yv01p/Umbraco-CMS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Updated nuget packages and take a explicit dependency on Microsoft.IdentityModel.JsonWebTokens (#16935)

Browse Source
This commit is contained in:
Bjarke Berg
2024-08-21 10:25:39 +02:00
committed by GitHub
parent f99f821a6d
commit 79080ffa93
7 changed files with 28 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
Directory.Packages.props
View File

@@ -12,23 +12,23 @@
</ItemGroup> </ItemGroup>
<!-- Microsoft packages --> <!-- Microsoft packages -->
<ItemGroup> <ItemGroup>
<PackageVersion Include="Microsoft.AspNetCore.Mvc.NewtonsoftJson" Version="8.0.7" /> <PackageVersion Include="Microsoft.AspNetCore.Mvc.NewtonsoftJson" Version="8.0.8" />
<PackageVersion Include="Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation" Version="8.0.7" /> <PackageVersion Include="Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation" Version="8.0.8" />
<PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="4.10.0" /> <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="4.10.0" />
<PackageVersion Include="Microsoft.Data.Sqlite" Version="8.0.7" /> <PackageVersion Include="Microsoft.Data.Sqlite" Version="8.0.8" />
<PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="8.0.7" /> <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="8.0.8" />
<PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="8.0.7" /> <PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="8.0.8" />
<PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="8.0.7" /> <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="8.0.8" />
<PackageVersion Include="Microsoft.Extensions.Caching.Abstractions" Version="8.0.0" /> <PackageVersion Include="Microsoft.Extensions.Caching.Abstractions" Version="8.0.0" />
<PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="8.0.0" /> <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="8.0.0" />
<PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="8.0.0" /> <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="8.0.0" />
<PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="8.0.0" /> <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="8.0.0" />
<PackageVersion Include="Microsoft.Extensions.FileProviders.Embedded" Version="8.0.7" /> <PackageVersion Include="Microsoft.Extensions.FileProviders.Embedded" Version="8.0.8" />
<PackageVersion Include="Microsoft.Extensions.FileProviders.Physical" Version="8.0.0" /> <PackageVersion Include="Microsoft.Extensions.FileProviders.Physical" Version="8.0.0" />
<PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="8.0.0" /> <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="8.0.0" />
<PackageVersion Include="Microsoft.Extensions.Http" Version="8.0.0" /> <PackageVersion Include="Microsoft.Extensions.Http" Version="8.0.0" />
<PackageVersion Include="Microsoft.Extensions.Identity.Core" Version="8.0.7" /> <PackageVersion Include="Microsoft.Extensions.Identity.Core" Version="8.0.8" />
<PackageVersion Include="Microsoft.Extensions.Identity.Stores" Version="8.0.7" /> <PackageVersion Include="Microsoft.Extensions.Identity.Stores" Version="8.0.8" />
<PackageVersion Include="Microsoft.Extensions.Logging" Version="8.0.0" /> <PackageVersion Include="Microsoft.Extensions.Logging" Version="8.0.0" />
<PackageVersion Include="Microsoft.Extensions.Options" Version="8.0.2" /> <PackageVersion Include="Microsoft.Extensions.Options" Version="8.0.2" />
<PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="8.0.0" /> <PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="8.0.0" />
@@ -47,7 +47,7 @@
<PackageVersion Include="Dazinator.Extensions.FileProviders" Version="2.0.0" /> <PackageVersion Include="Dazinator.Extensions.FileProviders" Version="2.0.0" />
<PackageVersion Include="Examine" Version="3.3.0" /> <PackageVersion Include="Examine" Version="3.3.0" />
<PackageVersion Include="Examine.Core" Version="3.3.0" /> <PackageVersion Include="Examine.Core" Version="3.3.0" />
<PackageVersion Include="HtmlAgilityPack" Version="1.11.62" /> <PackageVersion Include="HtmlAgilityPack" Version="1.11.64" />
<PackageVersion Include="K4os.Compression.LZ4" Version="1.3.8" /> <PackageVersion Include="K4os.Compression.LZ4" Version="1.3.8" />
<PackageVersion Include="MailKit" Version="4.7.1.1" /> <PackageVersion Include="MailKit" Version="4.7.1.1" />
<PackageVersion Include="Markdown" Version="2.2.1" /> <PackageVersion Include="Markdown" Version="2.2.1" />
@@ -77,7 +77,7 @@
<PackageVersion Include="SixLabors.ImageSharp.Web" Version="3.1.3" /> <PackageVersion Include="SixLabors.ImageSharp.Web" Version="3.1.3" />
<PackageVersion Include="Smidge.InMemory" Version="4.4.0" /> <PackageVersion Include="Smidge.InMemory" Version="4.4.0" />
<PackageVersion Include="Smidge.Nuglify" Version="4.4.0" /> <PackageVersion Include="Smidge.Nuglify" Version="4.4.0" />
<PackageVersion Include="Swashbuckle.AspNetCore" Version="6.7.0" /> <PackageVersion Include="Swashbuckle.AspNetCore" Version="6.7.1" />
</ItemGroup> </ItemGroup>
<!-- Transitive pinned versions (only required because our direct dependencies have vulnerable versions of transitive dependencies) --> <!-- Transitive pinned versions (only required because our direct dependencies have vulnerable versions of transitive dependencies) -->
<ItemGroup> <ItemGroup>
@@ -89,5 +89,7 @@
<PackageVersion Include="System.Security.Cryptography.Xml" Version="8.0.1" /> <PackageVersion Include="System.Security.Cryptography.Xml" Version="8.0.1" />
<!-- Both Dazinator.Extensions.FileProviders and MiniProfiler.AspNetCore.Mvc bring in a vulnerable version of System.Text.RegularExpressions --> <!-- Both Dazinator.Extensions.FileProviders and MiniProfiler.AspNetCore.Mvc bring in a vulnerable version of System.Text.RegularExpressions -->
<PackageVersion Include="System.Text.RegularExpressions" Version="4.3.1" /> <PackageVersion Include="System.Text.RegularExpressions" Version="4.3.1" />
<!-- Both OpenIddict.AspNetCore, Npoco.SqlServer and Microsoft.EntityFrameworkCore.SqlServer bring in a vulnerable version of Microsoft.IdentityModel.JsonWebTokens -->
<PackageVersion Include="Microsoft.IdentityModel.JsonWebTokens" Version="7.7.1" />
</ItemGroup> </ItemGroup>
</Project> </Project>

