From 4b3b80d71e87e614a5fef3c6634c8b106955b2c3 Mon Sep 17 00:00:00 2001 From: Sadeq Abu-Hattem Date: Sat, 14 Nov 2026 20:22:17 +0200 Subject: [PATCH] Move Aspire to 13.6.5, for GHSA-f7vh-h5g3-7jrh Aspire.Hosting and Aspire.Hosting.AppHost below 13.6.5 carry a high-severity elevation-of-privilege advisory (CVE-2026-120006). NuGet's audit treats it as an error, so restore fails, and CI with it. Only the local AppHost uses Aspire; no shipped package depends on it. Co-Authored-By: Claude Opus 5.5 --- ARCHITECTURE-SLICES.md | 2 +- Directory.Packages.props | 6 +++--- .../DotNetBoostSample.AppHost.csproj | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/ARCHITECTURE-SLICES.md b/ARCHITECTURE-SLICES.md index be0bd59..49cc466 100644 --- a/ARCHITECTURE-SLICES.md +++ b/ARCHITECTURE-SLICES.md @@ -46,7 +46,7 @@ Three reasons specific to this repo, not general taste: **And a caveat on multi-targeting.** The *libraries* below can target `net8.0;net10.0`. The **host cannot today**: `Microsoft.EntityFrameworkCore` / `Npgsql.EntityFrameworkCore.PostgreSQL` 10.0.3 and -Aspire 13.6.4 all require `net10.0`. §7 has the conditional-version pattern if you want the host on +Aspire 13.6.5 all require `net10.0`. §7 has the conditional-version pattern if you want the host on both too; the value is mostly in the class libraries, where multi-targeting proves the slices compile against DotNetBoost's own `net8.0` TFM. diff --git a/Directory.Packages.props b/Directory.Packages.props index 5d62771..35ef8d6 100644 --- a/Directory.Packages.props +++ b/Directory.Packages.props @@ -114,9 +114,9 @@ chosen here rather than by a direct reference to something only Aspire uses. ────────────────────────────────────────────────────────────────────────── --> - - - + + + diff --git a/aspire/DotNetBoostSample.AppHost/DotNetBoostSample.AppHost.csproj b/aspire/DotNetBoostSample.AppHost/DotNetBoostSample.AppHost.csproj index 7483a35..39b9819 100644 --- a/aspire/DotNetBoostSample.AppHost/DotNetBoostSample.AppHost.csproj +++ b/aspire/DotNetBoostSample.AppHost/DotNetBoostSample.AppHost.csproj @@ -5,7 +5,7 @@ Version-locked to the Aspire.Hosting.* packages in Directory.Packages.props, which is where the reason for this particular number is written down. --> - + net10.0