dotnet · Jan 24, 2025 · Jan 27, 2025 · Jan 28, 2025 · Jan 28, 2025 · Jan 28, 2025
diff --git a/README.md b/README.md
@@ -98,19 +98,9 @@ a new targeting pack is needed, please [open a new issue](#filing-issues) to dis
 
 ## Vulnerable Packages
 
-CVEs may exist for reference packages included in this repo. If they are mitigated by a newer version, the
-newer version should be added, the vulnerable version should be removed (only if there are no product repo 
-references to it), and references to the vulnerable package within other reference packages should be upgraded.
-A comment should be added to indicate when packages were manually upgraded in both the csproj and nuspec files.
-
-``` xml
-    <!-- Manual upgrade from 4.3.0 to address CVE-2017-0247 -->
-    <PackageReference Include="System.Net.Security" Version="4.3.1" />
-```
-
-All packages that contain a manually upgraded reference must be added to the eng/build.props as a
-DependencyPackageProjects in order to prevent the n-1 version from getting loaded which would still
-reference the vulnerable version.
+CVEs may exist for reference packages included in this repo. Because the packages do not contain any
+implementation, they do not pose a security risk. CG is configured in this repo to ignore the reference
+packages. If product repos migrate off these vulnerable packages, they can be [removed](#cleanup).
 
 ## Filing Issues
 

diff --git a/azure-pipelines/builds/ci.yml b/azure-pipelines/builds/ci.yml
@@ -25,6 +25,13 @@ extends:
   template: azure-pipelines/MicroBuild.1ES.Official.yml@MicroBuildTemplate
   parameters:
     sdl:
+      componentgovernance:
+        verbosity: Verbose
+        # All of the SBRPs must be ignored because it is possible some of them are for vulnerable versions.
+        # Because they are reference only packages they are not vulnerable themselves.
+        ignoreDirectories: |
+          artifacts/sb,
+          src/referencePackages
       policheck:
         enabled: true
       sourceAnalysisPool:

diff --git a/eng/Build.props b/eng/Build.props
@@ -22,22 +22,6 @@
       Format:
       <DependencyPackageProjects Include="$(RepoRoot)src\referencePackages\src\**\Microsoft.Extensions.Options.5.0.0.csproj" />
     -->
-
-    <DependencyPackageProjects Include="$(RepoRoot)src\referencePackages\src\**\System.Text.Json.6.0.10.csproj" />
-
-    <DependencyPackageProjects Include="$(RepoRoot)src\referencePackages\src\**\Microsoft.Extensions.DependencyModel.6.0.10.csproj" />
-    <DependencyPackageProjects Include="$(RepoRoot)src\referencePackages\src\**\System.Security.Cryptography.Cng.5.0.0.csproj" />
-    <DependencyPackageProjects Include="$(RepoRoot)src\referencePackages\src\**\System.Security.Cryptography.Pkcs.6.0.4.csproj" />
-    <DependencyPackageProjects Include="$(RepoRoot)src\referencePackages\src\**\System.Security.Cryptography.Pkcs.7.0.2.csproj" />
-    <DependencyPackageProjects Include="$(RepoRoot)src\referencePackages\src\**\System.Security.Cryptography.Pkcs.8.0.0.csproj" />
-    <DependencyPackageProjects Include="$(RepoRoot)src\referencePackages\src\**\System.Security.Cryptography.Xml.6.0.1.csproj" />
-    <DependencyPackageProjects Include="$(RepoRoot)src\referencePackages\src\**\System.Security.Cryptography.Xml.7.0.1.csproj" />
-    <DependencyPackageProjects Include="$(RepoRoot)src\referencePackages\src\**\Microsoft.Build.17.3.4.csproj" />
-    <DependencyPackageProjects Include="$(RepoRoot)src\referencePackages\src\**\Microsoft.Build.Tasks.Core.17.4.0.csproj" />
-    <DependencyPackageProjects Include="$(RepoRoot)src\referencePackages\src\**\NuGet.Protocol.6.8.1.csproj" />
-    <DependencyPackageProjects Include="$(RepoRoot)src\referencePackages\src\**\NuGet.Protocol.6.11.0.csproj" />
-    <DependencyPackageProjects Include="$(RepoRoot)src\referencePackages\src\**\NuGet.Protocol.6.12.1.csproj" />
-
   </ItemGroup>
 
