From 3e1ea115909acc61abaf1d0944727a5891cba605 Mon Sep 17 00:00:00 2001
From: Vincent Biret <vibiret@microsoft.com>
Date: Fri, 15 Nov 2024 12:13:00 -0500
Subject: [PATCH 1/2] chore: uses nuget suppressions for CVEs

Signed-off-by: Vincent Biret <vibiret@microsoft.com>
---
 .../Microsoft.Kiota.Http.HttpClientLibrary.csproj        | 9 +++++----
 .../json/Microsoft.Kiota.Serialization.Json.csproj       | 9 +++++----
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/src/http/httpClient/Microsoft.Kiota.Http.HttpClientLibrary.csproj b/src/http/httpClient/Microsoft.Kiota.Http.HttpClientLibrary.csproj
index 8ca43c2..daeffd2 100644
--- a/src/http/httpClient/Microsoft.Kiota.Http.HttpClientLibrary.csproj
+++ b/src/http/httpClient/Microsoft.Kiota.Http.HttpClientLibrary.csproj
@@ -13,10 +13,11 @@
   <ItemGroup
     Condition="'$(TargetFramework)' == 'net5.0' or '$(TargetFramework)'== 'netStandard2.0' or '$(TargetFramework)' == 'netStandard2.1' or '$(TargetFramework)' == 'net462'">
     <PackageReference Include="System.Diagnostics.DiagnosticSource" Version="[6.0,)" />
-    <!-- suppressed because of this CVE https://github.com/advisories/GHSA-hh2w-p6rv-4g7w 
-     The target application is the one which will resolve the correct version
-     when the version range is updated to > 8.0.4 in the future, remove the nowarn suppression -->
-    <PackageReference Include="System.Text.Json" Version="[6.0,)" NoWarn="NU1903" />
+    <!-- The target application is the one which will resolve the correct version.
+     When the version range is updated to > 8.0.4 in the future, remove the GHSA suppression -->
+    <PackageReference Include="System.Text.Json" Version="[6.0,)" />
+    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-hh2w-p6rv-4g7w" />
+    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-8g4q-xg66-9fp4" />
   </ItemGroup>
 
   <ItemGroup Condition="'$(TargetFramework)' == 'net462'">
diff --git a/src/serialization/json/Microsoft.Kiota.Serialization.Json.csproj b/src/serialization/json/Microsoft.Kiota.Serialization.Json.csproj
index 55be14a..fece6ca 100644
--- a/src/serialization/json/Microsoft.Kiota.Serialization.Json.csproj
+++ b/src/serialization/json/Microsoft.Kiota.Serialization.Json.csproj
@@ -14,10 +14,11 @@
   <!-- NET 5 target to be removed on next major version-->
   <ItemGroup
     Condition="'$(TargetFramework)' == 'net5.0' or '$(TargetFramework)'== 'netStandard2.0' or '$(TargetFramework)' == 'netStandard2.1'">
-    <!-- suppressed because of this CVE https://github.com/advisories/GHSA-hh2w-p6rv-4g7w
-     The target application is the one which will resolve the correct version
-     when the version range is updated to > 8.0.4 in the future, remove the nowarn suppression -->
-    <PackageReference Include="System.Text.Json" Version="[6.0,)" NoWarn="NU1903" />
+    <!-- The target application is the one which will resolve the correct version.
+     When the version range is updated to > 8.0.4 in the future, remove the GHSA suppression -->
+    <PackageReference Include="System.Text.Json" Version="[6.0,)" />
+    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-hh2w-p6rv-4g7w" />
+    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-8g4q-xg66-9fp4" />
   </ItemGroup>
 
   <ItemGroup>

From bb8f67ce208b34e3b13c46e01fa9cf631827261a Mon Sep 17 00:00:00 2001
From: Vincent Biret <vibiret@microsoft.com>
Date: Fri, 15 Nov 2024 12:27:08 -0500
Subject: [PATCH 2/2] chore: updates to suppression via props

Signed-off-by: Vincent Biret <vibiret@microsoft.com>
---
 Directory.Build.props                                       | 6 ++++++
 .../Microsoft.Kiota.Http.HttpClientLibrary.csproj           | 4 ----
 .../json/Microsoft.Kiota.Serialization.Json.csproj          | 4 ----
 3 files changed, 6 insertions(+), 8 deletions(-)

diff --git a/Directory.Build.props b/Directory.Build.props
index bf23bf0..400480e 100644
--- a/Directory.Build.props
+++ b/Directory.Build.props
@@ -17,4 +17,10 @@
     <IsPackable>false</IsPackable>
     <OutputType>Library</OutputType>
   </PropertyGroup>
+  <ItemGroup>
+    <!-- The target application is the one which will resolve the correct version.
+     When the version range is updated to > 8.0.4 in the future, remove the GHSA suppression -->
+    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-hh2w-p6rv-4g7w" />
+    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-8g4q-xg66-9fp4" />
+  </ItemGroup>
 </Project>
\ No newline at end of file
diff --git a/src/http/httpClient/Microsoft.Kiota.Http.HttpClientLibrary.csproj b/src/http/httpClient/Microsoft.Kiota.Http.HttpClientLibrary.csproj
index daeffd2..41346a5 100644
--- a/src/http/httpClient/Microsoft.Kiota.Http.HttpClientLibrary.csproj
+++ b/src/http/httpClient/Microsoft.Kiota.Http.HttpClientLibrary.csproj
@@ -13,11 +13,7 @@
   <ItemGroup
     Condition="'$(TargetFramework)' == 'net5.0' or '$(TargetFramework)'== 'netStandard2.0' or '$(TargetFramework)' == 'netStandard2.1' or '$(TargetFramework)' == 'net462'">
     <PackageReference Include="System.Diagnostics.DiagnosticSource" Version="[6.0,)" />
-    <!-- The target application is the one which will resolve the correct version.
-     When the version range is updated to > 8.0.4 in the future, remove the GHSA suppression -->
     <PackageReference Include="System.Text.Json" Version="[6.0,)" />
-    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-hh2w-p6rv-4g7w" />
-    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-8g4q-xg66-9fp4" />
   </ItemGroup>
 
   <ItemGroup Condition="'$(TargetFramework)' == 'net462'">
diff --git a/src/serialization/json/Microsoft.Kiota.Serialization.Json.csproj b/src/serialization/json/Microsoft.Kiota.Serialization.Json.csproj
index fece6ca..54ed462 100644
--- a/src/serialization/json/Microsoft.Kiota.Serialization.Json.csproj
+++ b/src/serialization/json/Microsoft.Kiota.Serialization.Json.csproj
@@ -14,11 +14,7 @@
   <!-- NET 5 target to be removed on next major version-->
   <ItemGroup
     Condition="'$(TargetFramework)' == 'net5.0' or '$(TargetFramework)'== 'netStandard2.0' or '$(TargetFramework)' == 'netStandard2.1'">
-    <!-- The target application is the one which will resolve the correct version.
-     When the version range is updated to > 8.0.4 in the future, remove the GHSA suppression -->
     <PackageReference Include="System.Text.Json" Version="[6.0,)" />
-    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-hh2w-p6rv-4g7w" />
-    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-8g4q-xg66-9fp4" />
   </ItemGroup>
 
   <ItemGroup>