Skip to content

Commit 33358b7

Browse files
NickCravermgravell
NickCraver
and
mgravell
authored
Packages: update to remove CVE dependencies (#2820)
* Packages: update to remove CVE dependencies This bumps *testing* (not the core package) to net8.0 for an easier time maintaining and updates packages outside StackExchange.Redis except for `Microsoft.Bcl.AsyncInterfaces`. `Microsoft.Bcl.AsyncInterfaces` was bumped from 5.0.0 to 6.0.0 due to deprecation warnings, still maintaining widest compatibility we can. * Fix .NET Framework test diff * fix enum flags rendering; involves adding a net8.0 TFM, but that's LTS *anyway*, so: fine also added appropriate [Obsolete] to respect transient net8.0 changes --------- Co-authored-by: Marc Gravell <marc.gravell@gmail.com>
1 parent 11ef77d commit 33358b7

File tree

18 files changed

+149
-59
lines changed

18 files changed

+149
-59
lines changed

‎Directory.Packages.props

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,32 @@
11
<Project>
22
<ItemGroup>
33
<!-- Packages we depend on for StackExchange.Redis, upgrades can create binding redirect pain! -->
4-
<PackageVersion Include="Microsoft.Bcl.AsyncInterfaces" Version="5.0.0" />
4+
<PackageVersion Include="Microsoft.Bcl.AsyncInterfaces" Version="6.0.0" />
5+
<PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="6.0.0" />
56
<PackageVersion Include="Pipelines.Sockets.Unofficial" Version="2.2.8" />
67
<PackageVersion Include="System.Diagnostics.PerformanceCounter" Version="5.0.0" />
78
<PackageVersion Include="System.Threading.Channels" Version="5.0.0" />
89
<PackageVersion Include="System.Runtime.InteropServices.RuntimeInformation" Version="4.3.0" />
910
<PackageVersion Include="System.IO.Compression" Version="4.3.0" />
1011

1112
<!-- Packages only used in the solution, upgrade at will -->
12-
<PackageVersion Include="BenchmarkDotNet" Version="0.13.1" />
13+
<PackageVersion Include="BenchmarkDotNet" Version="0.14.0" />
1314
<PackageVersion Include="GitHubActionsTestLogger" Version="2.4.1" />
1415
<PackageVersion Include="Microsoft.CodeAnalysis.PublicApiAnalyzers" Version="3.3.4" />
15-
<PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="6.0.0" />
16-
<PackageVersion Include="Microsoft.NETFramework.ReferenceAssemblies" Version="1.0.2" />
17-
<PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.10.0" />
16+
<PackageVersion Include="Microsoft.NETFramework.ReferenceAssemblies" Version="1.0.3" />
17+
<PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.12.0" />
1818
<PackageVersion Include="Microsoft.SourceLink.GitHub" Version="8.0.0" />
19-
<PackageVersion Include="Nerdbank.GitVersioning" Version="3.6.141" />
19+
<PackageVersion Include="Nerdbank.GitVersioning" Version="3.6.146" />
2020
<PackageVersion Include="Newtonsoft.Json" Version="13.0.3" />
21-
<PackageVersion Include="NSubstitute" Version="5.1.0" />
21+
<PackageVersion Include="NSubstitute" Version="5.3.0" />
2222
<PackageVersion Include="StackExchange.Redis" Version="2.6.96" />
2323
<PackageVersion Include="StyleCop.Analyzers" Version="1.2.0-beta.556" />
24+
<PackageVersion Include="System.Collections.Immutable" Version="9.0.0" />
25+
<PackageVersion Include="System.Reflection.Metadata" Version="9.0.0" />
2426
<!-- For binding redirect testing, main package gets this transitively -->
25-
<PackageVersion Include="System.IO.Pipelines" Version="5.0.1" />
26-
<PackageVersion Include="System.Runtime.Caching" Version="5.0.0" />
27-
<PackageVersion Include="xunit" Version="2.9.0" />
27+
<PackageVersion Include="System.IO.Pipelines" Version="9.0.0" />
28+
<PackageVersion Include="System.Runtime.Caching" Version="9.0.0" />
29+
<PackageVersion Include="xunit" Version="2.9.2" />
2830
<PackageVersion Include="xunit.runner.visualstudio" Version="2.8.2" />
2931
</ItemGroup>
3032
</Project>

