Fix vulnerabilities in dependencies
Description
Resolves 417 instances of 14 vulnerabilities in multiple versions of these 10 (transitive) dependencies:
Azure.Identity
Microsoft.Identity.Client
Newtonsoft.Json
Npgsql
SixLabors.ImageSharp
System.Formats.Asn1
System.Net.Http
System.Security.Cryptography.Xml
System.Text.Json
System.Text.RegularExpressions
These stats are only for the framework solution but the modules where also fixed. These where found using:
dotnet list package --vulnerable --include-transitive
Notes
Because it gets annoying to keep having to fix these in our project, I thought maybe I should fix it at the source 😇
Instead of just updating the vulnerable package versions, I did some cleanup to reduce the amount of transitive dependencies and to make the process of updating them easier in the future:
- Some vulnerabilities are only present in the
netstandard2.0andnetstandard2.1targets of some dependencies. Because ABP 8 requiresnet8.0anyway, I assume those targets can be safely dropped as an easy fix. - The
AssetTargetFallbackcan then be dropped from projects too. - There are bunch of unused dependencies that I removed, but there might be more of them.
- Because IdentityServer4 is deprecated, there is no fix for its vulnerability. According to #11989 it should have been removed by now as OpenIddict became the default in ABP 6.
- I also updated all other outdated dependencies I could find.
I rebased this on latest dev to fix a merge conflict.
Great initiative, I was just going to open an issue because of transitive package vulnerabilities that I'd like to see fixed 👍
@maliming I see now ABP is usually quite conservative in updating dependencies, so maybe you can skip the last commit, or cherry pick what you like in this PR.
Thanks @Muximize
We will continue to support the netstandard2.0 and netstandard2.1. And packages have been upgraded in https://github.com/abpframework/abp/pull/20960
I will cherry-pick your commit to a new Pull Request. 👍