Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove System.Runtime.Loader dependency on netstandard #8065

Merged
merged 4 commits into from
Jun 10, 2024

Conversation

ViktorHofer
Copy link
Member

@ViktorHofer ViktorHofer commented Jun 9, 2024

Important: This needs my other PRs in this repo to be merged first.

Fixes #8061

Avoid .NET Standard 1.x dependencies in the repo
completely. This results in this repo not being
affected by CVEs / vulnerable packages like
System.Private.Uri that are part of the .NET
Standard 1.x dependency graph.

Upgrade projects that use "System.Runtime.Loader"
from netstandard2.0 to .NETCoreApp as that API is
only availble on .NETCoreApp but keep the
netstandard2.0 TFM. The Loader package that was
used hasn't shipped for years anymore and was
never intended to be used on .NET Standard
(support for it was later removed)
Because of that, new nullable reference type
errors were raised by the compiler which I
suppressed temporarily by downgrading the
Nullable property to "annotations".

Fixes #8061

Avoid .NET Standard 1.x dependencies in the repo
completely. This results in this repo not being
affected by CVEs / vulnerable packages like
System.Private.Uri that are part of the .NET
Standard 1.x dependency graph.

Upgrade projects that use "System.Runtime.Loader"
from netstandard2.0 to .NETCoreApp as that API is
only availble on .NETCoreApp but keep the
netstandard2.0 TFM. The Loader package that was
used hasn't shipped for years anymore and was
never intended to be used on .NET Standard
(support for it was later removed)
 Because of that, new nullable reference type
 errors were raised by the compiler which I
 suppressed temporarily by downgrading the
 Nullable property to "annotations".
@ViktorHofer ViktorHofer requested a review from a team as a code owner June 9, 2024 16:59
@ViktorHofer ViktorHofer enabled auto-merge (squash) June 10, 2024 11:13
@ViktorHofer ViktorHofer merged commit aaba668 into main Jun 10, 2024
10 checks passed
@ViktorHofer ViktorHofer deleted the RemoveSystemRuntimeLoaderDependencyFromNetStandard branch June 10, 2024 11:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Microsoft.TemplateEngine.Edge transitively references System.Runtime.Loader/4.3.0 on netstandard2.0
2 participants