[17.11] Fix component governance alerts #10520

MichalPavlik · 2024-08-14T12:12:11Z

Fixes ~~CVE-2024-38081~~, CVE-2024-38095

Context

Some of our dependencies contains vulnerabilities.

Changes Made

I backported changes we already have in main branch - updated ~~Microsoft.IO.Redist~~ package version and pinned System.Formats.Asn1 package version.

Testing

Existing unit test.

Notes

VS 17.11 still uses Microsoft.IO.Redist version 6.0.0, so we need to stick with this version.

JanKrivanek · 2024-08-14T12:31:49Z

FYI @marcpopMSFT

eng/Versions.props

src/MSBuild/app.amd64.config

Co-authored-by: Rainer Sigwald <raines@microsoft.com>

…in eng/Versions.props

….com/dotnet/msbuild into dev/mipavlik/resolve-cg-alerts-17-11

src/MSBuild/app.amd64.config

src/MSBuild/app.config

MichalPavlik · 2024-09-11T13:02:00Z

/backport to 17.10

github-actions · 2024-09-11T13:02:13Z

Started backporting to 17.10: https://github.com/dotnet/msbuild/actions/runs/10812203541

MichalPavlik · 2024-09-11T13:02:22Z

/backport to vs17.10

github-actions · 2024-09-11T13:02:34Z

@MichalPavlik an error occurred while backporting to 17.10, please check the run log for details!

Error: @MichalPavlik is not a repo collaborator, backporting is not allowed. If you're a collaborator please make sure your dotnet team membership visibility is set to Public on https://github.com/orgs/dotnet/people?query=MichalPavlik

github-actions · 2024-09-11T13:02:36Z

Started backporting to vs17.10: https://github.com/dotnet/msbuild/actions/runs/10812210758

github-actions · 2024-09-11T13:02:57Z

@MichalPavlik an error occurred while backporting to vs17.10, please check the run log for details!

Error: @MichalPavlik is not a repo collaborator, backporting is not allowed. If you're a collaborator please make sure your dotnet team membership visibility is set to Public on https://github.com/orgs/dotnet/people?query=MichalPavlik

MichalPavlik · 2024-09-11T13:03:44Z

/backport to vs17.10

github-actions · 2024-09-11T13:03:56Z

Started backporting to vs17.10: https://github.com/dotnet/msbuild/actions/runs/10812234827

github-actions · 2024-09-11T13:04:19Z

@MichalPavlik backporting to vs17.10 failed, the patch most likely resulted in conflicts:

$ git am --3way --empty=keep --ignore-whitespace --keep-non-patch changes.patch

Applying: Resolves CG alerts
Using index info to reconstruct a base tree...
M	eng/SourceBuildPrebuiltBaseline.xml
M	eng/Version.Details.xml
M	eng/Versions.props
M	src/MSBuild/app.amd64.config
M	src/MSBuild/app.config
Falling back to patching base and 3-way merge...
Auto-merging src/MSBuild/app.config
Auto-merging src/MSBuild/app.amd64.config
Auto-merging eng/Versions.props
CONFLICT (content): Merge conflict in eng/Versions.props
Auto-merging eng/Version.Details.xml
Auto-merging eng/SourceBuildPrebuiltBaseline.xml
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config advice.mergeConflict false"
Patch failed at 0001 Resolves CG alerts
Error: The process '/usr/bin/git' failed with exit code 128

Please backport manually!

github-actions · 2024-09-11T13:04:19Z

@MichalPavlik an error occurred while backporting to vs17.10, please check the run log for details!

Error: git am failed, most likely due to a merge conflict.

