Umbraco-CMS/Directory.Packages.props at main · legacy-git/Umbraco-CMS · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
<?xml version="1.0" encoding="utf-8"?>
<Project>
  <PropertyGroup>
    <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
    <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
  </PropertyGroup>
  <!-- Global packages (private, build-time packages for all projects) -->
  <ItemGroup>
    <GlobalPackageReference Include="Nerdbank.GitVersioning" Version="3.10.85" />
    <GlobalPackageReference Include="StyleCop.Analyzers" Version="1.2.0-beta.556" />
    <!-- TODO (V18): Bump Umbraco.Code to 3.0.0 stable before release of 18.0.0 -->
    <GlobalPackageReference Include="Umbraco.Code" Version="3.0.0-beta" />
    <GlobalPackageReference Include="Umbraco.GitVersioning.Extensions" Version="0.2.0" />
  </ItemGroup>
  <!-- Microsoft packages -->
  <ItemGroup>
    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation" Version="10.0.9" />
    <!-- When updating this version, also update templates/UmbracoExtension/Umbraco.Extension.csproj -->
    <PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.9" />
    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="5.3.0" />
    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="5.3.0" />
    <PackageVersion Include="Microsoft.Data.Sqlite" Version="10.0.9" />
    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.9" />
    <PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.9" />
    <PackageVersion Include="Microsoft.Extensions.Caching.Abstractions" Version="10.0.9" />
    <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="10.0.9" />
    <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.9" />
    <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="10.0.9" />
    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.9" />
    <PackageVersion Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.9" />
    <PackageVersion Include="Microsoft.Extensions.FileProviders.Physical" Version="10.0.9" />
    <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.9" />
    <PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.9" />
    <PackageVersion Include="Microsoft.Extensions.Identity.Core" Version="10.0.9" />
    <PackageVersion Include="Microsoft.Extensions.Identity.Stores" Version="10.0.9" />
    <PackageVersion Include="Microsoft.Extensions.Logging" Version="10.0.9" />
    <PackageVersion Include="Microsoft.Extensions.Options" Version="10.0.9" />
    <PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="10.0.9" />
    <PackageVersion Include="Microsoft.Extensions.Options.DataAnnotations" Version="10.0.9" />
    <PackageVersion Include="Microsoft.Extensions.Caching.Hybrid" Version="10.7.0" />
    <PackageVersion Include="System.Linq.Async" Version="7.0.1" />
  </ItemGroup>
  <!-- Umbraco packages -->
  <ItemGroup>
    <PackageVersion Include="Umbraco.JsonSchema.Extensions" Version="0.4.3" />
  </ItemGroup>
  <!-- Third-party packages -->
  <ItemGroup>
    <PackageVersion Include="Asp.Versioning.Mvc" Version="10.0.0" />
    <PackageVersion Include="Asp.Versioning.Mvc.ApiExplorer" Version="10.0.0" />
    <PackageVersion Include="BitFaster.Caching" Version="2.6.0" />
    <PackageVersion Include="Dazinator.Extensions.FileProviders" Version="2.0.0" />
    <PackageVersion Include="Examine" Version="3.9.0" />
    <PackageVersion Include="Examine.Core" Version="3.9.0" />
    <PackageVersion Include="HtmlAgilityPack" Version="1.12.4" />
    <PackageVersion Include="JsonPatch.Net" Version="3.3.0" />
    <PackageVersion Include="K4os.Compression.LZ4" Version="1.3.8" />
    <PackageVersion Include="MailKit" Version="4.17.0" />
    <PackageVersion Include="Markdig" Version="1.3.2" />
    <PackageVersion Include="Markdown" Version="2.2.1" />
    <PackageVersion Include="MessagePack" Version="3.1.7" />
    <PackageVersion Include="MiniProfiler.AspNetCore.Mvc" Version="4.5.4" />
    <PackageVersion Include="MiniProfiler.Shared" Version="4.5.4" />
    <PackageVersion Include="ncrontab" Version="3.4.0" />
    <PackageVersion Include="NPoco" Version="6.2.0" />
    <PackageVersion Include="NPoco.SqlServer" Version="6.2.0" />
    <PackageVersion Include="OpenIddict.Abstractions" Version="7.5.0" />
    <PackageVersion Include="OpenIddict.AspNetCore" Version="7.5.0" />
    <PackageVersion Include="OpenIddict.EntityFrameworkCore" Version="7.5.0" />
    <PackageVersion Include="Serilog" Version="4.3.1" />
    <PackageVersion Include="Serilog.AspNetCore" Version="10.0.0" />
    <PackageVersion Include="Serilog.Enrichers.Process" Version="3.0.0" />
    <PackageVersion Include="Serilog.Enrichers.Thread" Version="4.0.0" />
    <PackageVersion Include="Serilog.Expressions" Version="5.0.0" />
    <PackageVersion Include="Serilog.Extensions.Hosting" Version="10.0.0" />
    <PackageVersion Include="Serilog.Formatting.Compact" Version="3.0.0" />
    <PackageVersion Include="Serilog.Formatting.Compact.Reader" Version="4.0.0" />
    <PackageVersion Include="Serilog.Settings.Configuration" Version="10.0.1" />
    <PackageVersion Include="Serilog.Sinks.Async" Version="2.1.0" />
    <PackageVersion Include="Serilog.Sinks.File" Version="7.0.0" />
    <PackageVersion Include="Serilog.Sinks.Map" Version="2.0.0" />
    <PackageVersion Include="SixLabors.ImageSharp" Version="3.1.12" />
    <PackageVersion Include="SixLabors.ImageSharp.Web" Version="3.2.0" />
    <PackageVersion Include="Swashbuckle.AspNetCore.SwaggerUI" Version="10.2.3" />
  </ItemGroup>
  <!-- Transitive pinned versions (only required because our direct dependencies have vulnerable versions of transitive dependencies) -->
  <ItemGroup>
    <!-- Dazinator.Extensions.FileProviders references vulnerable versions of the following: -->
    <!-- TODO (V18): Remove these pinned dependencies when the Dazinator.Extensions.FileProviders dependency is removed. -->
    <PackageVersion Include="System.Net.Http" Version="4.3.4" />
    <PackageVersion Include="System.Private.Uri" Version="4.3.2" />
    <!-- Markdown references vulnerable version of the following: -->
    <!-- TODO (V19): Remove these pinned dependencies when the Markdown dependency is removed. -->
    <PackageVersion Include="System.Text.RegularExpressions" Version="4.3.1" />
    <!--
      Examine (via Microsoft.AspNetCore.DataProtection) and OpenIddict's *.DataProtection packages otherwise
      resolve System.Security.Cryptography.Xml down to a vulnerable 8.0.0 (GHSA-37gx-xxp4-5rgx, GHSA-w3x6-4m5h-cxqf).
      Pin it forward until both of those dependencies reference a fixed version.
    -->
    <PackageVersion Include="System.Security.Cryptography.Xml" Version="10.0.9" />
    <!--
      Microsoft.AspNetCore.OpenApi and Swashbuckle only require Microsoft.OpenApi >= 2.0.0, which otherwise
      resolves to a vulnerable 2.0.0 (CVE-2026-49451, GHSA-v5pm-xwqc-g5wc). Pin forward to a patched 2.x
      until the referencing packages raise their floor.
    -->
    <PackageVersion Include="Microsoft.OpenApi" Version="2.9.0" />
  </ItemGroup>
</Project>