Question

在处理CVE-2018-8409时注意到，我们的dotnet发布（.NET Core 2.1.403 ASPNET Core应用）正在输出目录中发布System.IO.Pipelines.dll v4.0.0.1。

我在System.IO.Pipelines的v4.5.3中添加了一个nuget包引用。

除此以外，我看不到构建输出中对v4.0.0.1的引用：

Unified primary reference "System.IO.Pipelines, Version=4.0.0.1, Culture=neutral, PublicKeyToken=cc7b13ffcd2ddd51".
         Using this version instead of original version "4.0.0.0" in "<home_dir>\.nuget\packages\microsoft.aspnetcore.connections.abstractions\2.1.3\lib\netstandard2.0\Microsoft.AspNetCore.Connections.Abstractions.dll" because AutoUnify is 'true'.
         Using this version instead of original version "4.0.0.0" in "<home_dir>\.nuget\packages\microsoft.aspnetcore.http.connections\1.0.4\lib\netstandard2.0\Microsoft.AspNetCore.Http.Connections.dll" because AutoUnify is 'true'.
         Using this version instead of original version "4.0.0.0" in "<home_dir>\.nuget\packages\microsoft.aspnetcore.server.kestrel.core\2.1.3\lib\netstandard2.0\Microsoft.AspNetCore.Server.Kestrel.Core.dll" because AutoUnify is 'true'.
         Using this version instead of original version "4.0.0.0" in "<home_dir>\.nuget\packages\microsoft.aspnetcore.server.kestrel.transport.abstractions\2.1.3\lib\netstandard2.0\Microsoft.AspNetCore.Server.Kestrel.Transport.Abstractions.dll" because AutoUnify is 'true'.
         Using this version instead of original version "4.0.0.0" in "<home_dir>\.nuget\packages\microsoft.aspnetcore.server.kestrel.transport.sockets\2.1.3\lib\netstandard2.0\Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets.dll" because AutoUnify is 'true'.
         Using this version instead of original version "4.0.0.0" in "<home_dir>\.nuget\packages\microsoft.aspnetcore.signalr.core\1.0.4\lib\netstandard2.0\Microsoft.AspNetCore.SignalR.Core.dll" because AutoUnify is 'true'.
         Resolved file path is "<home_dir>\.nuget\packages\system.io.pipelines\4.5.3\lib\netstandard2.0\System.IO.Pipelines.dll".
         Reference found at search path location "{HintPathFromItem}".
         This reference is not "CopyLocal" because at least one source item had "Private" set to "false" and no source items had "Private" set to "true".
         The ImageRuntimeVersion for this reference is "v4.0.30319"

NOTE : <home_dir> is my user directory, it's not actually part of the output, fyi.

但是，当我签入VS2017时，我清楚地看到nuget包显示System.IO.Pipelines（4.5.3）

我希望System.IO.Pipelines 4.5.3出现在输出中，包括任何必要的程序集绑定重定向。

有什么想法我想念的吗？

谢谢！

Answer 1

一个极其烦人的举动，进一步的分析向我揭示了nuget包4.5.3包含程序集版本4.0.0.1

Whyyyyyyy微软，Whyyyyyyy

为什么dotnet发布不发布预期的版本？

1 个答案: