Fix security issues (#1206)

* . * . * x
2026-01-11 22:30:41 +01:00 · 2024-11-17 17:25:21 +01:00
parent edab3ad7e5
commit f4103b47aa
14 changed files with 37 additions and 26 deletions
--- a/Directory.Build.props
+++ b/Directory.Build.props
@@ -43,11 +43,17 @@
        </When>
    </Choose>

+    <PropertyGroup>
+        <NuGetAudit>true</NuGetAudit>
+        <!--<NuGetAuditLevel>low</NuGetAuditLevel>-->
+        <NuGetAuditMode>all</NuGetAuditMode>
+    </PropertyGroup>
+
    <ItemGroup>
        <!-- CVE-2019-0820 -->
        <PackageReference Include="System.Text.RegularExpressions" Version="4.3.1" />

-        <PackageReference Include="JetBrains.Annotations" Version="2024.2.0" PrivateAssets="All" />
+        <PackageReference Include="JetBrains.Annotations" Version="2024.3.0" PrivateAssets="All" />
        <PackageReference Include="Microsoft.SourceLink.GitHub" Version="8.0.0" PrivateAssets="All" />
    </ItemGroup>

--- a/src/WireMock.Net.Abstractions/WireMock.Net.Abstractions.csproj
+++ b/src/WireMock.Net.Abstractions/WireMock.Net.Abstractions.csproj
@@ -4,7 +4,7 @@
        <Description>Commonly used models, enumerations and types.</Description>
        <AssemblyTitle>WireMock.Net.Abstractions</AssemblyTitle>
        <Authors>Stef Heyenrath</Authors>
-        <TargetFrameworks>net45;net451;net461;netstandard1.0;netstandard1.3;netstandard2.0;netstandard2.1</TargetFrameworks>
+        <TargetFrameworks>net45;net451;net461;netstandard1.3;netstandard2.0;netstandard2.1</TargetFrameworks>
        <GenerateDocumentationFile>true</GenerateDocumentationFile>
        <NoWarn>$(NoWarn);1591;8603</NoWarn>
        <AssemblyName>WireMock.Net.Abstractions</AssemblyName>
@@ -36,15 +36,18 @@

    <ItemGroup>
        <!-- See also https://mstack.nl/blog/20210801-source-generators -->
-        <PackageReference Include="FluentBuilder" Version="0.9.0">
+        <PackageReference Include="FluentBuilder" Version="0.10.0">
            <PrivateAssets>all</PrivateAssets>
            <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
        </PackageReference>

-        <PackageReference Include="PolySharp" Version="1.14.0">
+        <PackageReference Include="PolySharp" Version="1.14.1">
          <PrivateAssets>all</PrivateAssets>
          <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
        </PackageReference>
+
+        <!-- CVE-2018-8292 -->
+        <PackageReference Include="System.Net.Http " Version="4.3.4" />
    </ItemGroup>

    <ItemGroup Condition="$(TargetFramework.StartsWith('netstandard')) and '$(TargetFramework)' != 'netstandard1.0'">
--- a/src/WireMock.Net.Aspire/WireMock.Net.Aspire.csproj
+++ b/src/WireMock.Net.Aspire/WireMock.Net.Aspire.csproj
@@ -35,7 +35,7 @@
    </PropertyGroup>

    <ItemGroup>
-        <PackageReference Include="Aspire.Hosting" Version="8.2.0" />
+        <PackageReference Include="Aspire.Hosting" Version="8.2.2" />
    </ItemGroup>

    <ItemGroup>
--- a/src/WireMock.Net.OpenApiParser/WireMock.Net.OpenApiParser.csproj
+++ b/src/WireMock.Net.OpenApiParser/WireMock.Net.OpenApiParser.csproj
@@ -26,7 +26,7 @@
          <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
        </PackageReference>
        <PackageReference Include="RamlToOpenApiConverter" Version="0.6.1" />
-        <PackageReference Include="RandomDataGenerator.Net" Version="1.0.17" />
+        <PackageReference Include="RandomDataGenerator.Net" Version="1.0.18" />
        <PackageReference Include="Stef.Validation" Version="0.1.1" />
    </ItemGroup>

