microsoft / microsoft/aspire

[AspireE2E]Build aspire project with warning "warning NU1903: Package 'Microsoft.OpenApi' 2.0.0 has a known high severity vulnerability"

Open
#18,919 2 comments 0 reactions 0 assignees View on GitHub
needs-area-label triage:needs-human
Dominant language
C#
Stars
6.3k
Forks
991
Avg merge
2d 15h
Merged PRs (30d)
196

Description

**REGRESSION INFO**: Repro for aspire 13.4.6

**INSTALL STEPS**

1. OS: Win11 x64 25h2 ENU
2. Install Aug servicing SDK 10.0.303
3. Install Aspire CLI 13.5.0-preview.1.26376.5 iex "& { $(irm https://aspire.dev/install.ps1) } -Quality dev"
5. Add feed

**REPRO STEPS**
1. Open CMD, create a Aspire Starter App(ASP.NET Core/Blazor)
`aspire new aspire-starter --name aspire6`
2. cd aspire6 then cd aspire6.AppHost
3. dotnet build

**ACTUAL** It will pop up warning "warning NU1903: Package 'Microsoft.OpenApi' 2.0.0 has a known high severity vulnerability"

Image

**EXPECTED**
No warning shows up.

Note:
1. When build api project, there is no this warning. when run “dotnet nuget why Microsoft.OpenApi”, the version of "Microsoft.OpenApi" is v2.7.5

Image

2. When build aspire project, have this warning, when run “dotnet nuget why Microsoft.OpenApi”, the version of "Microsoft.OpenApi" is v2.0.0

Image
3. Have a similar bug[67543](https://github.com/dotnet/aspnetcore/issues/67543) and this issue have been fixed in Aug service sdk 10.0.303

Contributor guide

Open the contributing guide

Research direction

Reproduce the warning with the Aspire Starter App and `dotnet build` from the `aspire6.AppHost` directory. Compare `dotnet nuget why Microsoft.OpenApi` for the API and AppHost projects, then trace the starter template's dependency graph. Done means the Aspire project builds without the NU1903 warning while the API project's resolved version remains consistent.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
build-system
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.