotnet-version: 8.0.*
229231

230232
- name: Download signed packages
231-
uses: actions/download-artifact@v4
233+
uses: actions/download-artifact@v8
232234
with:
233235
name: signed-packages
234236
path: packages
@@ -248,7 +250,9 @@ jobs:
248250

249251
steps:
250252
- name: Git checkout
251-
uses: actions/checkout@v4
253+
uses: actions/checkout@v6
254+
with:
255+
persist-credentials: true
252256

253257
- name: Calculate next package version
254258
shell: pwsh

‎.github/workflows/scan-vulnerable-dependencies.yml‎

Lines changed: 21 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -27,14 +27,31 @@ jobs:
2727

2828
steps:
2929
- name: Setup .NET
30-
uses: actions/setup-dotnet@v4
30+
uses: actions/setup-dotnet@v5
3131
with:
3232
dotnet-version: |
33-
6.0.*
3433
8.0.*
34+
10.0.*
3535
3636
- name: Git checkout
37-
uses: actions/checkout@v4
37+
uses: actions/checkout@v6
38+
with:
39+
persist-credentials: false
3840

3941
- name: Report vulnerable dependencies
40-
run: dotnet restore ${{ env.SOLUTION_FILE }} --verbosity minimal /p:NuGetAudit=true /p:NuGetAuditMode=all /p:NuGetAuditLevel=low /p:TreatWarningsAsErrors=True
42+
shell: pwsh
43+
run: |
44+
$ErrorActionPreference = 'Stop'
45+
$PSNativeCommandUseErrorActionPreference = $true
46+
47+
$output = dotnet list ${{ env.SOLUTION_FILE }} package --vulnerable --include-transitive --format json --output-version 1 2>&1
48+
$text = ($output | Out-String).TrimEnd()
49+
$json = $text | ConvertFrom-Json
50+
51+
foreach ($project in $json.projects) {
52+
if ($project.frameworks) {
53+
Write-Host 'Vulnerable package references were found.'
54+
dotnet list ${{ env.SOLUTION_FILE }} package --vulnerable --include-transitive
55+
exit 1
56+
}
57+
}

‎Directory.Build.props‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
<Project>
2+
<PropertyGroup>
3+
<EnableUnsafeBinaryFormatterSerialization>true</EnableUnsafeBinaryFormatterSerialization>
4+
</PropertyGroup>
5+
</Project>

‎azure-pipelines.yml‎

Lines changed: 4 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -33,14 +33,14 @@ jobs:
3333
pool:
3434
vmImage: $(imageName)
3535
steps:
36-
- task: UseDotNet@2
37-
displayName: Install .NET 6
38-
inputs:
39-
version: 6.0.x
4036
- task: UseDotNet@2
4137
displayName: Install .NET 8
4238
inputs:
4339
version: 8.0.x
40+
- task: UseDotNet@2
41+
displayName: Install .NET 10
42+
inputs:
43+
version: 10.0.x
4444
- pwsh: |
4545
# https://github.com/dotnet/core/issues/4749#issuecomment-2329706172
4646
wget http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl1.1_1.1.1f-1ubuntu2.24_amd64.deb
@@ -87,13 +87,6 @@ jobs:
8787
projects: '**/*.csproj'
8888
arguments: '--blame-hang-timeout 3m -f net8.0 --no-build -c $(buildConfiguration) -maxcpucount:1 $(skipFilter) --collect "XPlat Code Coverage" --settings coverlet.runsettings --logger trx --results-directory $(Build.SourcesDirectory)'
8989
publishTestResults: false
90-
- task: DotNetCoreCLI@2
91-
displayName: dotnet test 6.0
92-
inputs:
93-
command: test
94-
projects: '**/*.csproj'
95-
arguments: '--blame-hang-timeout 3m -f net6.0 --no-build -c $(buildConfiguration) -maxcpucount:1 $(skipFilter) --collect "XPlat Code Coverage" --settings coverlet.runsettings --logger trx --results-directory $(Build.SourcesDirectory)'
96-
publishTestResults: false
9790
- task: CopyFiles@2
9891
condition: failed()
9992
inputs:

‎build/templates/component-build.yaml‎

Lines changed: 4 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -16,14 +16,14 @@ jobs:
1616
pool:
1717
vmImage: ${{parameters.OS}}-latest
1818
steps:
19-
- task: UseDotNet@2
20-
displayName: Install .NET 6
21-
inputs:
22-
version: 6.0.x
2319
- task: UseDotNet@2
2420
displayName: Install .NET 8
2521
inputs:
2622
version: 8.0.x
23+
- task: UseDotNet@2
24+
displayName: Install .NET 10
25+
inputs:
26+
version: 10.0.x
2727
- task: DotNetCoreCLI@2
2828
displayName: dotnet restore
2929
inputs:
@@ -52,13 +52,6 @@ jobs:
5252
projects: $(SolutionFile)
5353
arguments: -f net8.0 ${{parameters.skipFilter}} $(CommonTestArgs)
5454
publishTestResults: false
55-
- task: DotNetCoreCLI@2
56-
displayName: dotnet test 6.0
57-
inputs:
58-
command: test
59-
projects: $(SolutionFile)
60-
arguments: -f net6.0 ${{parameters.skipFilter}} $(CommonTestArgs)
61-
publishTestResults: false
6255
- task: CopyFiles@2
6356
condition: failed()
6457
inputs:

‎sharedproject.props‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -57,9 +57,4 @@
5757
<ItemGroup>
5858
<None Include="..\..\..\..\build\icon.png" Pack="true" PackagePath="\"/>
5959
</ItemGroup>
60-
61-
<ItemGroup>
62-
<!-- All versions of Microsoft.Rest.ClientRuntime are vulnerable, but all higher versions of KubernetesClient without breaking changes depend on it. -->
63-
<NuGetAuditSuppress Include="https://github.com/advisories/GHSA-whph-446h-6m9v" />
64-
</ItemGroup>
6560
</Project>

‎sharedtest.props‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -37,9 +37,4 @@
3737
<IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
3838
</PackageReference>
3939
</ItemGroup>
40-
41-
<ItemGroup>
42-
<!-- All versions of Microsoft.Rest.ClientRuntime are vulnerable, but all higher versions of KubernetesClient without breaking changes depend on it. -->
43-
<NuGetAuditSuppress Include="https://github.com/advisories/GHSA-whph-446h-6m9v" />
44-
</ItemGroup>
4540
</Project>

‎src/Bootstrap/src/Autoconfig/Steeltoe.Bootstrap.Autoconfig.csproj‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<Project Sdk="Microsoft.NET.Sdk">
22
<PropertyGroup>
3-
<TargetFrameworks>net8.0;net6.0</TargetFrameworks>
3+
<TargetFrameworks>net8.0</TargetFrameworks>
44
<RootNamespace>Steeltoe.Bootstrap.Autoconfig</RootNamespace>
55
<Description>Package for automatically configuring Steeltoe packages that have separately been added to a project.</Description>
66
<PackageTags>Autoconfiguration;automatic configuration;application bootstrapping</PackageTags>

‎src/Bootstrap/test/Autoconfig.Test/HostBuilderExtensionsTest.cs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -302,7 +302,7 @@ public void TracingBase_IsAutowired()
302302
Assert.NotNull(host.Services.GetService<IDynamicMessageProcessor>());
303303

304304
// confirm instrumentation(s) were added as expected
305-
var instrumentations = tracerProvider.GetType().GetField("instrumentations", BindingFlags.NonPublic | BindingFlags.Instance).GetValue(tracerProvider) as List<object>;
305+
var instrumentations = OpenTelemetrySdkReflection.GetTracerProviderInstrumentations(tracerProvider);
306306
Assert.NotNull(instrumentations);
307307
Assert.Single(instrumentations);
308308
Assert.Contains(instrumentations, obj => obj.GetType().Name.Contains("Http"));
@@ -325,7 +325,7 @@ public void TracingCore_IsAutowired()
325325
Assert.NotNull(host.Services.GetService<IDynamicMessageProcessor>());
326326

327327
// confirm instrumentation(s) were added as expected
328-
var instrumentations = tracerProvider.GetType().GetField("instrumentations", BindingFlags.NonPublic | BindingFlags.Instance).GetValue(tracerProvider) as List<object>;
328+
var instrumentations = OpenTelemetrySdkReflection.GetTracerProviderInstrumentations(tracerProvider);
329329
Assert.NotNull(instrumentations);
330330
Assert.Equal(2, instrumentations.Count);
331331
Assert.Contains(instrumentations, obj => obj.GetType().Name.Contains("Http"));

‎src/Bootstrap/test/Autoconfig.Test/OpenTelemetrySdkReflection.cs‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
// Licensed to the .NET Foundation under one or more agreements.
2+
// The .NET Foundation licenses this file to you under the Apache 2.0 License.
3+
// See the LICENSE file in the project root for more information.
4+
5+
using OpenTelemetry.Trace;
6+
using System.Collections.Generic;
7+
using System.Reflection;
8+
9+
namespace Steeltoe.Bootstrap.Autoconfig.Test;
10+
11+
/// <summary>
12+
/// Reflection helpers for OpenTelemetry SDK internals used by tests.
13+
/// </summary>
14+
public static class OpenTelemetrySdkReflection
15+
{
16+
public static List<object> GetTracerProviderInstrumentations(TracerProvider tracerProvider)
17+
{
18+
var property = tracerProvider?.GetType().GetProperty(
19+
"Instrumentations",
20+
BindingFlags.Public | BindingFlags.NonPublic | BindingFlags.Instance);
21+
22+
return property?.GetValue(tracerProvider) as List<object>;
23+
}
24+
}

0 commit comments

Comments
 (0)