Use current STJ in HostModel and remove unnecessary audit suppressions #109852
Conversation
ViktorHofer
requested review from
maraf,
ilonatommy,
lewing and
pavelsavara
as code owners
dotnet-issue-labeler
bot
added
the
needs-area-label
ViktorHofer
added
blocked
|
I support the goal of this PR, I tried to do it before, but had to roll it back because of #108261 Be sure that you test those scenarios so that we don't break again. IIRC we didn't see the crossgen problems on PR it was only afterward. |
| <PackageReference Include="System.Text.Json" Version="$(SystemTextJsonToolsetVersion)" ExcludeAssets="Runtime" PrivateAssets="All" /> | ||
| </ItemGroup> | ||
|
|
||
| <!-- Suppress System.Text.Json/8.0.4 advisory as desktop msbuild doesn't yet provide binding redirects for the non-vulnerable version (8.0.5). --> |
There was a problem hiding this comment.
Is this no longer the case for the VS versions we are using?
There was a problem hiding this comment.
Still the case but I decided to apply the NU1903 NoWarn directly on the STJ PackageReference above so that this won't pop up again with a future vulnerability report for STJ.
| <!-- Suppress System.Text.Json/8.0.4 advisory as desktop msbuild doesn't yet provide binding redirects for the non-vulnerable version (8.0.5). --> | ||
| <ItemGroup> | ||
| <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-8g4q-xg66-9fp4" /> | ||
| <ProjectReference Include="$(LibrariesProjectRoot)System.Text.Json\src\System.Text.Json.csproj" SetConfiguration="Configuration=$(LibrariesConfiguration)" /> |
There was a problem hiding this comment.
We do the SetConfiguration here:
I saw the exact same error when testing with vstest locally. I posted a comment in dotnet/sdk#44042 as that's the underlying reason why this doesn't work. When testing with xunit.console.dll, things work fine.
Can you please elaborate on the crossgen problems? |
Fixes #108262 and follow-up work from 31e28ad
Blocked on dotnet/sdk#44042