Update the Nuget.* package versions

fsprojects / FAKE

FAKE - F# Make

https://fake.build

Other

1.28k stars 582 forks source link

Update the Nuget.* package versions #2761

Closed Numpsy closed 9 months ago

Numpsy commented 10 months ago

Description

Updates references to Nuget.Protocol and related libraries to version 6.7.0, to avoid versions with known security vulnerabilities.

refs #2760

TODO

I don't know if this should be updated to the current version (6.7.0) or the most-minimal update that is listed without vulnerabilities (6.0.5)?
I know pretty much nothing about Paket, so I hope this is the right way to do an update
It's possible that it'll conflict with the other pending PRs to update dependencies

xperiandri commented 9 months ago

Are only packet.lock changes required? Not paket.dependencies also?

Numpsy commented 9 months ago

It didn't update anything else when I did the update, but I do just notice that I updated the fakemodule group and not the fakerunner group, and I suppose those should be in step (maybe it didn't auto update because it's a transitive dependency of Paket.Core rather than a direct one?)

xperiandri commented 9 months ago

Please, try updating one more time on top of the latest master from scratch

Numpsy commented 9 months ago

I tried updating and got merge conflcts, so instead of trying to update here I made a clean PR at #2764 2764