* Localized file check-in by OneLocBuild Task: Build definition ID 9434: Build ID 10000931 (#10267) * Localized file check-in by OneLocBuild Task: Build definition ID 9434: Build ID 9752299 * Increase VersionPrefix version --------- Co-authored-by: Jenny Bai <v-jennybai@microsoft.com> * [17.11] Fix component governance alerts (#10520) * Resolves CG alerts --------- Co-authored-by: Rainer Sigwald <raines@microsoft.com> * Assembly redirect fix (#10624) * Fixing the assembly redirect * [vs17.11] Update dependencies from dotnet/arcade (#10654) * Update dependencies from https://github.com/dotnet/arcade build 20240910.4 Microsoft.SourceBuild.Intermediate.arcade , Microsoft.DotNet.Arcade.Sdk , Microsoft.DotNet.XUnitExtensions From Version 8.0.0-beta.24311.3 -> To Version 8.0.0-beta.24460.4 * version bump --------- Co-authored-by: dotnet-maestro[bot] <dotnet-maestro[bot]@users.noreply.github.com> Co-authored-by: Mariana Garces Dematte <magarces@microsoft.com> * Upgrade system.text.json to 8.0.4 (#10650) Will address dotnet/sdk#43339 when deployed in VS. --------- Co-authored-by: Rainer Sigwald <raines@microsoft.com> * disable loc (#10693) Part of: #10665 Disabling localization for 17.11. * [vs17.11] Update dependencies from dotnet/arcade (#10691) * [vs17.11] Update dependencies from dotnet/arcade (#10793) * Update dependencies from https://github.com/dotnet/arcade build 20241008.1 Microsoft.SourceBuild.Intermediate.arcade , Microsoft.DotNet.Arcade.Sdk , Microsoft.DotNet.XUnitExtensions From Version 8.0.0-beta.24475.3 -> To Version 8.0.0-beta.24508.1 * bump the version --------- Co-authored-by: dotnet-maestro[bot] <dotnet-maestro[bot]@users.noreply.github.com> Co-authored-by: YuliiaKovalova <95473390+YuliiaKovalova@users.noreply.github.com> * CG alert cleaning on VS17.11 (#10723) * Bump Microsoft.IO.Redist to 6.0.1 * Bump version prefix to 17.11.11 * [vs17.11] Update dependencies from dotnet/arcade (#10832) * [vs17.11] Update dependencies from dotnet/arcade (#10895) * [vs17.11] Update dependencies from dotnet/arcade (#10990) * Update dependencies from https://github.com/dotnet/arcade build 20241112.12 Microsoft.SourceBuild.Intermediate.arcade , Microsoft.DotNet.Arcade.Sdk , Microsoft.DotNet.XUnitExtensions From Version 8.0.0-beta.24525.2 -> To Version 8.0.0-beta.24562.12 * Update VersionPrefix to 17.11.16 --------- Co-authored-by: dotnet-maestro[bot] <dotnet-maestro[bot]@users.noreply.github.com> Co-authored-by: Gang Wang <v-gaw@microsoft.com> * Update dependencies from https://github.com/dotnet/arcade build 20241120.5 Microsoft.SourceBuild.Intermediate.arcade , Microsoft.DotNet.Arcade.Sdk , Microsoft.DotNet.XUnitExtensions From Version 8.0.0-beta.24562.12 -> To Version 8.0.0-beta.24570.5 * Update VersionPrefix to 17.11.17 * [vs17.11] Run tests even if version is not bumped (#11060) Backport of #11042 to vs17.11 * [vs17.11] Backport VS insertion pipeline YMLs (#11064) Co-authored-by: Jan Provaznik <janprovaznik@microsoft.com> * Eliminate the unnecessary change from vs17.11 * Remove duplicate version setting for System.Formats.Asn1 * Bump up version prefix to 17.12.18 --------- Co-authored-by: dotnet bot <dotnet-bot@dotnetfoundation.org> Co-authored-by: Jenny Bai <v-jennybai@microsoft.com> Co-authored-by: MichalPavlik <michalpavlik@outlook.com> Co-authored-by: Rainer Sigwald <raines@microsoft.com> Co-authored-by: dotnet-maestro[bot] <42748379+dotnet-maestro[bot]@users.noreply.github.com> Co-authored-by: dotnet-maestro[bot] <dotnet-maestro[bot]@users.noreply.github.com> Co-authored-by: Mariana Garces Dematte <magarces@microsoft.com> Co-authored-by: YuliiaKovalova <95473390+YuliiaKovalova@users.noreply.github.com> Co-authored-by: Gang Wang <v-gaw@microsoft.com> Co-authored-by: Surayya Huseyn Zada <114938397+surayya-MS@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Jan Provaznik <janprovaznik@microsoft.com>

