Skip to content

Use Central Package Management (cpm), move TargetFramework to BuildProps #519

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
JW-CH merged 3 commits into from
Dec 4, 2025
Merged

Use Central Package Management (cpm), move TargetFramework to BuildProps #519

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
91ef471
Move to Central Package Management (cpm)
JW-CH Dec 4, 2025
51af077
set TargetFramework in buildprops
JW-CH Dec 4, 2025
2b1db38
remove redundant logging reference
JW-CH Dec 4, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Directory.Build.props
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
<Project>
<PropertyGroup>
<Nullable>enable</Nullable>
<AvaloniaVersion>11.0.6</AvaloniaVersion>
Copy link
Collaborator

@3rob3 3rob3 Dec 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LOL, how was this still in there 😄

<TargetFramework>net8.0</TargetFramework>
</PropertyGroup>
</Project>
29 changes: 29 additions & 0 deletions Directory.Packages.props
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
<Project>
<PropertyGroup>
<ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
<CentralPackageTransitivePinningEnabled>false</CentralPackageTransitivePinningEnabled>
</PropertyGroup>
<ItemGroup>
<PackageVersion Include="AwesomeAssertions" Version="9.2.0" />
<PackageVersion Include="BloomFilter.NetCore" Version="2.5.3" />
<PackageVersion Include="coverlet.collector" Version="6.0.4" />
<PackageVersion Include="Ical.Net" Version="4.3.1" />
<PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="8.0.20" />
<PackageVersion Include="Microsoft.AspNetCore.SpaProxy" Version="8.0.20" />
<PackageVersion Include="Microsoft.Extensions.ApiDescription.Client" Version="8.0.20" />
<PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="9.0.5" />
<PackageVersion Include="Microsoft.Extensions.Http" Version="8.0.1" />
<PackageVersion Include="Microsoft.Extensions.Logging.Console" Version="8.0.1" />
<PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
<PackageVersion Include="Moq" Version="4.20.72" />
<PackageVersion Include="Newtonsoft.Json" Version="13.0.4" />
<PackageVersion Include="NSwag.ApiDescription.Client" Version="13.20.0" />
<PackageVersion Include="NUnit" Version="4.4.0" />
<PackageVersion Include="NUnit.Analyzers" Version="4.10.0" />
<PackageVersion Include="NUnit3TestAdapter" Version="5.2.0" />
<PackageVersion Include="OpenWeatherMap.API" Version="2.1.2" />
<PackageVersion Include="Swashbuckle.AspNetCore" Version="8.1.4" />
<PackageVersion Include="ThumbHash" Version="2.1.1" />
<PackageVersion Include="YamlDotNet" Version="16.3.0" />
Comment on lines +7 to +27
Copy link

@coderabbitai coderabbitai bot Dec 4, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🌐 Web query:

Swashbuckle.AspNetCore 8.1.4 security vulnerabilities CVE

💡 Result:

Short answer: There is no known CVE that directly affects Swashbuckle.AspNetCore v8.1.4 itself. However:

  • A transitive dependency risk exists: Newtonsoft.Json versions < 13.0.1 are affected by CVE-2024-21907 (DoS via deeply nested JSON); if your project (or any dependency in the chain used by Swashbuckle) pulls an affected Newtonsoft.Json, you are exposed. [1][3]

  • Old swagger-ui packages had SSRF/click‑hijack issues (e.g. CVE-2021-46708) but that affects Swagger UI packages prior to their fixed releases (upgrade to fixed versions); it does not apply to Swashbuckle.AspNetCore.SwaggerUI >= 6.3. Confirm your installed swagger-ui subpackage version. [2]

Recommendation: verify your effective dependency tree (dotnet list package --include-transitive or a SCA tool) for Newtonsoft.Json < 13.0.1 or for swashbuckle.aspnetcore.swaggerui versions < 6.3 and upgrade those packages if present. [3][1][2]

Sources:

