Skip to content

Fix CG alert around Microsoft.IO.Redist #175

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Aug 6, 2024
Merged

Fix CG alert around Microsoft.IO.Redist #175

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7dd39c6
Fix CG alert around Microsoft.IO.Redist
joperezr Aug 6, 2024
43b56da
Update src/SourceBrowser/src/Directory.Packages.props
joperezr Aug 6, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions src/SourceBrowser/src/Directory.Packages.props
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,9 @@
<PackageVersion Include="Microsoft.Build.Utilities.Core" Version="17.5.0" />
<PackageVersion Include="Microsoft.Build" Version="17.5.0" />

<!-- component governance -->
Copy link
Member

@ericstj ericstj Aug 6, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure it's helpful to say component governance here. We need this because it's a transitive dependency of MSBuild.

Copy link
Member Author

@joperezr joperezr Aug 6, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh, sorry, had auto-merge set so it merged after your approval but I can fix this in a follow up. The thinking here is that this isn't a direct dependency, so I wanted to add a section for Versions that are only there due to lifting transitive dependencies for CG. We do that in Aspire too. This way, we know we can safely remove those once we update direct dependencies that have bumped the transitive version.

<PackageVersion Include="Microsoft.IO.Redist" Version="6.0.1" />

<!-- roslyn -->
<PackageVersion Include="Microsoft.CodeAnalysis" Version="4.2.0" />
<PackageVersion Include="Microsoft.CodeAnalysis.Common" Version="4.2.0" />
Expand Down