From afe6344914a11558a9a662b4bbf2da1679fc5341 Mon Sep 17 00:00:00 2001
From: Viktor Hofer <viktor.hofer@microsoft.com>
Date: Wed, 21 Aug 2024 20:10:51 +0200
Subject: [PATCH 1/7] Enable NuGet Audit

---
 NuGet.config | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/NuGet.config b/NuGet.config
index 792ee1f6c03..2413842ee3f 100644
--- a/NuGet.config
+++ b/NuGet.config
@@ -14,6 +14,10 @@
     <add key="dotnet9" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet9/nuget/v3/index.json" />
     <add key="dotnet9-transport" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet9-transport/nuget/v3/index.json" />
   </packageSources>
+  <auditSources>
+    <clear />
+    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
+  </auditSources>
   <disabledPackageSources>
     <clear />
   </disabledPackageSources>

From 4fe8a46af3d5b364d32826e7558dd634833607cb Mon Sep 17 00:00:00 2001
From: Viktor Hofer <viktor.hofer@microsoft.com>
Date: Wed, 21 Aug 2024 18:35:17 +0000
Subject: [PATCH 2/7] Resolve Microsoft.IO.Redist/6.0.0 vulnerability

---
 Directory.Packages.props | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index 376184daed8..6969424cce0 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -38,6 +38,7 @@
     <PackageVersion Include="Microsoft.Build.Tasks.Core" Version="$(MicrosoftBuildTasksCoreVersion)" />
     <PackageVersion Include="Microsoft.Build.Utilities.Core" Version="$(MicrosoftBuildUtilitiesCoreVersion)" />
     <PackageVersion Include="Microsoft.Build" Version="$(MicrosoftBuildVersion)" />
+    <PackageVersion Include="Microsoft.IO.Redist" Version="6.0.1" /> <!-- Pin transitive dependency to avoid vulnerable 6.0.0 version. -->
     <!-- nuget -->
     <PackageVersion Include="NuGet.Commands" Version="$(NuGetCommandsVersion)" />
     <PackageVersion Include="NuGet.Frameworks" Version="$(NuGetFrameworksVersion)" />
@@ -83,7 +84,6 @@
     <PackageVersion Include="Microsoft.DataServices.Client" Version="$(MicrosoftDataServicesClientVersion)" />
     <PackageVersion Include="Microsoft.Diagnostics.Runtime" Version="1.0.5" />
     <PackageVersion Include="Microsoft.Identity.Client" Version="4.61.3" />
-    <PackageVersion Include="Microsoft.IO.Redist" Version="6.0.1" />
     <PackageVersion Include="Microsoft.OpenApi" Version="1.3.2" />
     <PackageVersion Include="Microsoft.OpenApi.Readers" Version="1.3.2" />
     <PackageVersion Include="Microsoft.Signed.Wix" Version="$(MicrosoftSignedWixVersion)" />

From bc6b8061237b6f56d9f27462d7f2fae8b3114134 Mon Sep 17 00:00:00 2001
From: Viktor Hofer <viktor.hofer@microsoft.com>
Date: Wed, 21 Aug 2024 18:51:27 +0000
Subject: [PATCH 3/7] Suppress STJ/8.0.0 advisory

---
 eng/BuildTask.Packages.props | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/eng/BuildTask.Packages.props b/eng/BuildTask.Packages.props
index 51e8b5641db..f89ecbb0be5 100644
--- a/eng/BuildTask.Packages.props
+++ b/eng/BuildTask.Packages.props
@@ -18,4 +18,9 @@
     <PackageVersion Update="Microsoft.Extensions.Logging.Console" Version="8.0.0" />
   </ItemGroup>
 
+  <!-- Suppress System.Text.Json/8.0.0 advisory as desktop msbuild doesn't yet provide binding redirects for the non-vulnerable version (8.0.4). -->
+  <ItemGroup>
+    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-hh2w-p6rv-4g7w" />
+  </ItemGroup>
+
 </Project>

From d360778e0277da887bfc21b712112b4519553440 Mon Sep 17 00:00:00 2001
From: Viktor Hofer <viktor.hofer@microsoft.com>
Date: Mon, 26 Aug 2024 11:49:02 +0200
Subject: [PATCH 4/7] Update BuildTask.Packages.props

---
 eng/BuildTask.Packages.props | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/eng/BuildTask.Packages.props b/eng/BuildTask.Packages.props
index f89ecbb0be5..ab2bfbb2a0d 100644
--- a/eng/BuildTask.Packages.props
+++ b/eng/BuildTask.Packages.props
@@ -8,13 +8,13 @@
     <PackageVersion Update="System.Reflection.MetadataLoadContext" Version="8.0.0" />
     <PackageVersion Update="System.Resources.Extensions" Version="8.0.0" />
     <PackageVersion Update="System.Text.Encodings.Web" Version="8.0.0" />
-    <PackageVersion Update="System.Text.Json" Version="8.0.0" />
+    <PackageVersion Update="System.Text.Json" Version="8.0.3" />
     <PackageVersion Update="System.Threading.Tasks.Dataflow" Version="8.0.0" />
 
