address several Checkmarx advisory upgrades and ensure compiler does …

…not emit CVE warnings
elastic · Oct 22, 2024 · 7399604 · 7399604
1 parent 3b7a967
commit 7399604
Show file tree

Hide file tree

Showing 9 changed files with 26 additions and 21 deletions.
diff --git a/Directory.Packages.props b/Directory.Packages.props
@@ -5,7 +5,7 @@
 
   <ItemGroup>
     <GlobalPackageReference Include="MinVer" Version="4.3.0" PrivateAssets="All" />
-    <GlobalPackageReference Include="Microsoft.NETFramework.ReferenceAssemblies.net462" Version="1.0.3" PrivateAssets="all"/>
+    <GlobalPackageReference Condition="'$(TargetFramework)' == 'net462'" Include="Microsoft.NETFramework.ReferenceAssemblies.net462" Version="1.0.3" PrivateAssets="all"/>
   </ItemGroup>
   <!-- Community Packages -->
   <ItemGroup>
@@ -86,16 +86,17 @@
 
   <!-- Microsoft/System packages -->
   <ItemGroup>
-    <PackageVersion Include="Microsoft.AspNetCore.Hosting.Abstractions" Version="2.1.0" />
-    <PackageVersion Include="Microsoft.AspNetCore.Http" Version="2.1.22" />
-    <PackageVersion Include="Microsoft.AspNetCore.Http.Abstractions" Version="2.1.1" />
-    <PackageVersion Include="Microsoft.AspNetCore.Http.Extensions" Version="2.1.21" />
+    <PackageVersion Include="Microsoft.AspNetCore.Hosting.Abstractions" Version="2.2.0" />
+    <PackageVersion Include="Microsoft.AspNetCore.Http" Version="2.2.2" />
+    <PackageVersion Include="Microsoft.AspNetCore.Http.Abstractions" Version="2.2.0" />
+    <PackageVersion Include="Microsoft.AspNetCore.Http.Extensions" Version="2.2.0" />
+    <PackageVersion Include="Microsoft.AspNetCore.Routing.Abstractions" Version="2.2.0" />
+
     <PackageVersion Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore" Version="8.0.2" />
     <PackageVersion Include="Microsoft.AspNetCore.Identity.UI" Version="8.0.2" />
     <PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="8.0.2" />
-    <PackageVersion Include="Microsoft.AspNetCore.Routing.Abstractions" Version="2.1.0" />
     <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="8.0.2" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="2.1.0" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="2.2.0" />
     <PackageVersion Include="Microsoft.Extensions.DependencyInjection " Version="6.0.0" />
     <PackageVersion Include="Microsoft.Extensions.Hosting" Version="8.0.0" />
     <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="8.0.0" />
@@ -110,7 +111,7 @@
     <PackageVersion Include="System.Threading.Tasks.Extensions" Version="4.5.4" />
 
     <PackageVersion Include="Microsoft.AspNet.Identity.EntityFramework" Version="2.2.3" />
-    <PackageVersion Include="Microsoft.AspNet.Identity.Owin" Version="2.2.3" />
+    <PackageVersion Include="Microsoft.AspNet.Identity.Owin" Version="2.2.4" />
     <PackageVersion Include="Microsoft.AspNet.Mvc" Version="5.2.4" />
     <PackageVersion Include="Microsoft.AspNet.TelemetryCorrelation" Version="1.0.7" />
     <PackageVersion Include="Microsoft.AspNet.Web.Optimization" Version="1.1.3" />

diff --git a/sample/Elastic.Apm.Azure.ServiceBus.Sample/Elastic.Apm.Azure.ServiceBus.Sample.csproj b/sample/Elastic.Apm.Azure.ServiceBus.Sample/Elastic.Apm.Azure.ServiceBus.Sample.csproj
@@ -8,6 +8,7 @@
   <ItemGroup>
     <PackageReference Include="Azure.Messaging.ServiceBus"/>
     <PackageReference Include="Microsoft.Azure.ServiceBus"/>
+    <PackageReference Include="Newtonsoft.Json"/>
   </ItemGroup>
 
   <ItemGroup>

diff --git a/src/Elastic.Apm.Specification/Elastic.Apm.Specification.csproj b/src/Elastic.Apm.Specification/Elastic.Apm.Specification.csproj
@@ -8,6 +8,7 @@
     <ItemGroup>
       <PackageReference Include="NJsonSchema"/>
       <PackageReference Include="SharpZipLib"/>
+      <PackageReference Include="Newtonsoft.Json"/>
     </ItemGroup>
 
