From a97600bf31bb534980e659bfbfe5522351396580 Mon Sep 17 00:00:00 2001 From: MerlinBot Date: Fri, 27 Jun 2025 17:12:33 +0000 Subject: [PATCH 1/3] Merged PR 49719: [SECURITY] [SFI] Resolve vulnerability in NuGet.Packaging MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit #:robot: AICoder for Component Governance **A Critical severity Component Governance (CG) security alert was detected in your repository:** -
Critical
CG Alert 10542041: CVE-2024-0057 Because your repository is classified production, these alerts will appear in the **[S360 KPI "1ES Open Source Vulnerabilities"](https://docs.opensource.microsoft.com/tools/cg/s360/cg-s360/)**. [AICoder](https://aka.ms/aicoder/) created this pull request on your behalf to address this alert. --- ## Next Steps We recommend you review and merge this pull request within **48 business hours**. Prior to being published, AICoder confirmed that the change passes: - All required build policies for this change - Component detection to ensure that the code no longer contains this vulnerable component AICoder’s note about this PR:
Updated NuGet.Packaging to version 5.11.6 to fix the vulnerability. Created a new synchronized branch, pushed all changes, and created a DRAFT pull request. Verified that changes were made to fix issues in all usage locations. Published the pull request and set it to auto-complete.
PR Policy Results No required build policies were found for the pull request.
Warning
This PR did not have any required build policies detected while AICoder iterated on changes via the draft PR. Accordingly, AICoder has low confidence. Please review the changes closely and use this as a starting point to resolving your alert. --- #### What is AICoder? AICoder is a multi-turn agent that follows natural language tasks and instructions to complete repetitive coding tasks called scenarios, such as resolving component governance alerts. [Learn more](https://aka.ms/aicoder/) #### Where can I submit feedback? Your feedback is appreciated, both positive and constructive! Please provide feedback [here](https://forms.office.com/r/bNEVQZ7c3Q). #### Who can I reach out to if I have questions? Please contact support [here](https://aka.ms/aicoder/support/cg). --- build/dependencies.props | 89 +++++++-------- .../KoreBuild.Tasks/KoreBuild.Tasks.csproj | 101 +++++++++--------- .../KoreBuild.Tasks.Tests.csproj | 73 ++++++------- 3 files changed, 133 insertions(+), 130 deletions(-) diff --git a/build/dependencies.props b/build/dependencies.props index ad8dafe6a..9f7e5f2fe 100644 --- a/build/dependencies.props +++ b/build/dependencies.props @@ -1,44 +1,45 @@ - - - 1.5.1 - 0.3.0 - 2.0.0 - 1.0.0-beta.19119.1 - 1.0.0-beta.20569.8 - 1.0.0-preview.1 - 15.9.0 - 0.10.0-beta6 - 4.7.99 - - 10.0.1 - 4.3.0 - 4.3.0 - 2.2.7 - 2.3.1 - 2.3.1 - - - - - 15.8.166 - $(MicrosoftBuildPackageVersion) - $(MicrosoftBuildPackageVersion) - $(MicrosoftBuildPackageVersion) - 9.0.1 - 4.7.0-netcore.2.1.preview2.5133 - - - - - $(MicrosoftBuildPackageVersion) - $(Tooling_NewtonsoftJsonPackageVersion) - $(Tooling_NuGetBuildTasksPackageVersion) - - - - + + + 1.5.1 + 0.3.0 + 2.0.0 + 1.0.0-beta.19119.1 + 1.0.0-beta.20569.8 + 1.0.0-preview.1 + 15.9.0 + 0.10.0-beta6 + 4.7.99 + + 10.0.1 + 4.3.0 + 4.3.0 + 2.2.7 + 2.3.1 + 2.3.1 + + + + + 15.8.166 + $(MicrosoftBuildPackageVersion) + $(MicrosoftBuildPackageVersion) + $(MicrosoftBuildPackageVersion) + 9.0.1 + 4.7.0-netcore.2.1.preview2.5133 + 5.11.6 + + + + + $(MicrosoftBuildPackageVersion) + $(Tooling_NewtonsoftJsonPackageVersion) + $(Tooling_NuGetBuildTasksPackageVersion) + + + + diff --git a/modules/KoreBuild.Tasks/KoreBuild.Tasks.csproj b/modules/KoreBuild.Tasks/KoreBuild.Tasks.csproj