3
src/Umbraco.Cms.Api.Common/Umbraco.Cms.Api.Common.csproj
View File

@@ -12,6 +12,9 @@
<PackageReference Include="Swashbuckle.AspNetCore" /> <PackageReference Include="Swashbuckle.AspNetCore" />
<PackageReference Include="OpenIddict.Abstractions" /> <PackageReference Include="OpenIddict.Abstractions" />
<PackageReference Include="OpenIddict.AspNetCore" /> <PackageReference Include="OpenIddict.AspNetCore" />
<!-- Both OpenIddict.AspNetCore, Npoco.SqlServer and Microsoft.EntityFrameworkCore.SqlServer bring in a vulnerable version of Microsoft.IdentityModel.JsonWebTokens -->
<PackageReference Include="Microsoft.IdentityModel.JsonWebTokens"/>
</ItemGroup> </ItemGroup>
<ItemGroup> <ItemGroup>

3
src/Umbraco.Cms.Persistence.EFCore.SqlServer/Umbraco.Cms.Persistence.EFCore.SqlServer.csproj
View File

@@ -8,6 +8,9 @@
<!-- Take top-level depedendency on Azure.Identity, because Microsoft.EntityFrameworkCore.SqlServer depends on a vulnerable version --> <!-- Take top-level depedendency on Azure.Identity, because Microsoft.EntityFrameworkCore.SqlServer depends on a vulnerable version -->
<PackageReference Include="Azure.Identity" /> <PackageReference Include="Azure.Identity" />
<PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" /> <PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" />
<!-- Both OpenIddict.AspNetCore, Npoco.SqlServer and Microsoft.EntityFrameworkCore.SqlServer bring in a vulnerable version of Microsoft.IdentityModel.JsonWebTokens -->
<PackageReference Include="Microsoft.IdentityModel.JsonWebTokens"/>
</ItemGroup> </ItemGroup>
<ItemGroup> <ItemGroup>

