fix: remove redundant NU1510 PackageReference pins in TodoApp.Uno#558
Merged
Conversation
System.Formats.Asn1, System.Private.Uri, and System.Text.Json were pinned as top-level PackageReference/PackageVersion entries since the Uno sample was first added, but NuGet's package-pruning feature now considers these pins redundant on every head (desktop, browserwasm, windows, android, ios-maccatalyst) - the implicitly-resolved versions already satisfy the pins, so restore emits NU1510 for each. Removed the three redundant entries from Directory.Packages.props and TodoApp.Uno.csproj. System.IO.Packaging (never triggers NU1510) and SQLitePCLRaw.bundle_e_sqlite3 (genuine NU1903 CVE floor, see CommunityToolkit#492) are left untouched. Verified: dotnet restore/build -f net10.0-desktop now completes with no NU1510 warnings (previously 3) and no new warnings/errors. Other heads (android/ios-maccatalyst/browserwasm/windows) require Uno workloads not available locally; verification for those relies on the todoapp-uno CI matrix. Fixes CommunityToolkit#540
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
samples/todoapp/TodoApp.Unorestore emitted threeNU1510warnings on every head (desktop, browserwasm, windows, android, ios-maccatalyst):System.Formats.Asn1,System.Private.Uri, andSystem.Text.Jsonwere pinned as top-levelPackageReference/PackageVersionentries since the Uno sample was first added. NuGet's package-pruning feature now considers these pins redundant on every head — the implicitly-resolved versions already satisfy the pins.Change
Removed the three redundant entries from:
samples/todoapp/TodoApp.Uno/Directory.Packages.propssamples/todoapp/TodoApp.Uno/TodoApp.Uno/TodoApp.Uno.csprojSystem.IO.Packaging(never triggered NU1510) andSQLitePCLRaw.bundle_e_sqlite3(genuine NU1903 CVE floor, see #492) are left untouched, per the issue's guidance.Note: contrary to the issue's guess, these pins predate the #492/#498-era NU1903 fixes — they were part of the original Uno sample scaffold (commit 9b9f9ec, Feb 2025) — but the fix (removal) is the same either way.
Verification
dotnet restore+dotnet build -f net10.0-desktoponTodoApp.Uno.csproj— 0 NU1510 warnings (previously 3), build succeeded, only a pre-existing unrelatedUno0001warning remained.dotnet restore/dotnet buildonDatasync.Toolkit.sln(root) — 0 warnings, 0 errors (the Uno sample isn't referenced by the main solution).Build Samplesworkflow on the branch (https://github.com/adrianhall/CommunityToolkit-Datasync/actions/runs/29146039469) — all jobs succeeded, including all 5todoapp-unoheads (android, ios-maccatalyst, windows, desktop, browserwasm). Confirmed 0 NU1510 occurrences in every job log (previously 3 each).Fixes #540