Upgrade System.Net.Http from 4.1.0 to 4.3.4 to fix the vulnerability (C…

…VE-2022-34716) (#592)
aspnet · Sep 19, 2023 · 6230eb1 · 6230eb1
1 parent 62c0ad8
commit 6230eb1
Show file tree

Hide file tree

Showing 3 changed files with 16 additions and 0 deletions.
diff --git a/Directory.Build.props b/Directory.Build.props
@@ -28,4 +28,10 @@
     -->
     <NoWarn>$(NoWarn);NETSDK1138</NoWarn>
   </PropertyGroup>
+
+  <!-- Bump NETStandard.Library to a version that doesn't transitively reference a System.Net.Http that causes CG alerts -->
+  <ItemGroup Condition="'$(IsUnitTestProject)' == 'true'">
+    <PackageReference Include="NETStandard.Library" Version="2.0.3" />
+  </ItemGroup>
+
 </Project>
diff --git a/src/AspNetCoreWebAPI/src/System.Web.Http.AspNetCore/System.Web.Http.AspNetCore.csproj b/src/AspNetCoreWebAPI/src/System.Web.Http.AspNetCore/System.Web.Http.AspNetCore.csproj
@@ -11,4 +11,9 @@
     <FrameworkReference Include="Microsoft.AspNetCore.App" />
   </ItemGroup>
 
+  <ItemGroup>
+    <!-- Bump NETStandard.Library to a version that doesn't transitively reference a System.Net.Http that causes CG alerts -->
+    <PackageReference Include="NETStandard.Library" Version="2.0.3" />
+  </ItemGroup>
+
 </Project>
diff --git a/...e.Grpc.HttpApi.IntegrationTests/Microsoft.AspNetCore.Grpc.HttpApi.IntegrationTests.csproj b/...e.Grpc.HttpApi.IntegrationTests/Microsoft.AspNetCore.Grpc.HttpApi.IntegrationTests.csproj
@@ -26,4 +26,9 @@
     </PackageReference>
   </ItemGroup>
 
+  <ItemGroup>
+    <!-- Bump NETStandard.Library to a version that doesn't transitively reference a System.Net.Http that causes CG alerts -->
+    <PackageReference Include="NETStandard.Library" Version="2.0.3" />
+  </ItemGroup>
+
 </Project>