  • NVD — CVE-2024-21907 (Newtonsoft.Json). [1]
  • Snyk advisory — CVE-2021-46708 / swagger-ui SSRF. [2]
  • Swashbuckle.AspNetCore 8.1.4 NuGet page (package metadata). [3]

🌐 Web query:

Newtonsoft.Json 13.0.4 security vulnerabilities known issues

💡 Result:

Short answer

  • No publicly disclosed CVE affects Newtonsoft.Json 13.0.4 itself — the known high‑severity CVE (CVE‑2024‑21907) affects versions before 13.0.1 and was fixed in 13.0.1. [1][4]

Known non‑security issues reported for 13.0.4

  • Users have reported regressions/behavior changes (SerializerSettings not respected) after upgrading to 13.0.4. [2]
  • Runtime issues when mixing assemblies (apps built against 13.0.4 loading 13.0.3 from GAC) have been reported. These are runtime/compatibility bugs, not CVEs. [3]

Recommendations

  • 13.0.4 includes the security fix for CVE‑2024‑21907; if you need protection against that DoS issue, ensure you are on >=13.0.1 (13.0.4 is fine). [1][4]
  • Before upgrading to 13.0.4 in production, test for the reported regressions (SerializerSettings and GAC/assembly-binding scenarios) and apply binding redirects or avoid mixed GAC installs if necessary. [2][3]

Sources

  • GitHub Advisory / CVE details (CVE‑2024‑21907) — fix in 13.0.1. [1]
  • GitHub issues reporting 13.0.4 regressions (#3080). [2]
  • GitHub issue reporting runtime/GAC compatibility (#3084). [3]
  • Rapid7 / vulnerability databases summary of CVE‑2024‑21907. [4]

🌐 Web query:

Microsoft.AspNetCore.Mvc.Testing 8.0.20 security vulnerabilities

💡 Result:

Short answer: Yes — Microsoft.AspNetCore.Mvc.Testing 8.0.20 (and ASP.NET Core 8.0.20 and earlier) is covered by a critical ASP.NET Core HTTP request‑smuggling vulnerability tracked as CVE‑2025‑55315. Microsoft patched it in ASP.NET Core 8.0.21; you should update to 8.0.21 or later. [1][2]

Sources

  • Microsoft / dotnet security advisory (CVE‑2025‑55315) — affected: ASP.NET Core 8.0.20 and earlier; guidance to update to patched releases. [1]
  • NuGet package page showing Microsoft.AspNetCore.Mvc.Testing 8.0.20 (package/version referenced). Update to 8.0.21+ is recommended. [2]

Would you like exact upgrade steps for your project (csproj/central package management/Docker)?

🌐 Web query:

NUnit latest stable version December 2025

💡 Result:

Latest stable NUnit version (as of December 4, 2025) is 4.4.0. [1][2]

Sources:

  • NuGet package profile for NUnit (latest version 4.4.0, last updated Aug 10, 2025). [1]
  • NUnit GitHub repository (NUnit 4 framework). [2]

🌐 Web query:

Microsoft.NET.Test.Sdk latest version 2025

💡 Result:

The latest Microsoft.NET.Test.Sdk release is version 18.0.1, published November 11, 2025. [1]

Sources:
[1] NuGet — Microsoft.NET.Test.Sdk package page (version list). [2] NuGet — Microsoft.NET.Test.SDK (package) (same listing).

Update Microsoft.AspNetCore.Mvc.Testing to 8.0.21 or later—CVE-2025-55315 critical HTTP request-smuggling vulnerability.