‎src/StackExchange.Redis/ConfigurationOptions.cs

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -357,13 +357,17 @@ private static bool CheckTrustedIssuer(X509Certificate2 certificateToValidate, X
357357
byte[] authorityData = authority.RawData;
358358
foreach (var chainElement in chain.ChainElements)
359359
{
360-
#if NET8_0_OR_GREATER
361-
#error TODO: use RawDataMemory (needs testing)
362-
#endif
363360
using var chainCert = chainElement.Certificate;
364-
if (!found && chainCert.RawData.SequenceEqual(authorityData))
361+
if (!found)
365362
{
366-
found = true;
363+
#if NET8_0_OR_GREATER
364+
if (chainCert.RawDataMemory.Span.SequenceEqual(authorityData))
365+
#else
366+
if (chainCert.RawData.SequenceEqual(authorityData))
367+
#endif
368+
{
369+
found = true;
370+
}
367371
}
368372
}
369373
return found;

‎src/StackExchange.Redis/Enums/CommandFlags.cs

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,36 +34,59 @@ public enum CommandFlags
3434
/// </summary>
3535
PreferMaster = 0,
3636

37+
#if NET8_0_OR_GREATER
38+
/// <summary>
39+
/// This operation should be performed on the replica if it is available, but will be performed on
40+
/// a primary if no replicas are available. Suitable for read operations only.
41+
/// </summary>
42+
[Obsolete("Starting with Redis version 5, Redis has moved to 'replica' terminology. Please use " + nameof(PreferReplica) + " instead, this will be removed in 3.0.")]
43+
[Browsable(false), EditorBrowsable(EditorBrowsableState.Never)]
44+
PreferSlave = 8,
45+
#endif
46+
3747
/// <summary>
3848
/// This operation should only be performed on the primary.
3949
/// </summary>
4050
DemandMaster = 4,
4151

52+
#if !NET8_0_OR_GREATER
4253
/// <summary>
4354
/// This operation should be performed on the replica if it is available, but will be performed on
4455
/// a primary if no replicas are available. Suitable for read operations only.
4556
/// </summary>
4657
[Obsolete("Starting with Redis version 5, Redis has moved to 'replica' terminology. Please use " + nameof(PreferReplica) + " instead, this will be removed in 3.0.")]
4758
[Browsable(false), EditorBrowsable(EditorBrowsableState.Never)]
4859
PreferSlave = 8,
60+
#endif
4961

5062
/// <summary>
5163
/// This operation should be performed on the replica if it is available, but will be performed on
5264
/// a primary if no replicas are available. Suitable for read operations only.
5365
/// </summary>
5466
PreferReplica = 8, // note: we're using a 2-bit set here, which [Flags] formatting hates; position is doing the best we can for reasonable outcomes here
5567

68+
#if NET8_0_OR_GREATER
69+
/// <summary>
70+
/// This operation should only be performed on a replica. Suitable for read operations only.
71+
/// </summary>
72+
[Obsolete("Starting with Redis version 5, Redis has moved to 'replica' terminology. Please use " + nameof(DemandReplica) + " instead, this will be removed in 3.0.")]
73+
[Browsable(false), EditorBrowsable(EditorBrowsableState.Never)]
74+
DemandSlave = 12,
75+
#endif
76+
5677
/// <summary>
5778
/// This operation should only be performed on a replica. Suitable for read operations only.
5879
/// </summary>
5980
DemandReplica = 12, // note: we're using a 2-bit set here, which [Flags] formatting hates; position is doing the best we can for reasonable outcomes here
6081

82+
#if !NET8_0_OR_GREATER
6183
/// <summary>
6284
/// This operation should only be performed on a replica. Suitable for read operations only.
6385
/// </summary>
6486
[Obsolete("Starting with Redis version 5, Redis has moved to 'replica' terminology. Please use " + nameof(DemandReplica) + " instead, this will be removed in 3.0.")]
6587
[Browsable(false), EditorBrowsable(EditorBrowsableState.Never)]
6688
DemandSlave = 12,
89+
#endif
6790

6891
// 16: reserved for additional "demand/prefer" options
6992

‎src/StackExchange.Redis/Exceptions.cs

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
using System;
2+
using System.ComponentModel;
23
using System.Runtime.Serialization;
34

