Skip to content

Move Aspire to 13.6.5, for GHSA-f7vh-h5g3-7jrh #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sadeqabuhattem merged 1 commit into from
Nov 14, 2026
Merged

Move Aspire to 13.6.5, for GHSA-f7vh-h5g3-7jrh #2

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,16 @@
All notable changes to this project are documented here.
This project follows [Semantic Versioning](https://semver.org/).

## [Unreleased]

### Security
- **Aspire moved from 13.6.4 to 13.6.5**, for
[GHSA-f7vh-h5g3-7jrh](https://github.com/advisories/GHSA-f7vh-h5g3-7jrh) (CVE-2026-120006), an
elevation-of-privilege vulnerability in `Aspire.Hosting` and `Aspire.Hosting.AppHost` below
13.6.5. Only the local AppHost uses Aspire; no shipped package depends on it, so nothing
that consumes the library is affected. NuGet's audit fails the restore on 13.6.4, which is what
this unblocks.

## [1.0.0-preview.2] — 2026-10-26

Makes `UseAuditing(sp)` usable in a context that DotNetBoost.MultiLingual also saves to. 493 tests
Expand Down
10 changes: 5 additions & 5 deletions Directory.Packages.props
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,13 +31,13 @@
chosen here rather than by a direct pin of something only Aspire uses.
────────────────────────────────────────────────────────────────────────── -->
<ItemGroup Label="Aspire — AppHost (orchestration)">
<PackageVersion Include="Aspire.Hosting.AppHost" Version="13.6.4" />
<PackageVersion Include="Aspire.Hosting.PostgreSQL" Version="13.6.4" />
<PackageVersion Include="Aspire.Hosting.AppHost" Version="13.6.5" />
<PackageVersion Include="Aspire.Hosting.PostgreSQL" Version="13.6.5" />
<!-- Runs the Nuxt dashboard in clients/dashboard as an orchestrated resource. -->
<PackageVersion Include="Aspire.Hosting.JavaScript" Version="13.6.4" />
<PackageVersion Include="Aspire.Hosting.JavaScript" Version="13.6.5" />
<!-- Referenced only when the matching block in AppHost.cs is uncommented. -->
<PackageVersion Include="Aspire.Hosting.SqlServer" Version="13.6.4" />
<PackageVersion Include="Aspire.Hosting.MongoDB" Version="13.6.4" />
<PackageVersion Include="Aspire.Hosting.SqlServer" Version="13.6.5" />
<PackageVersion Include="Aspire.Hosting.MongoDB" Version="13.6.5" />
</ItemGroup>

<ItemGroup Label="Aspire — consumed by the sample API">
Expand Down
2 changes: 1 addition & 1 deletion aspire/DotNetBoost.Auditing.AppHost/AppHost.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,7 @@
// Mongo Express is the counterpart to WithPgWeb, and worth opening once: an entry here is ONE
// document with its property changes embedded, where next door it is a row plus a row per property.
//
// This is a STANDALONE mongod — Aspire.Hosting.MongoDB 13.6.4 does have WithReplicaSet, but this
// This is a STANDALONE mongod — Aspire.Hosting.MongoDB 13.6.5 does have WithReplicaSet, but this
// AppHost does not call it yet — so transactions are not available, and the store's
// WithSession(session) has nothing to enlist in.
// That is not hidden from the sample: POST /api/products/{id}/fail exists to show the window it
Expand Down
2 changes: 1 addition & 1 deletion aspire/DotNetBoost.Auditing.AppHost/DotNetBoost.Auditing.AppHost.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@

Version-locked to the Aspire.Hosting.* packages in Directory.Packages.props, which is
where the reason for this particular number is written down. -->
<Sdk Name="Aspire.AppHost.Sdk" Version="13.6.4" />
<Sdk Name="Aspire.AppHost.Sdk" Version="13.6.5" />

<PropertyGroup>
<OutputType>Exe</OutputType>
Expand Down
Loading