Skip to content

v0.8.1-beta — Security patch (GHSA-g94r-2vxg-569j)

Pre-release
Pre-release

Choose a tag to compare

View all tags
@joslat joslat released this 29 Apr 00:28
· 226 commits to main since this release
v0.8.1-beta
c2def02

Security patch

What was broken

v0.8.0-beta claimed to patch GHSA-g94r-2vxg-569j (OpenTelemetry.Api moderate CVE)
via a PackageVersion pin in Directory.Packages.props. That pin was silently
ineffective: Central Package Management only overrides direct references by default,
and nothing in this repo references OpenTelemetry.Api directly. The transitive
copy pulled in by MAF resolved to 1.13.1 at build time.

What was fixed

  • Enabled CentralPackageTransitivePinningEnabled=true — forces CPM to apply
    PackageVersion entries to transitive dependencies, so OpenTelemetry.Api 1.15.3
    is now actually enforced across all projects and TFMs.
  • Bumped Microsoft.Extensions.DependencyInjection and
    Microsoft.Extensions.Hosting.Abstractions 9.0.0 → 10.0.3 to resolve the
    resulting NU1109 downgrade conflict (Azure.Identity 1.18.0 requires ≥ 10.0.3).

Verification

dotnet list package --vulnerable --include-transitive now reports zero vulnerable
packages across all 12 projects (net8.0 / net9.0 / net10.0).

Consumers who pinned AgentEval 0.8.0-beta should upgrade to 0.8.1-beta.

Assets 2
Loading