Resolves CG alerts

1af7539

MichalPavlik added Servicing-consider do-not-merge labels Aug 14, 2024

MichalPavlik requested a review from a team as a code owner August 14, 2024 12:12

MichalPavlik changed the base branch from main to vs17.11 August 14, 2024 12:20

JanKrivanek approved these changes Aug 14, 2024

View reviewed changes

rainersigwald reviewed Aug 14, 2024

View reviewed changes

eng/Versions.props Outdated Show resolved Hide resolved

src/MSBuild/app.amd64.config Outdated Show resolved Hide resolved

MichalPavlik mentioned this pull request Aug 14, 2024

[Kitten] Kitten work - August/2024 #10479

Closed

14 tasks

MichalPavlik and others added 5 commits August 14, 2024 15:37

Update src/MSBuild/app.amd64.config

362f319

Co-authored-by: Rainer Sigwald <raines@microsoft.com>

Increaded revision version number (the last part) of 'VersionPrefix' …

912895b

…in eng/Versions.props

Merge branch 'dev/mipavlik/resolve-cg-alerts-17-11' of https://github…

da1e29c

….com/dotnet/msbuild into dev/mipavlik/resolve-cg-alerts-17-11

Bumping once again

bcfa74e

Merge branch 'vs17.11' into dev/mipavlik/resolve-cg-alerts-17-11

fe4ff0c

rbhanda added Servicing-approved and removed Servicing-consider labels Aug 20, 2024

JanKrivanek removed the do-not-merge label Aug 20, 2024

maridematte added the do-not-merge label Aug 27, 2024

MichalPavlik added 3 commits September 2, 2024 07:53

Reverting MS.IO.Redist version back to 6.0.0

1ffd26e

Bumped version prefix

6a64851

Merge branch 'vs17.11' into dev/mipavlik/resolve-cg-alerts-17-11

9874907

MichalPavlik mentioned this pull request Sep 2, 2024

[Kitten] Kitten work - September/2024 - October/2024 #10592

Closed

7 tasks

MichalPavlik requested a review from rainersigwald September 3, 2024 09:26

MichalPavlik removed the do-not-merge label Sep 3, 2024

maridematte requested changes Sep 3, 2024

View reviewed changes

src/MSBuild/app.amd64.config Show resolved Hide resolved

src/MSBuild/app.config Show resolved Hide resolved

maridematte approved these changes Sep 5, 2024

View reviewed changes

MichalPavlik merged commit bcaf466 into vs17.11 Sep 6, 2024
10 checks passed

MichalPavlik deleted the dev/mipavlik/resolve-cg-alerts-17-11 branch September 6, 2024 07:50

MichalPavlik mentioned this pull request Sep 6, 2024

Assembly redirect fix #10624

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[17.11] Fix component governance alerts #10520

[17.11] Fix component governance alerts #10520

MichalPavlik commented Aug 14, 2024 •

edited

Loading

JanKrivanek commented Aug 14, 2024

MichalPavlik commented Sep 11, 2024

github-actions bot commented Sep 11, 2024

MichalPavlik commented Sep 11, 2024

github-actions bot commented Sep 11, 2024

github-actions bot commented Sep 11, 2024

github-actions bot commented Sep 11, 2024

MichalPavlik commented Sep 11, 2024

github-actions bot commented Sep 11, 2024

github-actions bot commented Sep 11, 2024

github-actions bot commented Sep 11, 2024

[17.11] Fix component governance alerts #10520

[17.11] Fix component governance alerts #10520

Conversation

MichalPavlik commented Aug 14, 2024 • edited Loading

Context

Changes Made

Testing

Notes

JanKrivanek commented Aug 14, 2024

MichalPavlik commented Sep 11, 2024

github-actions bot commented Sep 11, 2024

MichalPavlik commented Sep 11, 2024

github-actions bot commented Sep 11, 2024

github-actions bot commented Sep 11, 2024

github-actions bot commented Sep 11, 2024

MichalPavlik commented Sep 11, 2024

github-actions bot commented Sep 11, 2024

github-actions bot commented Sep 11, 2024

github-actions bot commented Sep 11, 2024

MichalPavlik commented Aug 14, 2024 •

edited

Loading