--- a/src/WireMock.Net.RestClient/WireMock.Net.RestClient.csproj
+++ b/src/WireMock.Net.RestClient/WireMock.Net.RestClient.csproj
@@ -4,7 +4,7 @@
    <Description>A RestClient using RestEase to access the admin interface.</Description>
    <AssemblyTitle>WireMock.Net.RestClient</AssemblyTitle>
    <Authors>Stef Heyenrath</Authors>
-    <TargetFrameworks>net45;netstandard1.1;netstandard2.0;netstandard2.1</TargetFrameworks>
+    <TargetFrameworks>net45;netstandard1.3;netstandard2.0;netstandard2.1</TargetFrameworks>
    <GenerateDocumentationFile>true</GenerateDocumentationFile>
    <AssemblyName>WireMock.Net.RestClient</AssemblyName>
    <PackageId>WireMock.Net.RestClient</PackageId>
@@ -30,8 +30,8 @@
  </PropertyGroup>

  <ItemGroup>
-    <PackageReference Include="JsonConverter.Newtonsoft.Json" Version="0.3.0" />
-    <PackageReference Include="RestEase" Version="1.5.7" />
+    <PackageReference Include="JsonConverter.Newtonsoft.Json" Version="0.7.0" />
+    <PackageReference Include="RestEase" Version="1.6.4" />
    <PackageReference Include="Stef.Validation" Version="0.1.1" />
  </ItemGroup>

--- a/src/WireMock.Net.TUnit/WireMock.Net.TUnit.csproj
+++ b/src/WireMock.Net.TUnit/WireMock.Net.TUnit.csproj
@@ -28,7 +28,7 @@
    <ItemGroup>
        <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
        <PackageReference Include="Stef.Validation" Version="0.1.1" />
-        <PackageReference Include="TUnit.Core" Version="0.1.817" />
+        <PackageReference Include="TUnit.Core" Version="0.2.195" />
    </ItemGroup>

    <ItemGroup>
--- a/src/WireMock.Net.Testcontainers/WireMock.Net.Testcontainers.csproj
+++ b/src/WireMock.Net.Testcontainers/WireMock.Net.Testcontainers.csproj
@@ -28,7 +28,7 @@
          <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
        </PackageReference>
        <PackageReference Include="Stef.Validation" Version="0.1.1" />
-        <PackageReference Include="Testcontainers" Version="3.10.0" />
+        <PackageReference Include="Testcontainers" Version="4.0.0" />
    </ItemGroup>

    <ItemGroup>
--- a/src/WireMock.Net.xUnit/WireMock.Net.xUnit.csproj
+++ b/src/WireMock.Net.xUnit/WireMock.Net.xUnit.csproj
@@ -3,7 +3,7 @@
        <Description>Some extensions for xUnit (ITestOutputHelper)</Description>
        <AssemblyTitle>WireMock.Net.xUnit</AssemblyTitle>
        <Authors>Stef Heyenrath</Authors>
-        <TargetFrameworks>net45;net451;netstandard1.0;netstandard2.0;netstandard2.1</TargetFrameworks>
+        <TargetFrameworks>net45;net451;netstandard1.3;netstandard2.0;netstandard2.1</TargetFrameworks>
        <GenerateDocumentationFile>true</GenerateDocumentationFile>
        <AssemblyName>WireMock.Net.xUnit</AssemblyName>
        <RootNamespace>WireMock.Net.Xunit</RootNamespace>
--- a/src/WireMock.Net/WireMock.Net.csproj
+++ b/src/WireMock.Net/WireMock.Net.csproj
@@ -59,13 +59,13 @@
    </PropertyGroup>

    <ItemGroup>
-        <PackageReference Include="JsonConverter.Abstractions" Version="0.5.0" />
+        <PackageReference Include="JsonConverter.Abstractions" Version="0.7.0" />
        <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
        <PackageReference Include="NJsonSchema.Extensions" Version="0.1.0" />
        <PackageReference Include="NSwag.Core" Version="13.16.1" />
        <PackageReference Include="SimMetrics.Net" Version="1.0.5" />
-        <PackageReference Include="JmesPath.Net" Version="1.0.125" />
-        <PackageReference Include="AnyOf" Version="0.3.0" />
+        <PackageReference Include="JmesPath.Net" Version="1.0.330" />
+        <PackageReference Include="AnyOf" Version="0.4.0" />
        <PackageReference Include="TinyMapper" Version="3.0.3" />
    </ItemGroup>

@@ -108,9 +108,6 @@
            <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
        </PackageReference>

-        <!-- https://github.com/WireMock-Net/WireMock.Net/issues/697 -->
-        <PackageReference Include="System.Text.Encodings.Web" Version="4.7.2" />
-
        <!-- https://github.com/WireMock-Net/WireMock.Net/issues/507 -->
        <PackageReference Include="Microsoft.AspNetCore.Server.IIS" Version="2.2.6" />
    </ItemGroup>
@@ -192,6 +189,11 @@
        <PackageReference Include="Handlebars.Net.Helpers.Xslt" Version="2.4.6" />
    </ItemGroup>

