Update Microsoft.AspNetCore.OData to 9.5.0 - #14224
Conversation
GitHub Actions
Error
There was a problem hiding this comment.
Pull request overview
Pins Microsoft.AspNetCore.OData to a specific version via central package management to ensure the repo consumes the patched package version (overriding the transitive dependency coming from OData2Linq 2.2.0) for the .NET structured data / EF plugin area.
Changes:
- Add a central package version pin for
Microsoft.AspNetCore.ODatato9.5.0indotnet/Directory.Packages.props.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Automated Code Review
Reviewers: 4 | Confidence: 83%
✓ Correctness
This PR adds a pined version of Microsoft.AspNetCore.OData 9.5.0 to Directory.Packages.props to override a transitive dependency from OData2Linq 2.2.0 and pick up a security fix. The change is minimal, correctly placed in central package management, and the transitive dependency path via OData2Linq (line 96) is confirmed in the same file. No correctness issues found.
✓ Security Reliability
The PR adds a
PackageVersionentry forMicrosoft.AspNetCore.ODatato override a transitive dependency fromOData2Linqfor a security fix. However,CentralPackageTransitivePinningEnabledis not set totrueanywhere in the repository. Without this property, NuGet's central package management will not pin transitive dependencies — thePackageVersionentry only controls directPackageReferenceitems. Since no project has a direct reference toMicrosoft.AspNetCore.OData(it is purely transitive viaOData2Linq), this change will have no effect on the resolved package version, and the intended security fix will not be applied.
✓ Test Coverage
This PR pins Microsoft.AspNetCore.OData to version 9.5.0 in Directory.Packages.props to address a security fix. The change is a pure dependency version override for a transitive dependency brought in by OData2Linq in the Entity Framework structured data plugin. No new behavioral code is introduced, so no new tests are needed. Existing tests for the Plugins.StructuredData.EntityFramework project would catch any regression from the version bump.
✓ Failure Modes
This PR adds a central package version pin for Microsoft.AspNetCore.OData 9.5.0 in Directory.Packages.props to pick up a security fix. The package is a transitive dependency of OData2Linq 2.2.0 (confirmed at line 96 of the same file), used by the Entity Framework structured data plugin. The change is purely a version override with no code modifications, introducing no new failure modes.
Automated review by SergeyMenshykh's agents
9dc145c to
9d26c6e
Compare
GitHub Actions
Error
9d26c6e to
21f8006
Compare
GitHub Actions
Failure
Pin Microsoft.AspNetCore.OData to version 9.5.0 to address a security fix in the package. This overrides the transitive dependency brought in by OData2Linq 2.2.0. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a8efdd59-6d18-4194-8561-1d4144f87333
21f8006 to
ec8ee7a
Compare
GitHub Actions
Inactive
github-project-automation
Bot
moved this from Sprint: In Review
to Sprint: Done
in Semantic Kernel
Pin
Microsoft.AspNetCore.ODatato version 9.5.0 inDirectory.Packages.props. This overrides the transitive dependency brought in byOData2Linq 2.2.0used in the Entity Framework structured data plugin.