     <!-- Packages that transitively bring above dependencies in. -->
-    <PackageVersion Update="Microsoft.Extensions.DependencyInjection.Abstractions" Version="8.0.0" />
+    <PackageVersion Update="Microsoft.Extensions.DependencyInjection.Abstractions" Version="8.0.1" />
     <PackageVersion Update="Microsoft.Extensions.DependencyInjection" Version="8.0.0" />
-    <PackageVersion Update="Microsoft.Extensions.DependencyModel" Version="8.0.0" />
+    <PackageVersion Update="Microsoft.Extensions.DependencyModel" Version="8.0.1" />
     <PackageVersion Update="Microsoft.Extensions.Logging.Console" Version="8.0.0" />
   </ItemGroup>
 

From f237b7114e190b8ef67471256a2b02ad3adbf381 Mon Sep 17 00:00:00 2001
From: Viktor Hofer <viktor.hofer@microsoft.com>
Date: Mon, 26 Aug 2024 17:03:11 +0200
Subject: [PATCH 5/7] Update Directory.Build.props

---
 Directory.Build.props | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/Directory.Build.props b/Directory.Build.props
index 6eb38c54d7a..f4f730a4c23 100644
--- a/Directory.Build.props
+++ b/Directory.Build.props
@@ -14,6 +14,8 @@
     <EnableNETAnalyzers>true</EnableNETAnalyzers>
     <EnforceCodeStyleInBuild>true</EnforceCodeStyleInBuild>
     <RepositoryUrl>https://github.com/dotnet/arcade</RepositoryUrl>
+    <!-- Only upgrade NuGetAdit warnings to errors for official builds. -->
+    <WarningsNotAsErrors Conditio="'$(OfficialBuild)' != 'true'">$(WarningsNotAsErrors);NU1901;NU1902;NU1903;NU1904</WarningsNotAsErrors>
   </PropertyGroup>
 
 </Project>

From 37d7ce1973b8ee701a506182ad44454bf1702676 Mon Sep 17 00:00:00 2001
From: Viktor Hofer <viktor.hofer@microsoft.com>
Date: Mon, 26 Aug 2024 17:06:09 +0200
Subject: [PATCH 6/7] Update Directory.Build.props

---
 Directory.Build.props | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Directory.Build.props b/Directory.Build.props
index f4f730a4c23..9d84f1dc650 100644
--- a/Directory.Build.props
+++ b/Directory.Build.props
@@ -14,8 +14,8 @@
     <EnableNETAnalyzers>true</EnableNETAnalyzers>
     <EnforceCodeStyleInBuild>true</EnforceCodeStyleInBuild>
     <RepositoryUrl>https://github.com/dotnet/arcade</RepositoryUrl>
-    <!-- Only upgrade NuGetAdit warnings to errors for official builds. -->
-    <WarningsNotAsErrors Conditio="'$(OfficialBuild)' != 'true'">$(WarningsNotAsErrors);NU1901;NU1902;NU1903;NU1904</WarningsNotAsErrors>
+    <!-- Only upgrade NuGetAudit warnings to errors for official builds. -->
+    <WarningsNotAsErrors Condition="'$(OfficialBuild)' != 'true'">$(WarningsNotAsErrors);NU1901;NU1902;NU1903;NU1904</WarningsNotAsErrors>
   </PropertyGroup>
 
 </Project>

From 257bb53fd7d90387901b37087efcfa1671f93af3 Mon Sep 17 00:00:00 2001
From: Viktor Hofer <viktor.hofer@microsoft.com>
Date: Mon, 26 Aug 2024 17:09:48 +0200
Subject: [PATCH 7/7] Update BuildTask.Packages.props

---
 eng/BuildTask.Packages.props | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/eng/BuildTask.Packages.props b/eng/BuildTask.Packages.props
index ab2bfbb2a0d..1c2d2a72e5e 100644
--- a/eng/BuildTask.Packages.props
+++ b/eng/BuildTask.Packages.props
@@ -12,9 +12,9 @@
     <PackageVersion Update="System.Threading.Tasks.Dataflow" Version="8.0.0" />
 
     <!-- Packages that transitively bring above dependencies in. -->
-    <PackageVersion Update="Microsoft.Extensions.DependencyInjection.Abstractions" Version="8.0.1" />
+    <PackageVersion Update="Microsoft.Extensions.DependencyInjection.Abstractions" Version="8.0.0" />
     <PackageVersion Update="Microsoft.Extensions.DependencyInjection" Version="8.0.0" />
-    <PackageVersion Update="Microsoft.Extensions.DependencyModel" Version="8.0.1" />
+    <PackageVersion Update="Microsoft.Extensions.DependencyModel" Version="8.0.0" />
     <PackageVersion Update="Microsoft.Extensions.Logging.Console" Version="8.0.0" />
   </ItemGroup>