Skip to content

fix: remove Scriban 6.2.0 NuGet audit suppressions #403

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
credfeto merged 2 commits into from
Sep 3, 2026
Merged

fix: remove Scriban 6.2.0 NuGet audit suppressions #403

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3dacf1b
fix: add missing IncludeAssets to NuGet package references
credfeto Sep 3, 2026
aa86bdd
fix: remove Scriban 6.2.0 NuGet audit suppressions
credfeto Sep 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,13 +19,13 @@ Please ADD ALL Changes to the UNRELEASED SECTION and not a specific release
- BuildBot.Discord.Tests: Added unit tests to increase code coverage to 100%
- BotService null-guard branch coverage test
### Fixed
- Suppress known Scriban 6.2.0 vulnerabilities pending upgrade
- SnsMessage: Token property was never populated from the constructor argument
- Added null guards for botMessageChannel and botReleaseMessageChannel parameters in BotService constructor
- Pass ILogger to HealthCheckClient.ExecuteAsync to match new API in Credfeto.Docker.HealthCheck.Http.Client 0.0.72.928
- Made DiscordChannelAdapter testable by accepting ITextChannel instead of the sealed SocketTextChannel, and added unit tests
- Guard against IndexOutOfRangeException when Branches list is empty in GithubStatusNotificationHandler
- Fixed CS0433 ambiguous xunit type conflict in test projects caused by FunFair.Test.Common now depending on the AOT-flavoured xunit v3 packages, by switching test projects to the matching xunit.v3.aot.mtp-v2 runner package
- Added missing IncludeAssets on NuGet package references required by FunFair.BuildCheck
### Changed
- Dependencies - Updated NSubstitute.Analyzers.CSharp to 1.0.17
- Switched to use minimal APIs
Expand Down Expand Up @@ -75,10 +75,13 @@ Please ADD ALL Changes to the UNRELEASED SECTION and not a specific release
- Dependencies - Updated Meziantou.Analyzer to 3.0.203
### Deprecated
### Removed
- Removed NuGet audit suppressions for Scriban 6.2.0 vulnerabilities now that the transitive dependency has been dropped
### Deployment Changes

<!--
Releases that have at least been deployed to staging, BUT NOT necessarily released to live. Changes should be moved from [Unreleased] into here as they are merged into the appropriate release branch
-->

## [1.4.48] - 2023-12-22
### Changed
- Dependencies - Updated SmartAnalyzers.CSharpExtensions.Annotations to 4.2.9
Expand Down
6 changes: 3 additions & 3 deletions src/BuildBot.CloudFormation.Tests/BuildBot.CloudFormation.Tests.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,9 +44,9 @@
<ProjectReference Include="..\BuildBot.CloudFormation\BuildBot.CloudFormation.csproj" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="FunFair.Test.Common" Version="6.4.3.2685" />
<PackageReference Include="NSubstitute" Version="6.2.0" />
<PackageReference Include="xunit.v3.aot.mtp-v2" Version="4.0.0" />
<PackageReference Include="FunFair.Test.Common" Version="6.4.3.2685" IncludeAssets="compile;runtime" />
<PackageReference Include="NSubstitute" Version="6.2.0" IncludeAssets="compile;runtime" />
<PackageReference Include="xunit.v3.aot.mtp-v2" Version="4.0.0" IncludeAssets="all" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="AsyncFixer" Version="2.1.0" PrivateAssets="All" ExcludeAssets="runtime" />
Expand Down
4 changes: 2 additions & 2 deletions src/BuildBot.CloudFormation/BuildBot.CloudFormation.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,8 +41,8 @@
<ProjectReference Include="..\BuildBot.Discord\BuildBot.Discord.csproj" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="AWSSDK.CloudFormation" Version="4.0.102.4" />
<PackageReference Include="Microsoft.Extensions.Http.Polly" Version="10.0.11" />
<PackageReference Include="AWSSDK.CloudFormation" Version="4.0.102.4" IncludeAssets="compile;runtime" />
<PackageReference Include="Microsoft.Extensions.Http.Polly" Version="10.0.11" IncludeAssets="compile;runtime" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="AsyncFixer" Version="2.1.0" PrivateAssets="All" ExcludeAssets="runtime" />
Expand Down
8 changes: 4 additions & 4 deletions src/BuildBot.Discord.Tests/BuildBot.Discord.Tests.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,10 +44,10 @@
<ProjectReference Include="..\BuildBot.Discord\BuildBot.Discord.csproj" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="FunFair.Test.Common" Version="6.4.3.2685" />
<PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.9.0" />
<PackageReference Include="NSubstitute" Version="6.2.0" />
<PackageReference Include="xunit.v3.aot.mtp-v2" Version="4.0.0" />
<PackageReference Include="FunFair.Test.Common" Version="6.4.3.2685" IncludeAssets="compile;runtime" />
<PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.9.0" IncludeAssets="compile;runtime;build;buildTransitive" />
<PackageReference Include="NSubstitute" Version="6.2.0" IncludeAssets="compile;runtime" />
<PackageReference Include="xunit.v3.aot.mtp-v2" Version="4.0.0" IncludeAssets="all" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="AsyncFixer" Version="2.1.0" PrivateAssets="All" ExcludeAssets="runtime" />
Expand Down
14 changes: 3 additions & 11 deletions src/BuildBot.Discord/BuildBot.Discord.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,21 +37,13 @@
<WarnOnPackingNonPackableProject>false</WarnOnPackingNonPackableProject>
<WarningsAsErrors />
</PropertyGroup>
<ItemGroup>
<!-- error NU1902: Warning As Error: Package 'Scriban' 6.2.0 has a known moderate severity vulnerability -->
<NuGetAuditSuppress Include="https://github.com/advisories/GHSA-5rpf-x9jg-8j5p" />
<!-- error NU1903: Warning As Error: Package 'Scriban' 6.2.0 has a known high severity vulnerability -->
<NuGetAuditSuppress Include="https://github.com/advisories/GHSA-grr9-747v-xvcp" />
<!-- error NU1903: Warning As Error: Package 'Scriban' 6.2.0 has a known high severity vulnerability -->
<NuGetAuditSuppress Include="https://github.com/advisories/GHSA-wgh7-7m3c-fx25" />
</ItemGroup>
<ItemGroup>
<ProjectReference Include="..\BuildBot.ServiceModel\BuildBot.ServiceModel.csproj" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="Discord.Net" Version="3.20.1" />
<PackageReference Include="Mediator.Abstractions" Version="3.0.2" />
<PackageReference Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.11" />
<PackageReference Include="Discord.Net" Version="3.20.1" IncludeAssets="compile;runtime" />
<PackageReference Include="Mediator.Abstractions" Version="3.0.2" IncludeAssets="compile;runtime" />
<PackageReference Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.11" IncludeAssets="compile;runtime" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="AsyncFixer" Version="2.1.0" PrivateAssets="All" ExcludeAssets="runtime" />
Expand Down
8 changes: 4 additions & 4 deletions src/BuildBot.GitHub.Tests/BuildBot.GitHub.Tests.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,10 +44,10 @@
<ProjectReference Include="..\BuildBot.GitHub\BuildBot.GitHub.csproj" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="FunFair.Test.Common" Version="6.4.3.2685" />
<PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.9.0" />
<PackageReference Include="NSubstitute" Version="6.2.0" />
<PackageReference Include="xunit.v3.aot.mtp-v2" Version="4.0.0" />
<PackageReference Include="FunFair.Test.Common" Version="6.4.3.2685" IncludeAssets="compile;runtime" />
<PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.9.0" IncludeAssets="compile;runtime;build;buildTransitive" />
<PackageReference Include="NSubstitute" Version="6.2.0" IncludeAssets="compile;runtime" />
<PackageReference Include="xunit.v3.aot.mtp-v2" Version="4.0.0" IncludeAssets="all" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="AsyncFixer" Version="2.1.0" PrivateAssets="All" ExcludeAssets="runtime" />
Expand Down
6 changes: 3 additions & 3 deletions src/BuildBot.Health.Tests/BuildBot.Health.Tests.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,9 +44,9 @@
<ProjectReference Include="..\BuildBot.Health\BuildBot.Health.csproj" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="FunFair.Test.Common" Version="6.4.3.2685" />
<PackageReference Include="NSubstitute" Version="6.2.0" />
<PackageReference Include="xunit.v3.aot.mtp-v2" Version="4.0.0" />
<PackageReference Include="FunFair.Test.Common" Version="6.4.3.2685" IncludeAssets="compile;runtime" />
<PackageReference Include="NSubstitute" Version="6.2.0" IncludeAssets="compile;runtime" />
<PackageReference Include="xunit.v3.aot.mtp-v2" Version="4.0.0" IncludeAssets="all" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="AsyncFixer" Version="2.1.0" PrivateAssets="All" ExcludeAssets="runtime" />
Expand Down
2 changes: 1 addition & 1 deletion src/BuildBot.Health/BuildBot.Health.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@
