CG work item fix for System.Text.JSON package #1871
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Details
Updated System.Text.Json to 8.0.5 to address GHSA-hh2w-p6rv-4g7w. This will fix CG issue https://dev.azure.com/mseng/1ES/_workitems/edit/2221678/?view=edit
Along with this updated its root dependencies to latest.
NOTE: After updating the version, test case was failing in pipeline with below error
Error Log:
Failed AllDropFilesAreAccountedFor [136 ms]
Error Message:
Assert.IsFalse failed. 1 drop files are missing from "ProductComponent" of WXS: Microsoft.Bcl.TimeProvider.dll
Stack Trace:
at MsiFileTests.WxsValidationTests.CompareWxsSectionToDropPath(String repoRoot, String relativeDropPath, String wxsFile, String wxsComponentId, HashSet`1 intentionalExclusions) in D:\a_work\1\s\src\MsiFileTests\WxsValidationTests.cs:line 48
at MsiFileTests.WxsValidationTests.AllDropFilesAreAccountedFor() in D:\a_work\1\s\src\MsiFileTests\WxsValidationTests.cs:line 25
Results File: D:\a_work_temp\TestResults\cloudtest_d22066dec000000_2024-10-17_06_24_32.trx
To fix above, made changes in Product.wxs as below
Added below code to fix the error in pipeline:
<File Id="Microsoft.Bcl.TimeProvider.dll" Source="Microsoft.Bcl.TimeProvider.dll" />
Motivation
CVE
Context
Pull request checklist