Arch Linux User Repository

FYI the new update patched the advisories that we had to suppress before, so I've removed the suppressions. It seems to be running fine on my machine, but let me know if you have build issues.

FYI the new update patched the advisories that we had to suppress before, so I've removed the suppressions. It seems to be running fine on my machine, but let me know if you have build issues.

@Sharparam I tested on my machine and it's working, even in a clean environment. Do you have any weird setttings in your dotnet config that could be overriding my ignore lines?

@mhegreberg The PKGBUILD is already supposed to suppress that advisory as far as I can tell though?

If I put the same suppression directly in the project file for Omnisharp.MSBuild it complains about a duplicate suppression, so it seems the suppression is ignored for some reason. If so, this is maybe a bug with the SDK itself rather than this package/project.

@sharparam

Only the newer versions of the sdk turn vulnerability warnings on by default. I think that particular package is tricky to update without the rest, but I'll take a look . Worst case you can instruct dotnet to ignore the advisory until upstream can patch to he compatible. If you look in the PKGBUILD I did this for one advisory

Currently fails during build() in the PublishNet6Builds step:

========================================
PublishNet6Builds
========================================
Publishing OmniSharp.Stdio.Driver.csproj for linux-x64...
/home/sharparam/.cache/aurutils/sync/omnisharp-roslyn/src/omnisharp-roslyn/src/OmniSharp.MSBuild/OmniSharp.MSBuild.csproj : error NU1901: Warning As Error: Package 'Microsoft.Build.Tasks.Core' 17.3.2 has a known low severity vulnerability, https://github.com/advisories/GHSA-h4j7-5rxr-p4wc
Failed to publish OmniSharp.Stdio.Driver for linux-x64
An error occurred when executing task 'PublishNet6Builds'.

Upgrading the affected package to 17.8.29 makes it work. (see https://github.com/advisories/GHSA-h4j7-5rxr-p4wc)

Although curiously, if built in a clean chroot it doesn't complain about the vulnerability, not sure why that is (perhaps it's only raised in a newer SDK? Outside chroot will use the newer SDK on my system compared to inside the chroot I think).

Additionally, it seems to have problems with GitVersion:

ERROR [05/24/25 18:47:42:34] An unexpected error occurred:
System.TypeInitializationException: The type initializer for 'LibGit2Sharp.Core.NativeMethods' threw an exception. ---> System.DllNotFoundException: lib/linux-x64/libgit2-572e4d8.so assembly:<unknown assembly> type:<unknown type> member:(null)
GitVersion failed. Setting default version 1.39.13

It can still continue as the message shows by setting a fallback version, but probably something that should be looked into. If built in chroot, GitVersion still fails but without any detail of the error (just says it failed and uses a default version instead).

since this was disowned I'll take this package. there are a few upstream packages that are out of date and causing vulnerability issues. If patching these works without issue, I may just do that and update.

EDIT: the build failure issue should be fixed for now until Microsoft updates the upstream package. let me know if you encounter any issues

Build fails with vulnerability warnings

/home/user/.cache/pikaur/build/omnisharp-roslyn/src/omnisharp-roslyn/src/OmniSharp.LanguageServerProtocol/OmniSharp.LanguageServerProtocol.csproj : error NU1903: Warning As Error: Package 'Microsoft.Extensions.Caching.Memory' 8.0.0 has a known high severity vulnerability, https://github.com/advisories/GHSA-qj66-m88j-hmgj [/home/user/.cache/pikaur/build/omnisharp-roslyn/src/omnisharp-roslyn/src/OmniSharp.Stdio.Driver/OmniSharp.Stdio.Driver.csproj]

and

/home/user/.cache/pikaur/build/omnisharp-roslyn/src/omnisharp-roslyn/src/OmniSharp.LanguageServerProtocol/OmniSharp.LanguageServerProtocol.csproj : error NU1903: Warning As Error: Package 'System.Text.Json' 8.0.4 has a known high severity vulnerability, https://github.com/advisories/GHSA-8g4q-xg66-9fp4 [/home/user/.cache/pikaur/build/omnisharp-roslyn/src/omnisharp-roslyn/src/OmniSharp.Stdio.Driver/OmniSharp.Stdio.Driver.csproj]

Fails with

~/.cache/paru/clone/omnisharp-roslyn/src/omnisharp-roslyn-1.39.11/src/OmniSharp.LanguageServerProtocol/OmniSharp.LanguageServerProtocol.csproj : error NU1903: Warning As Error: Package 'System.Text.Json' 8.0.0 has a known high severity vulnerability, https://github.com/advisories/GHSA-hh2w-p6rv-4g7w [~/.cache/paru/clone/omnisharp-roslyn/src/omnisharp-roslyn-1.39.11/src/OmniSharp.Stdio.Driver/OmniSharp.Stdio.Driver.csproj]