Closed pavelsavara closed 1 month ago
Tagging subscribers to 'arch-wasm': @lewing See info in area-owners.md if you want to be subscribed.
Note that this means that you are using the nuget.org feed somewhere which is unrelated but should be fixed as well. NU1903 is part of the NuGet Audit feature which only works with the nuget.org feed atm.
cc @lewing
Unfortunately, I don't know how these tests work. Can someone please file an issue for the nuget.org issue?
In wbt we're populating nuget config here: https://github.com/dotnet/runtime/blob/f9eda079502aa737ed7c75cf14dea10223cfb0fa/src/mono/wasm/Wasm.Build.Tests/Blazor/BlazorWasmTestBase.cs#L35
that produces:
<packageSources>
<clear />
<add key="nuget-local" value="C:\Users\user\source\repos\runtime-fork\artifacts\packages\Debug\Shipping\" />
<add key="dotnet8" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet8/nuget/v3/index.json" />
<add key="dotnet9" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet9/nuget/v3/index.json" />
<add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
</packageSources>
Do you mean we should remove <add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
?
Yes. AFAIK using the nuget.org feed in our builds is disallowed for security reasons. cc @mmitche
I can confirm that this package is using version 8.0.0:
When will this be fixed?
Copied from a mail conversation:
.NET's policy is that we do not publish new intermediate packages for the sole purpose of updating a leaf dependency. This is instead an application-level concern. We rely on NuGet functionality to make updating leaf dependencies simple and painless.
We don't yet have that documented but we will follow-up on it.
@ViktorHofer I am not knowledgeable with this ..but let me get this in my head?
VS is telling me that this particular NuGet package is using a vulnerable assembly. So why do I have to fix this? Why do I have to manually download another top level dependency for what is currently translative? I don't understand the logic. Surely, something, somewhere is responsible for using a vulnerable version and it should be rectified. No? Otherwise the headache is put on our shoulders and technically, the issue is not with out code but the NuGet packages concerned.
Log
Build Information
Build: https://dev.azure.com/dnceng-public/public/_build/results?buildId=737345 Build error leg or test failing:
Error Message
Fill the error message using step by step known issues guidance.
Known issue validation
Build: :mag_right: https://dev.azure.com/dnceng-public/public/_build/results?buildId=737345 Error message validated:
[NU1903: Package 'System.Text.Json' 8.0.0 has a known high severity vulnerability
] Result validation: :white_check_mark: Known issue matched with the provided build. Validation performed at: 7/11/2024 4:23:34 PM UTCReport
Summary