Additionally:

  • Microsoft.NET.Test.Sdk 17.14.1 is outdated. Update to 18.0.1 (latest as of November 2025).
  • Newtonsoft.Json 13.0.4 has reported regressions (SerializerSettings not respected in some scenarios). Test thoroughly before production deployment, or consider downgrading to 13.0.3 if issues occur.
  • Verify the effective dependency tree (e.g., dotnet list package --include-transitive) for any transitive Newtonsoft.Json < 13.0.1 pulled by Swashbuckle or other dependencies, and confirm swagger-ui subpackage version is ≥ 6.3.
🤖 Prompt for AI Agents 
In Directory.Packages.props around lines 7 to 27, update vulnerable/outdated
package versions: bump Microsoft.AspNetCore.Mvc.Testing from 8.0.20 to 8.0.21 or
later to address CVE-2025-55315, update Microsoft.NET.Test.Sdk from 17.14.1 to
18.0.1, and evaluate Newtonsoft.Json 13.0.4 for regressions—either test
thoroughly or pin to 13.0.3 if issues arise; after changes run a full transitive
check (dotnet list package --include-transitive) to ensure no transitive
Newtonsoft.Json < 13.0.1 is pulled and confirm any swagger-ui subpackage is >=
6.3, then update Directory.Packages.props accordingly and re-run tests.

Copy link
Collaborator Author

@JW-CH JW-CH Dec 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Will resolve this in another PR.

Copy link

@coderabbitai coderabbitai bot Dec 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@JW-CH, understood! Would you like me to create a follow-up issue to track the package updates (including the critical CVE-2025-55315 fix for Microsoft.AspNetCore.Mvc.Testing)?

</ItemGroup>
</Project>
23 changes: 7 additions & 16 deletions ImmichFrame.Core.Tests/ImmichFrame.Core.Tests.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,37 +1,28 @@
<Project Sdk="Microsoft.NET.Sdk">

<PropertyGroup>
<TargetFramework>net8.0</TargetFramework>
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>enable</Nullable>
<IsPackable>false</IsPackable>
<IsTestProject>true</IsTestProject>
</PropertyGroup>

<ItemGroup>
<PackageReference Include="Microsoft.Extensions.Logging.Console" Version="8.0.1" />
<PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
<PackageReference Include="NUnit" Version="4.4.0" />
<PackageReference Include="NUnit3TestAdapter" Version="5.2.0" />
<PackageReference Include="NUnit.Analyzers" Version="4.10.0">
<PackageReference Include="Microsoft.Extensions.Logging.Console" />
<PackageReference Include="Microsoft.NET.Test.Sdk" />
<PackageReference Include="NUnit" />
<PackageReference Include="NUnit3TestAdapter" />
<PackageReference Include="NUnit.Analyzers">
<PrivateAssets>all</PrivateAssets>
<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
</PackageReference>
<PackageReference Include="coverlet.collector" Version="6.0.4">
<PackageReference Include="coverlet.collector">
<PrivateAssets>all</PrivateAssets>
<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
</PackageReference>
<PackageReference Include="Moq" Version="4.20.72" />
<PackageReference Include="Moq" />
</ItemGroup>

<ItemGroup>
<ProjectReference Include="..\ImmichFrame.Core\ImmichFrame.Core.csproj" />
</ItemGroup>

<ItemGroup>
<Reference Include="Microsoft.Extensions.Logging">
<HintPath>..\..\..\.dotnet\shared\Microsoft.AspNetCore.App\8.0.0\Microsoft.Extensions.Logging.dll</HintPath>
</Reference>
</ItemGroup>

</Project>
22 changes: 10 additions & 12 deletions ImmichFrame.Core/ImmichFrame.Core.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,7 @@
<Project Sdk="Microsoft.NET.Sdk">
<Project Sdk="Microsoft.NET.Sdk">

<PropertyGroup>
<TargetFramework>net8.0</TargetFramework>
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>enable</Nullable>
</PropertyGroup>

