From 2f7d55d66a2b8ca271d969051c1c1f6bd59e9f0c Mon Sep 17 00:00:00 2001 From: ahall Date: Mon, 6 Jul 2026 10:24:19 +0100 Subject: [PATCH] fix: resolve remaining sample package drift and Microsoft.OpenApi NU1903 (#489) - Bump samples/todoapp-mvc Microsoft.EntityFrameworkCore.SqlServer 10.0.3 -> 10.0.9 to match the repo's EFCoreVersion (missed in #485). - Bump stray Microsoft.AspNetCore.Components.WebAssembly*/Microsoft.Extensions.Http pins in todoapp-blazor-wasm from 10.0.3 -> 10.0.9. - Bump Microsoft.EntityFrameworkCore (Avalonia), Microsoft.Extensions.Logging.Debug (MAUI), Microsoft.Extensions.DependencyInjection (WinUI3), and System.Text.Json/System.Formats.Asn1/System.IO.Packaging (Uno, local CPM) from 10.0.3 -> 10.0.9 across the todoapp client-platform samples. - Bump CommunityToolkit.Datasync.Client 10.0.0 -> 10.1.0 across every client sample (Avalonia, MAUI, Uno, WPF, WinUI3, todoapp-tutorial/ClientApp, todoapp-blazor-wasm/Client) to match the latest published package, alongside the already-updated 10.1.0 server samples. - Pin Microsoft.OpenApi to 2.7.5 in root Directory.Packages.props to resolve the NU1903 high-severity advisory (GHSA-v5pm-xwqc-g5wc) on the 2.0.0 version floated transitively via Microsoft.AspNetCore.OpenApi/NSwag.AspNetCore/ Swashbuckle.AspNetCore. CentralPackageTransitivePinningEnabled propagates this through project references into samples/datasync-server and samples/datasync-server-cosmosdb-singlecontainer without needing per-sample pins; verified every restored project.assets.json in the repo now resolves Microsoft.OpenApi/2.7.5. The remaining NU1903 advisory (SQLitePCLRaw.lib.e_sqlite3, GHSA-2m69-gcr7-jv3q) has no patched version available and is tracked separately in #492. Verified: dotnet restore/build/test on Datasync.Toolkit.sln (2280+ tests passing across all suites), plus restore+build for every affected sample solution/project (todoapp-mvc, todoapp-blazor-wasm, datasync-server, datasync-server-cosmosdb-singlecontainer, todoapp-tutorial, TodoApp.Avalonia, TodoApp.Avalonia.Desktop, TodoApp.WPF). TodoApp.MAUI/TodoApp.Uno mobile TFMs and TodoApp.WinUI3 build could not be fully exercised in this environment due to missing Android/iOS/Windows workloads, but package restore succeeded up to that point, confirming the version pins resolve cleanly. --- Directory.Packages.props | 8 ++++++++ .../TodoApp.BlazorWasm.Client.csproj | 8 ++++---- .../TodoApp.BlazorWasm.Server.csproj | 2 +- .../todoapp-mvc/TodoApp.Service/TodoApp.Service.csproj | 2 +- samples/todoapp-tutorial/ClientApp/ClientApp.csproj | 2 +- .../TodoApp.Avalonia/TodoApp.Avalonia.csproj | 4 ++-- samples/todoapp/TodoApp.MAUI/TodoApp.MAUI.csproj | 4 ++-- samples/todoapp/TodoApp.Uno/Directory.Packages.props | 8 ++++---- samples/todoapp/TodoApp.WPF/TodoApp.WPF.csproj | 2 +- samples/todoapp/TodoApp.WinUI3/TodoApp.WinUI3.csproj | 4 ++-- 10 files changed, 26 insertions(+), 18 deletions(-) diff --git a/Directory.Packages.props b/Directory.Packages.props index 5fa1f64..4d26d91 100644 --- a/Directory.Packages.props +++ b/Directory.Packages.props @@ -31,6 +31,14 @@ + + diff --git a/samples/todoapp-blazor-wasm/TodoApp.BlazorWasm.Client/TodoApp.BlazorWasm.Client.csproj b/samples/todoapp-blazor-wasm/TodoApp.BlazorWasm.Client/TodoApp.BlazorWasm.Client.csproj index 2dae8a3..b500632 100644 --- a/samples/todoapp-blazor-wasm/TodoApp.BlazorWasm.Client/TodoApp.BlazorWasm.Client.csproj +++ b/samples/todoapp-blazor-wasm/TodoApp.BlazorWasm.Client/TodoApp.BlazorWasm.Client.csproj @@ -7,10 +7,10 @@ - - - - + + + + diff --git a/samples/todoapp-blazor-wasm/TodoApp.BlazorWasm.Server/TodoApp.BlazorWasm.Server.csproj b/samples/todoapp-blazor-wasm/TodoApp.BlazorWasm.Server/TodoApp.BlazorWasm.Server.csproj index a6be799..9b70cc7 100644 --- a/samples/todoapp-blazor-wasm/TodoApp.BlazorWasm.Server/TodoApp.BlazorWasm.Server.csproj +++ b/samples/todoapp-blazor-wasm/TodoApp.BlazorWasm.Server/TodoApp.BlazorWasm.Server.csproj @@ -11,7 +11,7 @@ - + diff --git a/samples/todoapp-mvc/TodoApp.Service/TodoApp.Service.csproj b/samples/todoapp-mvc/TodoApp.Service/TodoApp.Service.csproj index 7a88cde..bbc928a 100644 --- a/samples/todoapp-mvc/TodoApp.Service/TodoApp.Service.csproj +++ b/samples/todoapp-mvc/TodoApp.Service/TodoApp.Service.csproj @@ -9,7 +9,7 @@ - + diff --git a/samples/todoapp-tutorial/ClientApp/ClientApp.csproj b/samples/todoapp-tutorial/ClientApp/ClientApp.csproj index e0e368d..c3c6132 100644 --- a/samples/todoapp-tutorial/ClientApp/ClientApp.csproj +++ b/samples/todoapp-tutorial/ClientApp/ClientApp.csproj @@ -9,7 +9,7 @@ - + diff --git a/samples/todoapp/TodoApp.Avalonia/TodoApp.Avalonia/TodoApp.Avalonia.csproj b/samples/todoapp/TodoApp.Avalonia/TodoApp.Avalonia/TodoApp.Avalonia.csproj index 6cc92ee..e2c0899 100644 --- a/samples/todoapp/TodoApp.Avalonia/TodoApp.Avalonia/TodoApp.Avalonia.csproj +++ b/samples/todoapp/TodoApp.Avalonia/TodoApp.Avalonia/TodoApp.Avalonia.csproj @@ -16,8 +16,8 @@ - + - + diff --git a/samples/todoapp/TodoApp.MAUI/TodoApp.MAUI.csproj b/samples/todoapp/TodoApp.MAUI/TodoApp.MAUI.csproj index 7c68ea6..424870a 100644 --- a/samples/todoapp/TodoApp.MAUI/TodoApp.MAUI.csproj +++ b/samples/todoapp/TodoApp.MAUI/TodoApp.MAUI.csproj @@ -50,10 +50,10 @@ - + - + diff --git a/samples/todoapp/TodoApp.Uno/Directory.Packages.props b/samples/todoapp/TodoApp.Uno/Directory.Packages.props index 6d4cbfc..73f9c81 100644 --- a/samples/todoapp/TodoApp.Uno/Directory.Packages.props +++ b/samples/todoapp/TodoApp.Uno/Directory.Packages.props @@ -10,11 +10,11 @@ - + - - + + - + diff --git a/samples/todoapp/TodoApp.WPF/TodoApp.WPF.csproj b/samples/todoapp/TodoApp.WPF/TodoApp.WPF.csproj index c6faa09..1dcc877 100644 --- a/samples/todoapp/TodoApp.WPF/TodoApp.WPF.csproj +++ b/samples/todoapp/TodoApp.WPF/TodoApp.WPF.csproj @@ -10,6 +10,6 @@ - + diff --git a/samples/todoapp/TodoApp.WinUI3/TodoApp.WinUI3.csproj b/samples/todoapp/TodoApp.WinUI3/TodoApp.WinUI3.csproj index 68ae39f..c4863a8 100644 --- a/samples/todoapp/TodoApp.WinUI3/TodoApp.WinUI3.csproj +++ b/samples/todoapp/TodoApp.WinUI3/TodoApp.WinUI3.csproj @@ -29,11 +29,11 @@ - + - +