   <ItemGroup Condition="'$(BuildDependencyPackageProjects)' == 'true'">

diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml
@@ -8,9 +8,9 @@
       <SourceBuild RepoName="source-build-externals" ManagedOnly="true" />
     </Dependency>
     <!-- Intermediate is necessary for source build. -->
-    <Dependency Name="Microsoft.SourceBuild.Intermediate.source-build-reference-packages" Version="10.0.606004">
+    <Dependency Name="Microsoft.SourceBuild.Intermediate.source-build-reference-packages" Version="10.0.607103">
       <Uri>https://github.com/dotnet/source-build-reference-packages</Uri>
-      <Sha>1d0bf118044fc096231bfba85b0cd68aad0d1507</Sha>
+      <Sha>412f115947777b9babf97716a20b056d0d77b1b9</Sha>
       <SourceBuild RepoName="source-build-reference-packages" ManagedOnly="true" />
     </Dependency>
     <!-- Intermediate is necessary for source build. -->

diff --git a/src/referencePackages/Directory.Build.targets b/src/referencePackages/Directory.Build.targets
@@ -82,6 +82,7 @@
       <TargetingPackVersion Condition="'%(TargetFramework)' == 'net6.0'">6.0.0</TargetingPackVersion>
       <TargetingPackVersion Condition="'%(TargetFramework)' == 'net7.0'">7.0.0</TargetingPackVersion>
       <TargetingPackVersion Condition="'%(TargetFramework)' == 'net8.0'">8.0.0</TargetingPackVersion>
+      <TargetingPackVersion Condition="'%(TargetFramework)' == 'net9.0'">9.0.0</TargetingPackVersion>
     </KnownFrameworkReference>
 
     <KnownFrameworkReference Update="@(KnownFrameworkReference->WithMetadataValue('Identity', 'NETStandard.Library'))">

diff --git a/...c/microsoft.bcl.asyncinterfaces/5.0.0/lib/netstandard2.0/Microsoft.Bcl.AsyncInterfaces.cs b/...c/microsoft.bcl.asyncinterfaces/5.0.0/lib/netstandard2.0/Microsoft.Bcl.AsyncInterfaces.cs
@@ -87,7 +87,7 @@ public readonly partial struct ConfiguredCancelableAsyncEnumerable<T>
         private readonly int _dummyPrimitive;
         public readonly ConfiguredCancelableAsyncEnumerable<T> ConfigureAwait(bool continueOnCapturedContext) { throw null; }
 
-        public readonly ConfiguredCancelableAsyncEnumerable<T>.Enumerator GetAsyncEnumerator() { throw null; }
+        public readonly Enumerator GetAsyncEnumerator() { throw null; }
 
         public readonly ConfiguredCancelableAsyncEnumerable<T> WithCancellation(Threading.CancellationToken cancellationToken) { throw null; }
 

diff --git a/...c/microsoft.bcl.asyncinterfaces/6.0.0/lib/netstandard2.0/Microsoft.Bcl.AsyncInterfaces.cs b/...c/microsoft.bcl.asyncinterfaces/6.0.0/lib/netstandard2.0/Microsoft.Bcl.AsyncInterfaces.cs
@@ -89,7 +89,7 @@ public readonly partial struct ConfiguredCancelableAsyncEnumerable<T>
         private readonly int _dummyPrimitive;
         public readonly ConfiguredCancelableAsyncEnumerable<T> ConfigureAwait(bool continueOnCapturedContext) { throw null; }
 
-        public readonly ConfiguredCancelableAsyncEnumerable<T>.Enumerator GetAsyncEnumerator() { throw null; }
+        public readonly Enumerator GetAsyncEnumerator() { throw null; }
 
         public readonly ConfiguredCancelableAsyncEnumerable<T> WithCancellation(Threading.CancellationToken cancellationToken) { throw null; }
 

