From 4deb8c1ed68ca14fb94e13c4f53f87e3d9a80027 Mon Sep 17 00:00:00 2001 From: samatstarion Date: Thu, 15 Aug 2024 12:54:17 +0200 Subject: [PATCH] [Update] System.Text.RegularExpressions version 4.3.1 - resolves transitive vulnerability --- .github/workflows/nuget-reference-check.yml | 34 +++++++++++++++++++ CDP4-SDK.sln | 2 -- CDP4Common/CDP4Common.csproj | 8 +++-- CDP4Dal/CDP4Dal.csproj | 4 +-- CDP4DalCommon/CDP4DalCommon.csproj | 4 +-- .../CDP4JsonFileDal.NetCore.Tests.csproj | 4 +++ CDP4JsonFileDal/CDP4JsonFileDal.csproj | 4 +-- CDP4JsonSerializer/CDP4JsonSerializer.csproj | 4 +-- .../CDP4MessagePackSerializer.csproj | 4 +-- CDP4Reporting/CDP4Reporting.csproj | 4 +-- .../CDP4RequirementsVerification.csproj | 4 +-- CDP4Rules/CDP4Rules.csproj | 4 +-- CDP4ServicesDal/CDP4ServicesDal.csproj | 4 +-- .../CDP4ServicesMessaging.csproj | 5 ++- CDP4Web/CDP4Web.csproj | 4 +-- CDP4WspDal/CDP4WspDal.csproj | 4 +-- 16 files changed, 68 insertions(+), 29 deletions(-) create mode 100644 .github/workflows/nuget-reference-check.yml diff --git a/.github/workflows/nuget-reference-check.yml b/.github/workflows/nuget-reference-check.yml new file mode 100644 index 00000000..6acf7906 --- /dev/null +++ b/.github/workflows/nuget-reference-check.yml @@ -0,0 +1,34 @@ +name: "nuget package reference check" + +on: + push: + pull_request: + schedule: + - cron: '0 8 * * *' + +jobs: + build: + runs-on: ubuntu-latest + steps: + - name: Checkout repository + uses: actions/checkout@v4 + with: + # We must fetch at least the immediate parents so that if this is + # a pull request then we can checkout the head. + fetch-depth: 2 + + - name: Setup .NET Environment + uses: actions/setup-dotnet@v4 + with: + dotnet-version: 8.0.x + + - name: Checking NuGet vulnerabilites + run: | + dotnet list CDP4-SDK.sln package --outdated --include-transitive 2>&1 | tee build.log + + dotnet list CDP4-SDK.sln package --deprecated --include-transitive 2>&1 | tee -a build.log + + dotnet list CDP4-SDK.sln package --vulnerable --include-transitive 2>&1 | tee -a build.log + + echo "Analyze dotnet list package command log output..." + grep -q -i "critical\|high\|moderate\|low" build.log; [ $? -eq 0 ] && echo "Security Vulnerabilities found on the log output" && exit 1 \ No newline at end of file diff --git a/CDP4-SDK.sln b/CDP4-SDK.sln index 4b54bcb1..a239f5d9 100644 --- a/CDP4-SDK.sln +++ b/CDP4-SDK.sln @@ -50,8 +50,6 @@ EndProject Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Solution Items", "Solution Items", "{8B27CAF4-B780-43A8-B0CA-768A294C599C}" ProjectSection(SolutionItems) = preProject CDP4-SDK.sln.DotSettings = CDP4-SDK.sln.DotSettings - .github\workflows\codeql-analysis.yml = .github\workflows\codeql-analysis.yml - .github\workflows\CodeQuality.yml = .github\workflows\CodeQuality.yml README.md = README.md EndProjectSection EndProject diff --git a/CDP4Common/CDP4Common.csproj b/CDP4Common/CDP4Common.csproj index 27ca358b..1715a0c3 100644 --- a/CDP4Common/CDP4Common.csproj +++ b/CDP4Common/CDP4Common.csproj @@ -4,7 +4,7 @@ net48;netstandard2.0 Starion Group S.A. CDP4Common Community Edition - 27.2.2 + 27.2.3 CDP4 Common Class Library that contains DTOs, POCOs Copyright © Starion Group S.A. Sam, Merlin, Alex, Naron, Alexander, Yevhen, Nathanael, Ahmed @@ -20,7 +20,7 @@ CDP COMET ECSS-E-TM-10-25 LGPL-3.0-only - [Update] NLog version 5.3.3 + [Update] System.Text.RegularExpressions version 4.3.1 - resolves transitive vulnerability README.md @@ -49,4 +49,8 @@ + + + + \ No newline at end of file diff --git a/CDP4Dal/CDP4Dal.csproj b/CDP4Dal/CDP4Dal.csproj index 43b6108a..2ebd4901 100644 --- a/CDP4Dal/CDP4Dal.csproj +++ b/CDP4Dal/CDP4Dal.csproj @@ -4,7 +4,7 @@ net48;netstandard2.0 Starion Group S.A. CDP4Dal Community Edition - 27.2.2 + 27.2.3 CDP4 Data Access Layer library, a consumer of an ECSS-E-TM-10-25 Annex C API Copyright © Starion Group S.A. Sam, Merlin, Alex, Naron, Alexander, Yevhen, Nathanael, Ahmed @@ -20,7 +20,7 @@ CDP COMET ECSS-E-TM-10-25 LGPL-3.0-only - [Update] System.Reactive version 6.0.1 + [BUMP] To CDP4Common 27.2.3 README.md diff --git a/CDP4DalCommon/CDP4DalCommon.csproj b/CDP4DalCommon/CDP4DalCommon.csproj index d6916801..2d156e82 100644 --- a/CDP4DalCommon/CDP4DalCommon.csproj +++ b/CDP4DalCommon/CDP4DalCommon.csproj @@ -5,7 +5,7 @@ Starion Group S.A. latest CDP4DalCommon Community Edition - 27.2.2 + 27.2.3 CDP4 Common Class Library that contains common types for any CDP4 server and the CDP4Dal Copyright © Starion Group S.A. Sam, Alex, Alexander, Nathanael, Antoine, Omar, Jaime @@ -21,7 +21,7 @@ CDP COMET ECSS-E-TM-10-25 LGPL-3.0-only - [BUMP] To CDP4Common 27.2.2 + [BUMP] To CDP4Common 27.2.3 README.md true diff --git a/CDP4JsonFileDal.NetCore.Tests/CDP4JsonFileDal.NetCore.Tests.csproj b/CDP4JsonFileDal.NetCore.Tests/CDP4JsonFileDal.NetCore.Tests.csproj index 02538cfc..2d3b7cbe 100644 --- a/CDP4JsonFileDal.NetCore.Tests/CDP4JsonFileDal.NetCore.Tests.csproj +++ b/CDP4JsonFileDal.NetCore.Tests/CDP4JsonFileDal.NetCore.Tests.csproj @@ -16,6 +16,10 @@ + + + + diff --git a/CDP4JsonFileDal/CDP4JsonFileDal.csproj b/CDP4JsonFileDal/CDP4JsonFileDal.csproj index f5c3510c..ee113d12 100644 --- a/CDP4JsonFileDal/CDP4JsonFileDal.csproj +++ b/CDP4JsonFileDal/CDP4JsonFileDal.csproj @@ -4,7 +4,7 @@ net48;netstandard2.0 Starion Group S.A. CDP4JsonFileDal Community Edition - 27.2.2 + 27.2.3 CDP4 Json File Dal Plugin Copyright © Starion Group S.A. Sam, Merlin, Alex, Naron, Alexander, Yevhen, Nathanael @@ -20,7 +20,7 @@ CDP