     <ItemGroup>

diff --git a/src/integrations/Elastic.Apm.AspNetCore/Elastic.Apm.AspNetCore.csproj b/src/integrations/Elastic.Apm.AspNetCore/Elastic.Apm.AspNetCore.csproj
@@ -22,7 +22,7 @@
     <PackageReference Include="Microsoft.AspNetCore.Hosting.Abstractions" />
     <PackageReference Include="Microsoft.Extensions.Configuration.Abstractions" />
     <PackageReference Include="Microsoft.AspNetCore.Routing.Abstractions" />
-    <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" VersionOverride="2.1.0" />
+    <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" VersionOverride="2.2.0" />
   </ItemGroup>
   <ItemGroup Condition=" '$(TargetFramework)' == 'net6.0' ">
     <FrameworkReference Include="Microsoft.AspNetCore.App" />

diff --git a/src/integrations/Elastic.Apm.Extensions.Hosting/Elastic.Apm.Extensions.Hosting.csproj b/src/integrations/Elastic.Apm.Extensions.Hosting/Elastic.Apm.Extensions.Hosting.csproj
@@ -23,10 +23,10 @@
   </ItemGroup>
 
   <ItemGroup Condition=" '$(TargetFramework)' == 'netstandard2.0' ">
-    <PackageReference Include="Microsoft.Extensions.Hosting.Abstractions" VersionOverride="2.1.0" />
-    <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" VersionOverride="2.1.0" />
-    <PackageReference Include="Microsoft.Extensions.DependencyInjection " VersionOverride="2.1.0" />
-    <PackageReference Include="Microsoft.Extensions.Logging.Configuration" VersionOverride="2.1.0" PrivateAssets="All" />
+    <PackageReference Include="Microsoft.Extensions.Hosting.Abstractions" VersionOverride="2.2.0" />
+    <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" VersionOverride="2.2.0" />
+    <PackageReference Include="Microsoft.Extensions.DependencyInjection" VersionOverride="2.2.0" />
+    <PackageReference Include="Microsoft.Extensions.Logging.Configuration" VersionOverride="2.2.0" PrivateAssets="All" />
   </ItemGroup>
 
   <ItemGroup Condition=" '$(TargetFramework)' == 'net6.0' ">

diff --git a/test/instrumentations/grpc/GrpcClientSample/GrpcClientSample.csproj b/test/instrumentations/grpc/GrpcClientSample/GrpcClientSample.csproj
@@ -2,7 +2,7 @@
 
   <PropertyGroup>
     <OutputType>Exe</OutputType>
-    <TargetFramework>netcoreapp3.1</TargetFramework>
+    <TargetFramework>net8.0</TargetFramework>
   </PropertyGroup>
 
   <ItemGroup>

diff --git a/test/instrumentations/grpc/GrpcServiceSample/GrpcServiceSample.csproj b/test/instrumentations/grpc/GrpcServiceSample/GrpcServiceSample.csproj
@@ -1,15 +1,15 @@
 <Project Sdk="Microsoft.NET.Sdk.Web">
 
   <PropertyGroup>
-    <TargetFramework>netcoreapp3.1</TargetFramework>
+    <TargetFramework>net8.0</TargetFramework>
   </PropertyGroup>
 
   <ItemGroup>
     <Protobuf Include="Protos\greet.proto" GrpcServices="Server" />
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Grpc.AspNetCore"" />
+    <PackageReference Include="Grpc.AspNetCore" />
   </ItemGroup>
 
   <ItemGroup>

diff --git a/test/profiler/Elastic.Apm.Profiler.Managed.Tests/AdoNet/NpgSqlCommandTests.cs b/test/profiler/Elastic.Apm.Profiler.Managed.Tests/AdoNet/NpgSqlCommandTests.cs
@@ -32,19 +32,21 @@ public static IEnumerable<object[]> TestParameters
 		{
 			get
 			{
+				//TODO test version 8.x
+
 				// use the version defined in NpgsqlSample
-				var npgSqlVersion = "5.0.7";
+				var npgSqlVersion = "5.0.18";
 
 				// TODO: Add x64/x86 options. macOS and Linux do not support x86
 				yield return new object[] { "net8.0", npgSqlVersion };
 
 				if (TestEnvironment.IsWindows)
 					yield return new object[] { "net462", npgSqlVersion };
 
-				npgSqlVersion = "6.0.2";
+				npgSqlVersion = "6.0.12";
 				yield return new object[] { "net8.0", npgSqlVersion };
 
-				npgSqlVersion = "7.0.2";
+				npgSqlVersion = "7.0.8";
 				yield return new object[] { "net8.0", npgSqlVersion };
 			}
 		}

diff --git a/test/profiler/applications/NpgsqlSample/NpgsqlSample.csproj b/test/profiler/applications/NpgsqlSample/NpgsqlSample.csproj
@@ -1,13 +1,13 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
     <PropertyGroup>
-        <NpgsqlVersion Condition="'$(NpgsqlVersion)'==''">5.0.7</NpgsqlVersion>
+        <NpgsqlVersion Condition="'$(NpgsqlVersion)'==''">5.0.18</NpgsqlVersion>
         <OutputType>Exe</OutputType>
         <TargetFrameworks>net462;net6.0;net8.0</TargetFrameworks>
     </PropertyGroup>
 
     <ItemGroup>
-      <PackageReference Include="Npgsql" VersionOverride="$(NpgsqlVersion)" />
+      <PackageReference Include="Npgsql" VersionOverride="5.0.18" />
     </ItemGroup>
 
     <ItemGroup>