<ItemGroup>
Expand All @@ -13,21 +11,21 @@
</ItemGroup>

<ItemGroup>
<PackageReference Include="BloomFilter.NetCore" Version="2.5.3" />
<PackageReference Include="Ical.Net" Version="4.3.1" />
<PackageReference Include="Microsoft.Extensions.ApiDescription.Client" Version="8.0.20">
<PackageReference Include="BloomFilter.NetCore" />
<PackageReference Include="Ical.Net" />
<PackageReference Include="Microsoft.Extensions.ApiDescription.Client">
<PrivateAssets>all</PrivateAssets>
<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
</PackageReference>
<PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="9.0.5" />
<PackageReference Include="Microsoft.Extensions.Http" Version="8.0.1" />
<PackageReference Include="Newtonsoft.Json" Version="13.0.4" />
<PackageReference Include="NSwag.ApiDescription.Client" Version="13.20.0">
<PackageReference Include="Microsoft.Extensions.Caching.Memory" />
<PackageReference Include="Microsoft.Extensions.Http" />
<PackageReference Include="Newtonsoft.Json" />
<PackageReference Include="NSwag.ApiDescription.Client">
<PrivateAssets>all</PrivateAssets>
<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
</PackageReference>
<PackageReference Include="OpenWeatherMap.API" Version="2.1.2" />
<PackageReference Include="ThumbHash" Version="2.1.1" />
<PackageReference Include="OpenWeatherMap.API" />
<PackageReference Include="ThumbHash" />
</ItemGroup>

</Project>
20 changes: 9 additions & 11 deletions ImmichFrame.WebApi.Tests/ImmichFrame.WebApi.Tests.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,25 +1,23 @@
<Project Sdk="Microsoft.NET.Sdk">
<Project Sdk="Microsoft.NET.Sdk">

<PropertyGroup>
<OutputType>Exe</OutputType>
<TargetFramework>net8.0</TargetFramework>
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>enable</Nullable>
<IsTestProject>true</IsTestProject>
</PropertyGroup>

<ItemGroup>
<PackageReference Include="AwesomeAssertions" Version="9.2.0" />
<PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="8.0.20" />
<PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
<PackageReference Include="Moq" Version="4.20.72" />
<PackageReference Include="NUnit" Version="4.4.0" />
<PackageReference Include="NUnit3TestAdapter" Version="5.2.0" />
<PackageReference Include="NUnit.Analyzers" Version="4.10.0">
<PackageReference Include="AwesomeAssertions" />
<PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" />
<PackageReference Include="Microsoft.NET.Test.Sdk" />
<PackageReference Include="Moq" />
<PackageReference Include="NUnit" />
<PackageReference Include="NUnit3TestAdapter" />
<PackageReference Include="NUnit.Analyzers">
<PrivateAssets>all</PrivateAssets>
<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
</PackageReference>
<PackageReference Include="coverlet.collector" Version="6.0.4">
<PackageReference Include="coverlet.collector">
<PrivateAssets>all</PrivateAssets>
<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
</PackageReference>
Expand Down
8 changes: 3 additions & 5 deletions ImmichFrame.WebApi/ImmichFrame.WebApi.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,6 @@
<Project Sdk="Microsoft.NET.Sdk.Web">

<PropertyGroup>
<TargetFramework>net8.0</TargetFramework>
<Nullable>enable</Nullable>
<ImplicitUsings>enable</ImplicitUsings>
<SpaRoot>..\immichFrame.Web</SpaRoot>
<SpaProxyLaunchCommand>npm run dev -- --host</SpaProxyLaunchCommand>
Expand All @@ -11,9 +9,9 @@
</PropertyGroup>

<ItemGroup>
<PackageReference Include="Swashbuckle.AspNetCore" Version="8.1.4" />
<PackageReference Include="Microsoft.AspNetCore.SpaProxy" Version="8.0.20" />
<PackageReference Include="YamlDotNet" Version="16.3.0" />
<PackageReference Include="Swashbuckle.AspNetCore" />
<PackageReference Include="Microsoft.AspNetCore.SpaProxy" />
<PackageReference Include="YamlDotNet" />
</ItemGroup>

<ItemGroup>
Expand Down
Loading