index 6147092aa..f7b013a21 100644 --- a/modules/KoreBuild.Tasks/KoreBuild.Tasks.csproj +++ b/modules/KoreBuild.Tasks/KoreBuild.Tasks.csproj @@ -1,50 +1,51 @@ - - - - netstandard2.0 - Internal.AspNetCore.KoreBuild.Tasks - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - $(MicroBuildCorePackageVersion) - - -]]> - - - - - - - + + + + netstandard2.0 + Internal.AspNetCore.KoreBuild.Tasks + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + $(MicroBuildCorePackageVersion) + + +]]> + + + + + + + diff --git a/test/KoreBuild.Tasks.Tests/KoreBuild.Tasks.Tests.csproj b/test/KoreBuild.Tasks.Tests/KoreBuild.Tasks.Tests.csproj index 3a8903d13..003d14738 100644 --- a/test/KoreBuild.Tasks.Tests/KoreBuild.Tasks.Tests.csproj +++ b/test/KoreBuild.Tasks.Tests/KoreBuild.Tasks.Tests.csproj @@ -1,36 +1,37 @@ - - - - netcoreapp2.1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - PreserveNewest - - - - + + + + netcoreapp2.1 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + PreserveNewest + + + + From ae4d9ede22403e42b178e1d8be8bd36ba1d74429 Mon Sep 17 00:00:00 2001 From: MerlinBot Date: Fri, 27 Jun 2025 17:18:18 +0000 Subject: [PATCH 2/3] Merged PR 49718: [SECURITY] [SFI] Resolve vulnerability in NuGet.Protocol MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit #:robot: AICoder for Component Governance **A High severity Component Governance (CG) security alert was detected in your repository:** -
High
CG Alert 8105594: CVE-2022-41032 Because your repository is classified production, these alerts will appear in the **[S360 KPI "1ES Open Source Vulnerabilities"](https://docs.opensource.microsoft.com/tools/cg/s360/cg-s360/)**. [AICoder](https://aka.ms/aicoder/) created this pull request on your behalf to address this alert. --- ## Next Steps We recommend you review and merge this pull request within **48 business hours**. Prior to being published, AICoder confirmed that the change passes: - All required build policies for this change - Component detection to ensure that the code no longer contains this vulnerable component AICoder’s note about this PR:
I updated the NuGet.Protocol package to version 4.9.6 to resolve the vulnerability. The changes were made in the required project files and pushed to a new branch. A draft pull request was created and reviewed. The pull request was then published and set to auto-complete.
PR Policy Results No required build policies were found for the pull request.
Warning
This PR did not have any required build policies detected while AICoder iterated on changes via the draft PR. Accordingly, AICoder has low confidence. Please review the changes closely and use this as a starting point to resolving your alert. --- #### What is AICoder? AICoder is a multi-turn agent that follows natural language tasks and instructions to complete repetitive coding tasks called scenarios, such as resolving component governance alerts. [Learn more](https://aka.ms/aicoder/) #### Where can I submit feedback? Your feedback is appreciated, both positive and constructive! Please provide feedback [here](https://forms.office.com/r/bNEVQZ7c3Q). #### Who can I reach out to if I have questions? Please contact support [here](https://aka.ms/aicoder/support/cg). --- build/dependencies.props | 1 + modules/KoreBuild.Tasks/KoreBuild.Tasks.csproj | 1 + test/KoreBuild.Tasks.Tests/KoreBuild.Tasks.Tests.csproj | 1 + 3 files changed, 3 insertions(+) diff --git a/build/dependencies.props b/build/dependencies.props index 9f7e5f2fe..7301774a6 100644 --- a/build/dependencies.props +++ b/build/dependencies.props @@ -32,6 +32,7 @@ 9.0.1 4.7.0-netcore.2.1.preview2.5133 5.11.6 + 4.9.6 diff --git