COMET ECSS-E-TM-10-25 LGPL-3.0-only - [BUMP] To CDP4Common 27.2.2 + [BUMP] To CDP4Common 27.2.3 README.md diff --git a/CDP4JsonSerializer/CDP4JsonSerializer.csproj b/CDP4JsonSerializer/CDP4JsonSerializer.csproj index 0ba94c68..a50fed98 100644 --- a/CDP4JsonSerializer/CDP4JsonSerializer.csproj +++ b/CDP4JsonSerializer/CDP4JsonSerializer.csproj @@ -4,7 +4,7 @@ net48;netstandard2.0 Starion Group S.A. CDP4JsonSerializer Community Edition - 27.2.2 + 27.2.3 CDP4 JSON Serialization Library Copyright © Starion Group S.A. Sam, Merlin, Alex, Naron, Alexander, Yevhen, Nathanael @@ -20,7 +20,7 @@ CDP COMET ECSS-E-TM-10-25 JSON LGPL-3.0-only - [BUMP] To CDP4Common 27.2.2 + [BUMP] To CDP4Common 27.2.3 README.md diff --git a/CDP4MessagePackSerializer/CDP4MessagePackSerializer.csproj b/CDP4MessagePackSerializer/CDP4MessagePackSerializer.csproj index a450f436..889b8d3f 100644 --- a/CDP4MessagePackSerializer/CDP4MessagePackSerializer.csproj +++ b/CDP4MessagePackSerializer/CDP4MessagePackSerializer.csproj @@ -4,7 +4,7 @@ net48;netstandard2.0 Starion Group S.A. CDP4MessagePackSerializer Community Edition - 27.2.2 + 27.2.3 CDP4 MessagePack Serialization Library Copyright © Starion Group S.A. Sam, Alex, Alexander, Nathanael, Antoine, Omar @@ -20,7 +20,7 @@ CDP COMET ECSS-E-TM-10-25 MessagePack LGPL-3.0-only - [Update] MessagePack to version 2.5.172 + [BUMP] To CDP4Common 27.2.3 README.md diff --git a/CDP4Reporting/CDP4Reporting.csproj b/CDP4Reporting/CDP4Reporting.csproj index 84e71f61..81ecec7d 100644 --- a/CDP4Reporting/CDP4Reporting.csproj +++ b/CDP4Reporting/CDP4Reporting.csproj @@ -4,7 +4,7 @@ netstandard2.0 Starion Group S.A. CDP4Reporting Community Edition - 27.2.2 + 27.2.3 CDP4 Reporting Copyright © Starion Group S.A. Sam, Alex, Alexander @@ -20,7 +20,7 @@ CDP COMET ECSS-E-TM-10-25 LGPL-3.0-only - [BUMP] To CDP4Common 27.2.2 + [BUMP] To CDP4Common 27.2.3 latest README.md diff --git a/CDP4RequirementsVerification/CDP4RequirementsVerification.csproj b/CDP4RequirementsVerification/CDP4RequirementsVerification.csproj index 87cb7caf..e00d76fa 100644 --- a/CDP4RequirementsVerification/CDP4RequirementsVerification.csproj +++ b/CDP4RequirementsVerification/CDP4RequirementsVerification.csproj @@ -4,7 +4,7 @@ net48;netstandard2.0 Starion Group S.A. CDP4RequirementsVerification Community Edition - 27.2.2 + 27.2.3 CDP4 Class Library that provides requirement verification Copyright © Starion Group S.A. Sam, Alex, Alexander, Yevhen, Nathanael @@ -20,7 +20,7 @@ CDP COMET ECSS-E-TM-10-25 LGPL-3.0-only - [BUMP] To CDP4Common 27.2.2 + [BUMP] To CDP4Common 27.2.3 README.md diff --git a/CDP4Rules/CDP4Rules.csproj b/CDP4Rules/CDP4Rules.csproj index 56f92547..7d18e027 100644 --- a/CDP4Rules/CDP4Rules.csproj +++ b/CDP4Rules/CDP4Rules.csproj @@ -4,7 +4,7 @@ net48;netstandard2.0 Starion Group S.A. CDP4Rules Community Edition - 27.2.2 + 27.2.3 CDP4 Class Library that provides Model Analysis and Rule Checking Copyright © Starion Group S.A. Sam, Alex, Alexander, Yevhen, Nathanael @@ -20,7 +20,7 @@ CDP COMET ECSS-E-TM-10-25 LGPL-3.0-only - [BUMP] To CDP4Common 27.2.2 + [BUMP] To CDP4Common 27.2.3 README.md diff --git a/CDP4ServicesDal/CDP4ServicesDal.csproj b/CDP4ServicesDal/CDP4ServicesDal.csproj index 7e5cbc6d..18e38343 100644 --- a/CDP4ServicesDal/CDP4ServicesDal.csproj +++ b/CDP4ServicesDal/CDP4ServicesDal.csproj @@ -4,7 +4,7 @@ net48;netstandard2.0 Starion Group S.A. CDP4ServicesDal Community Edition - 27.2.2 + 27.2.3 CDP4ServicesDal Dal Plugin Copyright © Starion Group S.A. Sam, Merlin, Alex, Naron, Alexander, Yevhen, Nathanael @@ -20,7 +20,7 @@ CDP COMET ECSS-E-TM-10-25 LGPL-3.0-only - [BUMP] To CDP4Common 27.2.2 + [BUMP] To CDP4Common 27.2.3 README.md diff --git a/CDP4ServicesMessaging/CDP4ServicesMessaging.csproj b/CDP4ServicesMessaging/CDP4ServicesMessaging.csproj index e890b976..78ea1f3c 100644 --- a/CDP4ServicesMessaging/CDP4ServicesMessaging.csproj +++ b/CDP4ServicesMessaging/CDP4ServicesMessaging.csproj @@ -4,7 +4,7 @@ netstandard2.0 Starion Group S.A. CDP4Common Community Edition - 27.2.2 + 27.2.3 CDP4 Services Messaging is a Class Library that contains clients and messages class that can be used for inter services communication Copyright © Starion Group S.A. Sam, Alex, Alexander, Nathanael, Antoine @@ -20,8 +20,7 @@ CDP COMET ECSS-E-TM-10-25 LGPL-3.0-only - [Update] Polly to version 8.4.1 - [Update] Microsoft.Extensions.Configuration.Binder to version 8.0.2 + [BUMP] To CDP4Common 27.2.3 README.md latest diff --git a/CDP4Web/CDP4Web.csproj b/CDP4Web/CDP4Web.csproj index 476f484a..33bb243d 100644 --- a/CDP4Web/CDP4Web.csproj +++ b/CDP4Web/CDP4Web.csproj @@ -5,7 +5,7 @@ latest Starion Group S.A. CDP4Web Community Edition - 27.2.2 + 27.2.3 CDP4Web Dedicated Sdk for CDPServicesDal Copyright © Starion Group S.A. Sam, Alex, Alexander, Nathanael, Antoine, Omar, Jaime @@ -21,7 +21,7 @@ CDP COMET ECSS-E-TM-10-25 LGPL-3.0-only - [Update] FluentResults to version 3.16.0 + [BUMP] To CDP4Common 27.2.3 README.md diff --git a/CDP4WspDal/CDP4WspDal.csproj b/CDP4WspDal/CDP4WspDal.csproj index ad4cb4e6..85af287a 100644 --- a/CDP4WspDal/CDP4WspDal.csproj +++ b/CDP4WspDal/CDP4WspDal.csproj @@ -4,7 +4,7 @@ net48;netstandard2.0 Starion Group S.A. CDP4WspDal Community Edition - 27.2.2 + 27.2.3 CDP4 WSP Dal Plugin Copyright © Starion Group S.A. Sam, Merlin, Alex, Naron, Alexander, Yevhen, Nathanael @@ -20,7 +20,7 @@ CDP COMET ECSS-E-TM-10-25 LGPL-3.0-only - [BUMP] To CDP4Common 27.2.2 + [BUMP] To CDP4Common 27.2.3 README.md