From a74bdeb96ff7a25bdf595e75b945872d52f7751a Mon Sep 17 00:00:00 2001 From: Sadeq Abu-Hattem Date: Sat, 14 Nov 2026 20:22:17 +0200 Subject: [PATCH] Move Aspire to 13.6.5, for GHSA-f7vh-h5g3-7jrh Aspire.Hosting and Aspire.Hosting.AppHost below 13.6.5 carry a high-severity elevation-of-privilege advisory (CVE-2026-120006). NuGet's audit treats it as an error, so restore fails, and CI with it. Only the local AppHost uses Aspire; no shipped package depends on it. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 10 ++++++++++ Directory.Packages.props | 10 +++++----- aspire/DotNetBoost.Auditing.AppHost/AppHost.cs | 2 +- .../DotNetBoost.Auditing.AppHost.csproj | 2 +- 4 files changed, 17 insertions(+), 7 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 29c3c36..d41dc96 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,16 @@ All notable changes to this project are documented here. This project follows [Semantic Versioning](https://semver.org/). +## [Unreleased] + +### Security +- **Aspire moved from 13.6.4 to 13.6.5**, for + [GHSA-f7vh-h5g3-7jrh](https://github.com/advisories/GHSA-f7vh-h5g3-7jrh) (CVE-2026-120006), an + elevation-of-privilege vulnerability in `Aspire.Hosting` and `Aspire.Hosting.AppHost` below + 13.6.5. Only the local AppHost uses Aspire; no shipped package depends on it, so nothing + that consumes the library is affected. NuGet's audit fails the restore on 13.6.4, which is what + this unblocks. + ## [1.0.0-preview.2] — 2026-10-26 Makes `UseAuditing(sp)` usable in a context that DotNetBoost.MultiLingual also saves to. 493 tests diff --git a/Directory.Packages.props b/Directory.Packages.props index 335e990..6e31645 100644 --- a/Directory.Packages.props +++ b/Directory.Packages.props @@ -31,13 +31,13 @@ chosen here rather than by a direct pin of something only Aspire uses. ────────────────────────────────────────────────────────────────────────── --> - - + + - + - - + + diff --git a/aspire/DotNetBoost.Auditing.AppHost/AppHost.cs b/aspire/DotNetBoost.Auditing.AppHost/AppHost.cs index 02d1f28..3f609ae 100644 --- a/aspire/DotNetBoost.Auditing.AppHost/AppHost.cs +++ b/aspire/DotNetBoost.Auditing.AppHost/AppHost.cs @@ -66,7 +66,7 @@ // Mongo Express is the counterpart to WithPgWeb, and worth opening once: an entry here is ONE // document with its property changes embedded, where next door it is a row plus a row per property. // -// This is a STANDALONE mongod — Aspire.Hosting.MongoDB 13.6.4 does have WithReplicaSet, but this +// This is a STANDALONE mongod — Aspire.Hosting.MongoDB 13.6.5 does have WithReplicaSet, but this // AppHost does not call it yet — so transactions are not available, and the store's // WithSession(session) has nothing to enlist in. // That is not hidden from the sample: POST /api/products/{id}/fail exists to show the window it diff --git a/aspire/DotNetBoost.Auditing.AppHost/DotNetBoost.Auditing.AppHost.csproj b/aspire/DotNetBoost.Auditing.AppHost/DotNetBoost.Auditing.AppHost.csproj index 94ef0cb..ac11a77 100644 --- a/aspire/DotNetBoost.Auditing.AppHost/DotNetBoost.Auditing.AppHost.csproj +++ b/aspire/DotNetBoost.Auditing.AppHost/DotNetBoost.Auditing.AppHost.csproj @@ -5,7 +5,7 @@ Version-locked to the Aspire.Hosting.* packages in Directory.Packages.props, which is where the reason for this particular number is written down. --> - + Exe