<ProjectReference Include="..\BuildBot.ServiceModel\BuildBot.ServiceModel.csproj" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="Mediator.Abstractions" Version="3.0.2" />
<PackageReference Include="Mediator.Abstractions" Version="3.0.2" IncludeAssets="compile;runtime" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="AsyncFixer" Version="2.1.0" PrivateAssets="All" ExcludeAssets="runtime" />
Expand Down
6 changes: 3 additions & 3 deletions src/BuildBot.Json.Tests/BuildBot.Json.Tests.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,9 +44,9 @@
<ProjectReference Include="..\BuildBot.Json\BuildBot.Json.csproj" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="FunFair.Test.Common" Version="6.4.3.2685" />
<PackageReference Include="NSubstitute" Version="6.2.0" />
<PackageReference Include="xunit.v3.aot.mtp-v2" Version="4.0.0" />
<PackageReference Include="FunFair.Test.Common" Version="6.4.3.2685" IncludeAssets="compile;runtime" />
<PackageReference Include="NSubstitute" Version="6.2.0" IncludeAssets="compile;runtime" />
<PackageReference Include="xunit.v3.aot.mtp-v2" Version="4.0.0" IncludeAssets="all" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="AsyncFixer" Version="2.1.0" PrivateAssets="All" ExcludeAssets="runtime" />
Expand Down
6 changes: 3 additions & 3 deletions src/BuildBot.ServiceModel.Tests/BuildBot.ServiceModel.Tests.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,9 +44,9 @@
<ProjectReference Include="..\BuildBot.ServiceModel\BuildBot.ServiceModel.csproj" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="FunFair.Test.Common" Version="6.4.3.2685" />
<PackageReference Include="NSubstitute" Version="6.2.0" />
<PackageReference Include="xunit.v3.aot.mtp-v2" Version="4.0.0" />
<PackageReference Include="FunFair.Test.Common" Version="6.4.3.2685" IncludeAssets="compile;runtime" />
<PackageReference Include="NSubstitute" Version="6.2.0" IncludeAssets="compile;runtime" />
<PackageReference Include="xunit.v3.aot.mtp-v2" Version="4.0.0" IncludeAssets="all" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="AsyncFixer" Version="2.1.0" PrivateAssets="All" ExcludeAssets="runtime" />
Expand Down
4 changes: 2 additions & 2 deletions src/BuildBot.ServiceModel/BuildBot.ServiceModel.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,8 +38,8 @@
<WarningsAsErrors />
</PropertyGroup>
<ItemGroup>
<PackageReference Include="System.Interactive.Async" Version="7.0.1" />
<PackageReference Include="System.Reactive" Version="7.0.0" />
<PackageReference Include="System.Interactive.Async" Version="7.0.1" IncludeAssets="compile;runtime" />
<PackageReference Include="System.Reactive" Version="7.0.0" IncludeAssets="compile;runtime;analyzers" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="AsyncFixer" Version="2.1.0" PrivateAssets="All" ExcludeAssets="runtime" />
Expand Down
8 changes: 4 additions & 4 deletions src/BuildBot.Tests/BuildBot.Tests.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,10 +44,10 @@
<ProjectReference Include="..\BuildBot.Json\BuildBot.Json.csproj" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="FunFair.Test.Common" Version="6.4.3.2685" />
<PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.9.0" />
<PackageReference Include="NSubstitute" Version="6.2.0" />
<PackageReference Include="xunit.v3.aot.mtp-v2" Version="4.0.0" />
<PackageReference Include="FunFair.Test.Common" Version="6.4.3.2685" IncludeAssets="compile;runtime" />
<PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.9.0" IncludeAssets="compile;runtime;build;buildTransitive" />
<PackageReference Include="NSubstitute" Version="6.2.0" IncludeAssets="compile;runtime" />
<PackageReference Include="xunit.v3.aot.mtp-v2" Version="4.0.0" IncludeAssets="all" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="AsyncFixer" Version="2.1.0" PrivateAssets="All" ExcludeAssets="runtime" />
Expand Down
6 changes: 3 additions & 3 deletions src/BuildBot.Watchtower.Tests/BuildBot.Watchtower.Tests.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,9 +44,9 @@
<ProjectReference Include="..\BuildBot.Watchtower\BuildBot.Watchtower.csproj" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="FunFair.Test.Common" Version="6.4.3.2685" />
<PackageReference Include="NSubstitute" Version="6.2.0" />
<PackageReference Include="xunit.v3.aot.mtp-v2" Version="4.0.0" />