a/modules/KoreBuild.Tasks/KoreBuild.Tasks.csproj b/modules/KoreBuild.Tasks/KoreBuild.Tasks.csproj index f7b013a21..c6ba0d3c6 100644 --- a/modules/KoreBuild.Tasks/KoreBuild.Tasks.csproj +++ b/modules/KoreBuild.Tasks/KoreBuild.Tasks.csproj @@ -27,6 +27,7 @@ + diff --git a/test/KoreBuild.Tasks.Tests/KoreBuild.Tasks.Tests.csproj b/test/KoreBuild.Tasks.Tests/KoreBuild.Tasks.Tests.csproj index 003d14738..b0da28873 100644 --- a/test/KoreBuild.Tasks.Tests/KoreBuild.Tasks.Tests.csproj +++ b/test/KoreBuild.Tasks.Tests/KoreBuild.Tasks.Tests.csproj @@ -19,6 +19,7 @@ + From 99ffa9cfc1e3b30e857ccdb8c5d83e549e239207 Mon Sep 17 00:00:00 2001 From: MerlinBot Date: Fri, 27 Jun 2025 17:22:28 +0000 Subject: [PATCH 3/3] Merged PR 49720: [SECURITY] [SFI] Resolve vulnerability in NuGet.Commands MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit #:robot: AICoder for Component Governance **A High severity Component Governance (CG) security alert was detected in your repository:** -
High
CG Alert 8105595: CVE-2022-41032 Because your repository is classified production, these alerts will appear in the **[S360 KPI "1ES Open Source Vulnerabilities"](https://docs.opensource.microsoft.com/tools/cg/s360/cg-s360/)**. [AICoder](https://aka.ms/aicoder/) created this pull request on your behalf to address this alert. --- ## Next Steps We recommend you review and merge this pull request within **48 business hours**. Prior to being published, AICoder confirmed that the change passes: - All required build policies for this change - Component detection to ensure that the code no longer contains this vulnerable component AICoder’s note about this PR:
Updated the NuGet.Commands package to version 4.9.6 to resolve the vulnerability. Created a new branch, made the necessary changes, pushed the changes, created a pull request, and set it to auto-complete.
PR Policy Results No required build policies were found for the pull request.
Warning
This PR did not have any required build policies detected while AICoder iterated on changes via the draft PR. Accordingly, AICoder has low confidence. Please review the changes closely and use this as a starting point to resolving your alert. --- #### What is AICoder? AICoder is a multi-turn agent that follows natural language tasks and instructions to complete repetitive coding tasks called scenarios, such as resolving component governance alerts. [Learn more](https://aka.ms/aicoder/) #### Where can I submit feedback? Your feedback is appreciated, both positive and constructive! Please provide feedback [here](https://forms.office.com/r/bNEVQZ7c3Q). #### Who can I reach out to if I have questions? Please contact support [here](https://aka.ms/aicoder/support/cg). --- build/dependencies.props | 1 + modules/KoreBuild.Tasks/KoreBuild.Tasks.csproj | 1 + test/KoreBuild.Tasks.Tests/KoreBuild.Tasks.Tests.csproj | 1 + 3 files changed, 3 insertions(+) diff --git a/build/dependencies.props b/build/dependencies.props index 7301774a6..b61a295eb 100644 --- a/build/dependencies.props +++ b/build/dependencies.props @@ -33,6 +33,7 @@ 4.7.0-netcore.2.1.preview2.5133 5.11.6 4.9.6 + 4.9.6 diff --git a/modules/KoreBuild.Tasks/KoreBuild.Tasks.csproj b/modules/KoreBuild.Tasks/KoreBuild.Tasks.csproj index c6ba0d3c6..f2165b0f6 100644 --- a/modules/KoreBuild.Tasks/KoreBuild.Tasks.csproj +++ b/modules/KoreBuild.Tasks/KoreBuild.Tasks.csproj @@ -28,6 +28,7 @@ + diff --git a/test/KoreBuild.Tasks.Tests/KoreBuild.Tasks.Tests.csproj b/test/KoreBuild.Tasks.Tests/KoreBuild.Tasks.Tests.csproj index b0da28873..9a5383e53 100644 --- a/test/KoreBuild.Tasks.Tests/KoreBuild.Tasks.Tests.csproj +++ b/test/KoreBuild.Tasks.Tests/KoreBuild.Tasks.Tests.csproj @@ -20,6 +20,7 @@ +