Wali/nuget package vulnerability fix

[waliMSFT]

updated the version of the nuget package System.Runtime.Uri to 4.3.2

[cormacpayne]

Would you mind providing some context as to why this runtime.unix.System.Private.Uri package was also added as a package reference throughout these .csproj files?

[william-msft]

Adding a screenshot or a description of the vulnerability we are solving would be nice.

[waliMSFT]

Please have a look on the comment: #2068 (comment)

[cormacpayne]

nit: I'm not sure if we need to include these package references in Detector.csproj and Detector.Test.csproj since they already reference the Common.csproj project, so these package references should be propagated downstream to these projects, but it's worth double-checking this

[waliMSFT]

Please have a look on the comment: #2068 (comment)

[waliMSFT]

After discussing with Dan, I have updated the dependency in the projects. Our partners showed concern on the System.Private.Uri version 4.3.0. Xunit has a inner dependency on that package, so updated the System.Private.Uri to 4.3.2 in the Common project as other projects have dependency on it.

[daniv-msft]

After discussing with Dan, I have updated the dependency in the projects. Our partners showed concern on the System.Private.Uri version 4.3.0. Xunit has a inner dependency on that package, so updated the System.Private.Uri to 4.3.2 in the Common project as other projects have dependency on it.

Could you please clarify why the other projects apart from Detector don't show the vulnerability? Given that here we need to take a direct dependency on a package we don't need directly, I'd rather make sure we minimize the impact on our project to where it is absolutely needed.

[cormacpayne]

@daniv-msft @waliMSFT -- to follow-up on the above comment: it may be worth introducing packages.lock.json files for our projects to better understand the dependencies we're taking and where each one is coming from (i.e., direct vs. transitive). This doc outlines the changes we'd make in each .csproj file if we wanted to generate it.

[waliMSFT]

After discussing with Dan, I have updated the dependency in the projects. Our partners showed concern on the System.Private.Uri version 4.3.0. Xunit has a inner dependency on that package, so updated the System.Private.Uri to 4.3.2 in the Common project as other projects have dependency on it.

Could you please clarify why the other projects apart from Detector don't show the vulnerability? Given that here we need to take a direct dependency on a package we don't need directly, I'd rather make sure we minimize the impact on our project to where it is absolutely needed.

@daniv-msft Among all the projects we have inside Oryx/src directory, only the Detector project uses the Xunit package. As few projects have dependency on Detector project, so the root dependency on the Xunit always comes from the Detector project.
In addition, there are projects do not have dependency on the Detector project. for example: BuildServer, BuildScriptGenerator.Common, etc. So, they don't possess any vulnerability.

[daniv-msft]

After discussing with Dan, I have updated the dependency in the projects. Our partners showed concern on the System.Private.Uri version 4.3.0. Xunit has a inner dependency on that package, so updated the System.Private.Uri to 4.3.2 in the Common project as other projects have dependency on it.

Could you please clarify why the other projects apart from Detector don't show the vulnerability? Given that here we need to take a direct dependency on a package we don't need directly, I'd rather make sure we minimize the impact on our project to where it is absolutely needed.

@daniv-msft Among all the projects we have inside Oryx/src directory, only the Detector project uses the Xunit package. As few projects have dependency on Detector project, so the root dependency on the Xunit always comes from the Detector project. In addition, there are projects do not have dependency on the Detector project. for example: BuildServer, BuildScriptGenerator.Common, etc. So, they don't possess any vulnerability.

Thanks for clarifying! In that case, please consider moving the System.Private.Uri nuget reference to Detector.csproj only so that we keep the workaround we need to create here as minimal as possible.

[waliMSFT]

Thanks for clarifying! In that case, please consider moving the System.Private.Uri nuget reference to Detector.csproj only so that we keep the workaround we need to create here as minimal as possible.
@daniv-msft I have made the change as you said. I agree with you to make the change as minimum as possible. However, I was wondering the vulnerability on the system.private.uri version 4.3.0 will be there if we import the xUnit package in any other project. It will create the same vulnerability. As all the projects use the Common project, previously I thought to add the updated system.private.uri version 4.3.2 there.