-
Notifications
You must be signed in to change notification settings - Fork 93
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Update to Newtonsoft 13.0.1 #2504
Changes from 8 commits
3392e26
e397e1e
97680df
216d72f
fbaaf18
f20fb9d
26a538b
3d143a6
e6bd7dd
d077083
c640726
b663d1a
968870f
bf3369c
ef08a64
23d1f21
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,4 +1,4 @@ | ||
<?xml version="1.0" encoding="utf-8"?> | ||
<packages> | ||
<package id="Newtonsoft.Json" version="12.0.3" targetFramework="net472" /> | ||
<package id="Newtonsoft.Json" version="13.0.1" targetFramework="net472" /> | ||
</packages> |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,4 +1,4 @@ | ||
<?xml version="1.0" encoding="utf-8"?> | ||
<packages> | ||
<package id="Newtonsoft.Json" version="12.0.3" targetFramework="net472" /> | ||
<package id="Newtonsoft.Json" version="13.0.1" targetFramework="net472" /> | ||
</packages> |
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -47,7 +47,7 @@ | |
|
||
<ItemGroup> | ||
<PackageReference Include="FluentAssertions" Version="5.10.2" /> | ||
<PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.0.0" /> | ||
<PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.4.0-preview-20220707-01" /> | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. This preview version includes the update to Newtonsoft 13.0.1 |
||
<PackageReference Include="Moq" Version="4.13.1" /> | ||
<PackageReference Include="System.Collections.Immutable" Version="5.0.0" /> | ||
<PackageReference Include="System.Composition" Version="5.0.0" /> | ||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -28,10 +28,11 @@ | |
<PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="3.1.2" /> | ||
<PackageReference Include="Microsoft.Extensions.Logging.ApplicationInsights" Version="2.13.1" /> | ||
<PackageReference Include="Microsoft.Extensions.Logging.Console" Version="3.1.2" /> | ||
<PackageReference Include="Microsoft.Json.Schema" Version="1.1.4" /> | ||
<PackageReference Include="Microsoft.Json.Schema.Validation" Version="1.1.4" /> | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. |
||
<PackageReference Include="Microsoft.Json.Schema" Version="1.1.5" /> | ||
<PackageReference Include="Microsoft.Json.Schema.Validation" Version="1.1.5" /> | ||
<PackageReference Include="Microsoft.TeamFoundationServer.Client" Version="16.153.0" /> | ||
<PackageReference Include="Microsoft.SourceLink.GitHub" Version="1.0.0" PrivateAssets="All" /> | ||
<PackageReference Include="Newtonsoft.Json" Version="13.0.1" /> | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Yes, this is needed. Otherwise, TFS will default to an older version of Newtonsoft. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I tried, I think this line is not need, the reason is There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Eddy experimented on this one both ways and determined that it is needed at this time. |
||
<PackageReference Include="System.Text.Encodings.Web" Version="5.0.1" /> | ||
</ItemGroup> | ||
|
||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
previously we have like this, maybe add before the current string?
DEPENDENCY BREAKING: SARIF now requires Newtonsoft.Json v13.0.1. #Resolved
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We didn't follow this convention when we updated to v12.0.1. In fact, I don't see a release history note for that specific update. In this case, the release history serves to tell anyone using the SARIF sdk that this version resolves the Newtonsoft vulnerability. I did consider this approach. If during testing, we see any indicators that this is indeed a breaking change, then we can re-evaluate the note.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I need to correct my previous statement. I was able to find the latest release history note and confirmed that this pattern has been repeated and took the suggestion. Thank you.