[AspireE2E]Build aspire project with warning "warning NU1903: Package 'Microsoft.OpenApi' 2.0.0 has a known high severity vulnerability"
- Dominant language
- C#
- Stars
- 6.3k
- Forks
- 991
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 196
Description
**REGRESSION INFO**: Repro for aspire 13.4.6
**INSTALL STEPS**
1. OS: Win11 x64 25h2 ENU
2. Install Aug servicing SDK 10.0.303
3. Install Aspire CLI 13.5.0-preview.1.26376.5 iex "& { $(irm https://aspire.dev/install.ps1) } -Quality dev"
5. Add feed
**REPRO STEPS**
1. Open CMD, create a Aspire Starter App(ASP.NET Core/Blazor)
`aspire new aspire-starter --name aspire6`
2. cd aspire6 then cd aspire6.AppHost
3. dotnet build
**ACTUAL** It will pop up warning "warning NU1903: Package 'Microsoft.OpenApi' 2.0.0 has a known high severity vulnerability"
**EXPECTED**
No warning shows up.
Note:
1. When build api project, there is no this warning. when run “dotnet nuget why Microsoft.OpenApi”, the version of "Microsoft.OpenApi" is v2.7.5
2. When build aspire project, have this warning, when run “dotnet nuget why Microsoft.OpenApi”, the version of "Microsoft.OpenApi" is v2.0.0
3. Have a similar bug[67543](https://github.com/dotnet/aspnetcore/issues/67543) and this issue have been fixed in Aug service sdk 10.0.303
Contributor guide
Research direction
Reproduce the warning with the Aspire Starter App and `dotnet build` from the `aspire6.AppHost` directory. Compare `dotnet nuget why Microsoft.OpenApi` for the API and AppHost projects, then trace the starter template's dependency graph. Done means the Aspire project builds without the NU1903 warning while the API project's resolved version remains consistent.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- build-system
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100