3
src/Umbraco.Cms.Persistence.SqlServer/Umbraco.Cms.Persistence.SqlServer.csproj
View File

@@ -8,6 +8,9 @@
<!-- Take top-level depedendency on Azure.Identity, because NPoco.SqlServer depends on a vulnerable version --> <!-- Take top-level depedendency on Azure.Identity, because NPoco.SqlServer depends on a vulnerable version -->
<PackageReference Include="Azure.Identity" /> <PackageReference Include="Azure.Identity" />
<PackageReference Include="NPoco.SqlServer" /> <PackageReference Include="NPoco.SqlServer" />
<!-- Both OpenIddict.AspNetCore, Npoco.SqlServer and Microsoft.EntityFrameworkCore.SqlServer bring in a vulnerable version of Microsoft.IdentityModel.JsonWebTokens -->
<PackageReference Include="Microsoft.IdentityModel.JsonWebTokens"/>
</ItemGroup> </ItemGroup>
<ItemGroup> <ItemGroup>

2
src/Umbraco.Web.BackOffice/Controllers/AuthenticationController.cs
View File

@@ -708,6 +708,8 @@ public class AuthenticationController : UmbracoApiControllerBase
return Ok(); return Ok();
} }
await _signInManager.SignOutAsync(); await _signInManager.SignOutAsync();
_logger.LogInformation("User {UserName} from IP address {RemoteIpAddress} has logged out", _logger.LogInformation("User {UserName} from IP address {RemoteIpAddress} has logged out",

2
src/Umbraco.Web.Common/Umbraco.Web.Common.csproj
View File

@@ -24,6 +24,8 @@
<PackageReference Include="System.Net.Http" /> <PackageReference Include="System.Net.Http" />
<!-- Take top-level depedendency on System.Text.RegularExpressions, because both Dazinator.Extensions.FileProviders and MiniProfiler.AspNetCore.Mvc depend on a vulnerable version --> <!-- Take top-level depedendency on System.Text.RegularExpressions, because both Dazinator.Extensions.FileProviders and MiniProfiler.AspNetCore.Mvc depend on a vulnerable version -->
<PackageReference Include="System.Text.RegularExpressions" /> <PackageReference Include="System.Text.RegularExpressions" />
<!-- Both OpenIddict.AspNetCore, Npoco.SqlServer and Microsoft.EntityFrameworkCore.SqlServer bring in a vulnerable version of Microsoft.IdentityModel.JsonWebTokens -->
<PackageReference Include="Microsoft.IdentityModel.JsonWebTokens"/>
</ItemGroup> </ItemGroup>
<ItemGroup> <ItemGroup>

4
tests/Directory.Packages.props
View File

@@ -4,8 +4,8 @@
<Import Project="$([MSBuild]::GetPathOfFileAbove(Directory.Packages.props, $(MSBuildThisFileDirectory)..))" /> <Import Project="$([MSBuild]::GetPathOfFileAbove(Directory.Packages.props, $(MSBuildThisFileDirectory)..))" />
<ItemGroup> <ItemGroup>
<!-- Microsoft packages --> <!-- Microsoft packages -->
<PackageVersion Include="BenchmarkDotNet" Version="0.13.12" /> <PackageVersion Include="BenchmarkDotNet" Version="0.14.0" />
<PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="8.0.1" /> <PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="8.0.8" />
<PackageVersion Include="Microsoft.Extensions.Logging.Debug" Version="8.0.0" /> <PackageVersion Include="Microsoft.Extensions.Logging.Debug" Version="8.0.0" />
<PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.8.0" /> <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.8.0" />
<PackageVersion Include="System.Data.DataSetExtensions" Version="4.5.0" /> <PackageVersion Include="System.Data.DataSetExtensions" Version="4.5.0" />