45
namespace StackExchange.Redis
@@ -22,6 +23,10 @@ public RedisCommandException(string message) : base(message) { }
2223
/// <param name="innerException">The inner exception.</param>
2324
public RedisCommandException(string message, Exception innerException) : base(message, innerException) { }
2425

26+
#if NET8_0_OR_GREATER
27+
[Obsolete(Obsoletions.LegacyFormatterImplMessage, DiagnosticId = Obsoletions.LegacyFormatterImplDiagId)]
28+
[EditorBrowsable(EditorBrowsableState.Never)]
29+
#endif
2530
private RedisCommandException(SerializationInfo info, StreamingContext ctx) : base(info, ctx) { }
2631
}
2732

@@ -46,6 +51,10 @@ public RedisTimeoutException(string message, CommandStatus commandStatus) : base
4651
/// </summary>
4752
public CommandStatus Commandstatus { get; }
4853

54+
#if NET8_0_OR_GREATER
55+
[Obsolete(Obsoletions.LegacyFormatterImplMessage, DiagnosticId = Obsoletions.LegacyFormatterImplDiagId)]
56+
[EditorBrowsable(EditorBrowsableState.Never)]
57+
#endif
4958
private RedisTimeoutException(SerializationInfo info, StreamingContext ctx) : base(info, ctx)
5059
{
5160
Commandstatus = info.GetValue("commandStatus", typeof(CommandStatus)) as CommandStatus? ?? CommandStatus.Unknown;
@@ -56,6 +65,10 @@ private RedisTimeoutException(SerializationInfo info, StreamingContext ctx) : ba
5665
/// </summary>
5766
/// <param name="info">Serialization info.</param>
5867
/// <param name="context">Serialization context.</param>
68+
#if NET8_0_OR_GREATER
69+
[Obsolete(Obsoletions.LegacyFormatterImplMessage, DiagnosticId = Obsoletions.LegacyFormatterImplDiagId)]
70+
[EditorBrowsable(EditorBrowsableState.Never)]
71+
#endif
5972
public override void GetObjectData(SerializationInfo info, StreamingContext context)
6073
{
6174
base.GetObjectData(info, context);
@@ -107,6 +120,10 @@ public RedisConnectionException(ConnectionFailureType failureType, string messag
107120
/// </summary>
108121
public CommandStatus CommandStatus { get; }
109122

123+
#if NET8_0_OR_GREATER
124+
[Obsolete(Obsoletions.LegacyFormatterImplMessage, DiagnosticId = Obsoletions.LegacyFormatterImplDiagId)]
125+
[EditorBrowsable(EditorBrowsableState.Never)]
126+
#endif
110127
private RedisConnectionException(SerializationInfo info, StreamingContext ctx) : base(info, ctx)
111128
{
112129
FailureType = (ConnectionFailureType)info.GetInt32("failureType");
@@ -118,6 +135,10 @@ private RedisConnectionException(SerializationInfo info, StreamingContext ctx) :
118135
/// </summary>
119136
/// <param name="info">Serialization info.</param>
120137
/// <param name="context">Serialization context.</param>
138+
#if NET8_0_OR_GREATER
139+
[Obsolete(Obsoletions.LegacyFormatterImplMessage, DiagnosticId = Obsoletions.LegacyFormatterImplDiagId)]
140+
[EditorBrowsable(EditorBrowsableState.Never)]
141+
#endif
121142
public override void GetObjectData(SerializationInfo info, StreamingContext context)
122143
{
123144
base.GetObjectData(info, context);
@@ -150,6 +171,10 @@ public RedisException(string message, Exception? innerException) : base(message,
150171
/// </summary>
151172
/// <param name="info">Serialization info.</param>
152173
/// <param name="ctx">Serialization context.</param>
174+
#if NET8_0_OR_GREATER
175+
[Obsolete(Obsoletions.LegacyFormatterImplMessage, DiagnosticId = Obsoletions.LegacyFormatterImplDiagId)]
176+
[EditorBrowsable(EditorBrowsableState.Never)]
177+
#endif
153178
protected RedisException(SerializationInfo info, StreamingContext ctx) : base(info, ctx) { }
154179
}
155180

@@ -165,6 +190,10 @@ public sealed partial class RedisServerException : RedisException
165190
/// <param name="message">The message for the exception.</param>
166191
public RedisServerException(string message) : base(message) { }
167192

