From 585983807f72cb05c2626e7ac35a3349b7a77400 Mon Sep 17 00:00:00 2001
From: plave0 <40834140+plave0@users.noreply.github.com>
Date: Fri, 11 Oct 2024 11:10:34 +0200
Subject: [PATCH] Updating versions of transitive dependencies (#392)

Updating versions of transitive dependencies to their latest stable versions. Updating relevant comments.

Internal ADO work item:
https://dev.azure.com/msazure/One/_workitems/edit/29603592
---
 properties/service_fabric_common.props                |  2 +-
 ...osoft.ServiceFabric.Actors.KVSToRCMigration.csproj | 11 ++++++++---
 ...eFabric.Actors.KVSToRCMigration_netstandard.csproj | 11 ++++++++---
 ...t.ServiceFabric.Actors.StateMigration.Tests.csproj |  6 +++++-
 4 files changed, 22 insertions(+), 8 deletions(-)

diff --git a/properties/service_fabric_common.props b/properties/service_fabric_common.props
index 2ed11810..cf8a4b92 100644
--- a/properties/service_fabric_common.props
+++ b/properties/service_fabric_common.props
@@ -31,7 +31,7 @@
     <!-- TODO: Versions numbers are changed here manually for now, Integrate this with GitVersion. -->
     <MajorVersion>8</MajorVersion>
     <MinorVersion>0</MinorVersion>
-    <BuildVersion>8</BuildVersion>
+    <BuildVersion>9</BuildVersion>
     <Revision>0</Revision>
 
   </PropertyGroup>
diff --git a/src/Microsoft.ServiceFabric.Actors.KVSToRCMigration/Microsoft.ServiceFabric.Actors.KVSToRCMigration.csproj b/src/Microsoft.ServiceFabric.Actors.KVSToRCMigration/Microsoft.ServiceFabric.Actors.KVSToRCMigration.csproj
index a83c69f2..fcea9adc 100644
--- a/src/Microsoft.ServiceFabric.Actors.KVSToRCMigration/Microsoft.ServiceFabric.Actors.KVSToRCMigration.csproj
+++ b/src/Microsoft.ServiceFabric.Actors.KVSToRCMigration/Microsoft.ServiceFabric.Actors.KVSToRCMigration.csproj
@@ -29,9 +29,14 @@
   </ItemGroup>
   <ItemGroup>
     <!-- Overriding versions of transitive dependencies -->
-    <PackageReference Include="Newtonsoft.Json" Version="13.0.1" />
-    <PackageReference Include="System.Security.Cryptography.Xml" Version="4.7.1" />
-    <PackageReference Include="System.Text.Encodings.Web" Version="4.5.1" />
+    <!-- 
+      Some versions of transitive dependencies have to be overwritten, since the default versions
+      defined by the direct dependencies are marked as vulnerable packages on nuget.org.
+    -->
+    <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
+    <PackageReference Include="System.Security.Cryptography.Xml" Version="8.0.1" />
+    <PackageReference Include="System.Text.Encodings.Web" Version="8.0.0" />
+    <PackageReference Include="System.Formats.Asn1" Version="8.0.1" />
   </ItemGroup>
   <ItemGroup>
     <Reference Include="System.ComponentModel.DataAnnotations" />
diff --git a/src/netstandard/Microsoft.ServiceFabric.Actors.KVSToRCMigration/Microsoft.ServiceFabric.Actors.KVSToRCMigration_netstandard.csproj b/src/netstandard/Microsoft.ServiceFabric.Actors.KVSToRCMigration/Microsoft.ServiceFabric.Actors.KVSToRCMigration_netstandard.csproj
index df643ad2..f048417e 100644
--- a/src/netstandard/Microsoft.ServiceFabric.Actors.KVSToRCMigration/Microsoft.ServiceFabric.Actors.KVSToRCMigration_netstandard.csproj
+++ b/src/netstandard/Microsoft.ServiceFabric.Actors.KVSToRCMigration/Microsoft.ServiceFabric.Actors.KVSToRCMigration_netstandard.csproj
@@ -35,9 +35,14 @@
   </ItemGroup>
   <ItemGroup>
     <!-- Overriding versions of transitive dependencies -->
-    <PackageReference Include="Newtonsoft.Json" Version="13.0.1" />
-    <PackageReference Include="System.Security.Cryptography.Xml" Version="4.7.1" />
-    <PackageReference Include="System.Text.Encodings.Web" Version="4.5.1" />
+    <!-- 
+      Some versions of transitive dependencies have to be overwritten, since the default versions
+      defined by the direct dependencies are marked as vulnerable packages on nuget.org.
+    -->
+    <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
+    <PackageReference Include="System.Security.Cryptography.Xml" Version="8.0.1" />
+    <PackageReference Include="System.Text.Encodings.Web" Version="8.0.0" />
     <PackageReference Include="System.Text.RegularExpressions" Version="4.3.1" />
+    <PackageReference Include="System.Formats.Asn1" Version="8.0.1" />
   </ItemGroup>
 </Project>
\ No newline at end of file
diff --git a/test/unittests/Microsoft.ServiceFabric.Actors.StateMigration.Tests/Microsoft.ServiceFabric.Actors.StateMigration.Tests.csproj b/test/unittests/Microsoft.ServiceFabric.Actors.StateMigration.Tests/Microsoft.ServiceFabric.Actors.StateMigration.Tests.csproj
index 08916bd9..44727204 100644
--- a/test/unittests/Microsoft.ServiceFabric.Actors.StateMigration.Tests/Microsoft.ServiceFabric.Actors.StateMigration.Tests.csproj
+++ b/test/unittests/Microsoft.ServiceFabric.Actors.StateMigration.Tests/Microsoft.ServiceFabric.Actors.StateMigration.Tests.csproj
@@ -25,6 +25,10 @@
   </ItemGroup>
   <ItemGroup>
     <!-- Overriding versions of transitive dependencies -->
-    <PackageReference Include="System.Drawing.Common" Version="4.7.2" />
+    <!-- 
+      Some versions of transitive dependencies have to be overwritten, since the default versions
+      defined by the direct dependencies are marked as vulnerable packages on nuget.org.
+    -->
+    <PackageReference Include="System.Drawing.Common" Version="8.0.8" />
   </ItemGroup>
 </Project>