<PackageReference Include="FunFair.Test.Common" Version="6.4.3.2685" IncludeAssets="compile;runtime" />
<PackageReference Include="NSubstitute" Version="6.2.0" IncludeAssets="compile;runtime" />
<PackageReference Include="xunit.v3.aot.mtp-v2" Version="4.0.0" IncludeAssets="all" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="AsyncFixer" Version="2.1.0" PrivateAssets="All" ExcludeAssets="runtime" />
Expand Down
38 changes: 11 additions & 27 deletions src/BuildBot/BuildBot.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,17 +81,17 @@
<ProjectReference Include="..\BuildBot.Watchtower\BuildBot.Watchtower.csproj" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="Credfeto.Docker.HealthCheck.Http.Client" Version="0.0.77.1109" />
<PackageReference Include="Microsoft.Extensions.Hosting.Systemd" Version="10.0.11" />
<PackageReference Include="Microsoft.Extensions.Hosting.WindowsServices" Version="10.0.11" />
<PackageReference Include="Serilog" Version="4.4.0" />
<PackageReference Include="Serilog.Enrichers.Demystifier" Version="1.0.3" />
<PackageReference Include="Serilog.Enrichers.Environment" Version="3.0.1" />
<PackageReference Include="Serilog.Enrichers.Process" Version="3.0.0" />
<PackageReference Include="Serilog.Enrichers.Thread" Version="4.0.0" />
<PackageReference Include="Serilog.Extensions.Logging" Version="10.0.0" />
<PackageReference Include="Serilog.Sinks.Console" Version="6.1.1" />
<PackageReference Include="Serilog.Sinks.Debug" Version="3.0.0" />
<PackageReference Include="Credfeto.Docker.HealthCheck.Http.Client" Version="0.0.77.1109" IncludeAssets="compile;runtime" />
<PackageReference Include="Microsoft.Extensions.Hosting.Systemd" Version="10.0.11" IncludeAssets="compile;runtime" />
<PackageReference Include="Microsoft.Extensions.Hosting.WindowsServices" Version="10.0.11" IncludeAssets="compile;runtime" />
<PackageReference Include="Serilog" Version="4.4.0" IncludeAssets="compile;runtime" />
<PackageReference Include="Serilog.Enrichers.Demystifier" Version="1.0.3" IncludeAssets="compile;runtime" />
<PackageReference Include="Serilog.Enrichers.Environment" Version="3.0.1" IncludeAssets="compile;runtime" />
<PackageReference Include="Serilog.Enrichers.Process" Version="3.0.0" IncludeAssets="compile;runtime" />
<PackageReference Include="Serilog.Enrichers.Thread" Version="4.0.0" IncludeAssets="compile;runtime" />
<PackageReference Include="Serilog.Extensions.Logging" Version="10.0.0" IncludeAssets="compile;runtime" />
<PackageReference Include="Serilog.Sinks.Console" Version="6.1.1" IncludeAssets="compile;runtime" />
<PackageReference Include="Serilog.Sinks.Debug" Version="3.0.0" IncludeAssets="compile;runtime" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="AsyncFixer" Version="2.1.0" PrivateAssets="All" ExcludeAssets="runtime" />
Expand All @@ -115,20 +115,4 @@
<PackageReference Include="Credfeto.Version.Information.Generator" Version="1.0.136.1515" PrivateAssets="All" ExcludeAssets="runtime" />
<PackageReference Include="ToStringWithoutOverrideAnalyzer" Version="0.6.0" PrivateAssets="All" ExcludeAssets="runtime" />
</ItemGroup>
<ItemGroup>
<!-- Scriban 6.2.0 known vulnerabilities - upgrade tracked in funfair-tech/BuildBot#352 -->
<!-- error NU1903: Package 'Scriban' 6.2.0 has known high/moderate/critical vulnerabilities -->
<NuGetAuditSuppress Include="https://github.com/advisories/GHSA-24c8-4792-22hx" />
<NuGetAuditSuppress Include="https://github.com/advisories/GHSA-5rpf-x9jg-8j5p" />
<NuGetAuditSuppress Include="https://github.com/advisories/GHSA-5wr9-m6jw-xx44" />
<NuGetAuditSuppress Include="https://github.com/advisories/GHSA-c875-h985-hvrc" />
<NuGetAuditSuppress Include="https://github.com/advisories/GHSA-grr9-747v-xvcp" />
<NuGetAuditSuppress Include="https://github.com/advisories/GHSA-m2p3-hwv5-xpqw" />
<NuGetAuditSuppress Include="https://github.com/advisories/GHSA-p6q4-fgr8-vx4p" />
<NuGetAuditSuppress Include="https://github.com/advisories/GHSA-v66j-x4hw-fv9g" />
<NuGetAuditSuppress Include="https://github.com/advisories/GHSA-wgh7-7m3c-fx25" />
<NuGetAuditSuppress Include="https://github.com/advisories/GHSA-x6m9-38vm-2xhf" />
<NuGetAuditSuppress Include="https://github.com/advisories/GHSA-xcx6-vp38-8hr5" />
<NuGetAuditSuppress Include="https://github.com/advisories/GHSA-xw6w-9jjh-p9cr" />
</ItemGroup>
</Project>
Loading