193+
#if NET8_0_OR_GREATER
194+
[Obsolete(Obsoletions.LegacyFormatterImplMessage, DiagnosticId = Obsoletions.LegacyFormatterImplDiagId)]
195+
[EditorBrowsable(EditorBrowsableState.Never)]
196+
#endif
168197
private RedisServerException(SerializationInfo info, StreamingContext ctx) : base(info, ctx) { }
169198
}
170199
}

‎src/StackExchange.Redis/Obsoletions.cs

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
namespace StackExchange.Redis;
2+
3+
internal static class Obsoletions
4+
{
5+
public const string LegacyFormatterImplMessage = "This API supports obsolete formatter-based serialization. It should not be called or extended by application code.";
6+
public const string LegacyFormatterImplDiagId = "SYSLIB0051";
7+
}

‎src/StackExchange.Redis/PublicAPI/net8.0/PublicAPI.Shipped.txt

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
StackExchange.Redis.ConfigurationOptions.SslClientAuthenticationOptions.get -> System.Func<string!, System.Net.Security.SslClientAuthenticationOptions!>?
2+
StackExchange.Redis.ConfigurationOptions.SslClientAuthenticationOptions.set -> void
3+
System.Runtime.CompilerServices.IsExternalInit (forwarded, contained in System.Runtime)

‎src/StackExchange.Redis/StackExchange.Redis.csproj

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
<PropertyGroup>
33
<Nullable>enable</Nullable>
44
<!-- extend the default lib targets for the main lib; mostly because of "vectors" -->
5-
<TargetFrameworks>net461;netstandard2.0;net472;netcoreapp3.1;net6.0</TargetFrameworks>
5+
<TargetFrameworks>net461;netstandard2.0;net472;netcoreapp3.1;net6.0;net8.0</TargetFrameworks>
66
<Description>High performance Redis client, incorporating both synchronous and asynchronous usage.</Description>
77
<AssemblyName>StackExchange.Redis</AssemblyName>
88
<AssemblyTitle>StackExchange.Redis</AssemblyTitle>

‎tests/BasicTest/BasicTest.csproj

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
<PropertyGroup>
44
<Description>StackExchange.Redis.BasicTest .NET Core</Description>
5-
<TargetFrameworks>net472;net6.0</TargetFrameworks>
5+
<TargetFrameworks>net472;net8.0</TargetFrameworks>
66
<AssemblyName>BasicTest</AssemblyName>
77
<OutputType>Exe</OutputType>
88
<PackageId>BasicTest</PackageId>
@@ -11,6 +11,9 @@
1111

1212
<ItemGroup>
1313
<PackageReference Include="BenchmarkDotNet" />
14+
<PackageReference Include="System.Collections.Immutable" />
15+
<PackageReference Include="System.Reflection.Metadata" />
16+
1417
<ProjectReference Include="..\..\src\StackExchange.Redis\StackExchange.Redis.csproj" />
1518
</ItemGroup>
1619

‎tests/BasicTestBaseline/BasicTestBaseline.csproj

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
<PropertyGroup>
44
<Description>StackExchange.Redis.BasicTest .NET Core</Description>
5-
<TargetFrameworks>net472;net6.0</TargetFrameworks>
5+
<TargetFrameworks>net472;net8.0</TargetFrameworks>
66
<AssemblyName>BasicTestBaseline</AssemblyName>
77
<OutputType>Exe</OutputType>
88
<PackageId>BasicTestBaseline</PackageId>
@@ -17,6 +17,8 @@
1717
<ItemGroup>
1818
<PackageReference Include="BenchmarkDotNet" />
1919
<PackageReference Include="StackExchange.Redis" />
20+
<PackageReference Include="System.Collections.Immutable" />
21+
<PackageReference Include="System.Reflection.Metadata" />
2022
</ItemGroup>
2123

2224
</Project>

‎tests/ConsoleTest/ConsoleTest.csproj

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<Project Sdk="Microsoft.NET.Sdk">
22

33
<PropertyGroup>
4-
<TargetFramework>net6.0</TargetFramework>
4+
<TargetFramework>net8.0</TargetFramework>
55
<OutputType>Exe</OutputType>
66
<ImplicitUsings>enable</ImplicitUsings>
77
<Nullable>enable</Nullable>

0 commit comments

Comments
 (0)