+    <ItemGroup>
+        <!-- CVE-2021-26701 and https://github.com/WireMock-Net/WireMock.Net/issues/697 -->
+        <PackageReference Include="System.Text.Encodings.Web" Version="4.7.2" />
+    </ItemGroup>
+
    <ItemGroup>
        <ProjectReference Include="..\WireMock.Net.Abstractions\WireMock.Net.Abstractions.csproj" />
        <ProjectReference Include="..\WireMock.Org.Abstractions\WireMock.Org.Abstractions.csproj" />
--- a/src/WireMock.Org.RestClient/WireMock.Org.RestClient.csproj
+++ b/src/WireMock.Org.RestClient/WireMock.Org.RestClient.csproj
@@ -30,8 +30,8 @@
    </PropertyGroup>

    <ItemGroup>
-        <PackageReference Include="AnyOf" Version="0.3.0" />
-        <PackageReference Include="RestEase" Version="1.5.7" />
+        <PackageReference Include="AnyOf" Version="0.4.0" />
+        <PackageReference Include="RestEase" Version="1.6.4" />
    </ItemGroup>

    <ItemGroup>
--- a/test/WireMock.Net.Aspire.TestAppHost/WireMock.Net.Aspire.TestAppHost.csproj
+++ b/test/WireMock.Net.Aspire.TestAppHost/WireMock.Net.Aspire.TestAppHost.csproj
@@ -18,7 +18,7 @@
    </ItemGroup>

    <ItemGroup>
-        <PackageReference Include="Aspire.Hosting.AppHost" Version="8.2.0" />
+        <PackageReference Include="Aspire.Hosting.AppHost" Version="8.2.2" />
    </ItemGroup>

    <ItemGroup>
--- a/test/WireMock.Net.Aspire.Tests/WireMock.Net.Aspire.Tests.csproj
+++ b/test/WireMock.Net.Aspire.Tests/WireMock.Net.Aspire.Tests.csproj
@@ -13,7 +13,7 @@
    </PropertyGroup>

    <ItemGroup>
-        <PackageReference Include="Aspire.Hosting.Testing" Version="8.2.0" />
+        <PackageReference Include="Aspire.Hosting.Testing" Version="8.2.2" />
        <PackageReference Include="Codecov" Version="1.13.0" />
        <PackageReference Include="coverlet.msbuild" Version="6.0.2">
            <PrivateAssets>all</PrivateAssets>
--- a/test/WireMock.Net.TUnitTests/WireMock.Net.TUnitTests.csproj
+++ b/test/WireMock.Net.TUnitTests/WireMock.Net.TUnitTests.csproj
@@ -9,7 +9,7 @@
    </PropertyGroup>

    <ItemGroup>
-        <PackageReference Include="TUnit" Version="0.1.817" />
+        <PackageReference Include="TUnit" Version="0.2.195" />
    </ItemGroup>

    <ItemGroup>
--- a/test/WireMock.Net.Tests/WireMock.Net.Tests.csproj
+++ b/test/WireMock.Net.Tests/WireMock.Net.Tests.csproj
@@ -72,10 +72,10 @@
        </PackageReference>
        <PackageReference Include="Moq" Version="4.17.2" />
        <PackageReference Include="System.Threading" Version="4.3.0" />
-        <PackageReference Include="RestEase" Version="1.5.7" />
+        <PackageReference Include="RestEase" Version="1.6.4" />
        <PackageReference Include="NFluent" Version="2.8.0" />
        <PackageReference Include="SimMetrics.Net" Version="1.0.5" />
-        <PackageReference Include="AnyOf" Version="0.3.0" />
+        <PackageReference Include="AnyOf" Version="0.4.0" />
        <PackageReference Include="Microsoft.AspNet.WebApi.Client" Version="5.2.9" />
    </ItemGroup>

@@ -104,7 +104,7 @@

    <ItemGroup Condition="'$(TargetFramework)' != 'net452'">
        <PackageReference Include="System.Net.Http.Json" Version="3.2.1" />
-        <PackageReference Include="JsonConverter.System.Text.Json" Version="0.5.0" />
+        <PackageReference Include="JsonConverter.System.Text.Json" Version="0.7.0" />

        <PackageReference Include="Google.Protobuf" Version="3.25.1" />
        <PackageReference Include="Grpc.Net.Client" Version="2.60.0" />