diff --git a/...c/microsoft.bcl.asyncinterfaces/8.0.0/lib/netstandard2.0/Microsoft.Bcl.AsyncInterfaces.cs b/...c/microsoft.bcl.asyncinterfaces/8.0.0/lib/netstandard2.0/Microsoft.Bcl.AsyncInterfaces.cs
@@ -4,6 +4,7 @@
 // ------------------------------------------------------------------------------
 // Changes to this file must follow the http://aka.ms/api-review process.
 // ------------------------------------------------------------------------------
+[assembly: System.Reflection.AssemblyMetadata("source", "source-build-reference-packages")]
 [assembly: System.Runtime.CompilerServices.CompilationRelaxations(8)]
 [assembly: System.Runtime.CompilerServices.RuntimeCompatibility(WrapNonExceptionThrows = true)]
 [assembly: System.Diagnostics.Debuggable(System.Diagnostics.DebuggableAttribute.DebuggingModes.IgnoreSymbolStoreSequencePoints)]
@@ -22,8 +23,8 @@
 [assembly: System.Reflection.AssemblyProduct("Microsoft® .NET")]
 [assembly: System.Reflection.AssemblyTitle("Microsoft.Bcl.AsyncInterfaces")]
 [assembly: System.Reflection.AssemblyMetadata("RepositoryUrl", "https://github.com/dotnet/runtime")]
-[assembly: System.Reflection.AssemblyVersionAttribute("8.0.0.0")]
 [assembly: System.Runtime.CompilerServices.ReferenceAssembly]
+[assembly: System.Reflection.AssemblyVersionAttribute("8.0.0.0")]
 [assembly: System.Reflection.AssemblyFlagsAttribute((System.Reflection.AssemblyNameFlags)0x70)]
 namespace System
 {

diff --git a/...c/microsoft.bcl.asyncinterfaces/8.0.0/lib/netstandard2.1/Microsoft.Bcl.AsyncInterfaces.cs b/...c/microsoft.bcl.asyncinterfaces/8.0.0/lib/netstandard2.1/Microsoft.Bcl.AsyncInterfaces.cs
@@ -4,6 +4,7 @@
 // ------------------------------------------------------------------------------
 // Changes to this file must follow the http://aka.ms/api-review process.
 // ------------------------------------------------------------------------------
+[assembly: System.Reflection.AssemblyMetadata("source", "source-build-reference-packages")]
 [assembly: System.Runtime.CompilerServices.CompilationRelaxations(8)]
 [assembly: System.Runtime.CompilerServices.RuntimeCompatibility(WrapNonExceptionThrows = true)]
 [assembly: System.Diagnostics.Debuggable(System.Diagnostics.DebuggableAttribute.DebuggingModes.IgnoreSymbolStoreSequencePoints)]
@@ -22,8 +23,8 @@
 [assembly: System.Reflection.AssemblyProduct("Microsoft® .NET")]
 [assembly: System.Reflection.AssemblyTitle("Microsoft.Bcl.AsyncInterfaces")]
 [assembly: System.Reflection.AssemblyMetadata("RepositoryUrl", "https://github.com/dotnet/runtime")]
-[assembly: System.Reflection.AssemblyVersionAttribute("8.0.0.0")]
 [assembly: System.Runtime.CompilerServices.ReferenceAssembly]
+[assembly: System.Reflection.AssemblyVersionAttribute("8.0.0.0")]
 [assembly: System.Reflection.AssemblyFlagsAttribute((System.Reflection.AssemblyNameFlags)0x70)]
 [assembly: System.Runtime.CompilerServices.TypeForwardedTo(typeof(System.Collections.Generic.IAsyncEnumerable<>))]
 [assembly: System.Runtime.CompilerServices.TypeForwardedTo(typeof(System.Collections.Generic.IAsyncEnumerator<>))]

diff --git a/...encePackages/src/microsoft.bcl.asyncinterfaces/8.0.0/microsoft.bcl.asyncinterfaces.nuspec b/...encePackages/src/microsoft.bcl.asyncinterfaces/8.0.0/microsoft.bcl.asyncinterfaces.nuspec
@@ -4,6 +4,7 @@
     <id>Microsoft.Bcl.AsyncInterfaces</id>
     <version>8.0.0</version>
     <authors>Microsoft</authors>
+    <requireLicenseAcceptance>false</requireLicenseAcceptance>
     <license type="expression">MIT</license>
     <licenseUrl>https://licenses.nuget.org/MIT</licenseUrl>
     <projectUrl>https://dot.net/</projectUrl>

diff --git a/src/referencePackages/src/microsoft.build/17.12.6/Microsoft.Build.17.12.6.csproj b/src/referencePackages/src/microsoft.build/17.12.6/Microsoft.Build.17.12.6.csproj
diff --git a/src/referencePackages/src/microsoft.build/17.12.6/microsoft.build.nuspec b/src/referencePackages/src/microsoft.build/17.12.6/microsoft.build.nuspec