From 17b50bc60eaa9694f04c8224582cf9687adf98fb Mon Sep 17 00:00:00 2001
From: David Justo <david.justo.1996@gmail.com>
Date: Wed, 29 May 2024 19:33:11 -0700
Subject: [PATCH 1/5] use framework dependency in netcoreapp3.1

---
 .../WebJobs.Extensions.DurableTask.csproj                  | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/src/WebJobs.Extensions.DurableTask/WebJobs.Extensions.DurableTask.csproj b/src/WebJobs.Extensions.DurableTask/WebJobs.Extensions.DurableTask.csproj
index 256aea537..ce25ebbcb 100644
--- a/src/WebJobs.Extensions.DurableTask/WebJobs.Extensions.DurableTask.csproj
+++ b/src/WebJobs.Extensions.DurableTask/WebJobs.Extensions.DurableTask.csproj
@@ -99,13 +99,10 @@
     <PackageReference Include="Azure.Identity" Version="1.11.0" />
     <PackageReference Include="Microsoft.Azure.WebJobs" Version="3.0.37" />
     <PackageReference Include="Microsoft.AspNetCore.Mvc.WebApiCompatShim" Version="2.2.0" />
-    <PackageReference Include="Microsoft.AspNetCore.Routing" Version="2.2.0" />
-    <PackageReference Include="Microsoft.AspNetCore.Server.Kestrel" Version="2.2.0" />
-    <PackageReference Include="Microsoft.Extensions.Azure" Version="1.1.1" />
+	<PackageReference Include="Microsoft.AspNetCore.App" />
+	<PackageReference Include="Microsoft.Extensions.Azure" Version="1.1.1" />
     <PackageReference Include="Microsoft.Extensions.Http" Version="2.2.0" />
     <PackageReference Include="Microsoft.Azure.DurableTask.ApplicationInsights" Version="0.1.*" />
-    <!-- Explicitly pinned transitive dependencies with CVE vulnerabilities.-->
-    <PackageReference Include="Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets" Version="2.2.1" />
     <!-- The gRPC dependencies in this package are not compatible with older frameworks, like .NET Core 2.x -->
     <PackageReference Include="Microsoft.DurableTask.Grpc" Version="1.1.0" />
     <PackageReference Include="Grpc.Core" Version="2.46.6" /> <!-- Bring this in until we move to hosted RPC -->

From d5f99d15a024a3227bf8c1b0d880dd7492efedef Mon Sep 17 00:00:00 2001
From: David Justo <david.justo.1996@gmail.com>
Date: Wed, 29 May 2024 19:34:34 -0700
Subject: [PATCH 2/5] add comment

---
 .../WebJobs.Extensions.DurableTask.csproj                       | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/WebJobs.Extensions.DurableTask/WebJobs.Extensions.DurableTask.csproj b/src/WebJobs.Extensions.DurableTask/WebJobs.Extensions.DurableTask.csproj
index ce25ebbcb..f47e51218 100644
--- a/src/WebJobs.Extensions.DurableTask/WebJobs.Extensions.DurableTask.csproj
+++ b/src/WebJobs.Extensions.DurableTask/WebJobs.Extensions.DurableTask.csproj
@@ -99,6 +99,8 @@
     <PackageReference Include="Azure.Identity" Version="1.11.0" />
     <PackageReference Include="Microsoft.Azure.WebJobs" Version="3.0.37" />
     <PackageReference Include="Microsoft.AspNetCore.Mvc.WebApiCompatShim" Version="2.2.0" />
+	<!-- To access Kestrel, use metapackage and leverage framework dependency on AspNetCore.
+	This allows us to avoid dependency on outdated Kestrel packages from NuGet, which may have CVEs-->
 	<PackageReference Include="Microsoft.AspNetCore.App" />
 	<PackageReference Include="Microsoft.Extensions.Azure" Version="1.1.1" />
     <PackageReference Include="Microsoft.Extensions.Http" Version="2.2.0" />

From 5fdfc69eb0482b457075d270b0615fdd959fef81 Mon Sep 17 00:00:00 2001
From: David Justo <david.justo.1996@gmail.com>
Date: Wed, 29 May 2024 19:42:52 -0700
Subject: [PATCH 3/5] fix formatting

---
 .../WebJobs.Extensions.DurableTask.csproj                   | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/WebJobs.Extensions.DurableTask/WebJobs.Extensions.DurableTask.csproj b/src/WebJobs.Extensions.DurableTask/WebJobs.Extensions.DurableTask.csproj
index f47e51218..aa48ff9a7 100644
--- a/src/WebJobs.Extensions.DurableTask/WebJobs.Extensions.DurableTask.csproj
+++ b/src/WebJobs.Extensions.DurableTask/WebJobs.Extensions.DurableTask.csproj
@@ -99,9 +99,9 @@
     <PackageReference Include="Azure.Identity" Version="1.11.0" />
     <PackageReference Include="Microsoft.Azure.WebJobs" Version="3.0.37" />
     <PackageReference Include="Microsoft.AspNetCore.Mvc.WebApiCompatShim" Version="2.2.0" />
-	<!-- To access Kestrel, use metapackage and leverage framework dependency on AspNetCore.
-	This allows us to avoid dependency on outdated Kestrel packages from NuGet, which may have CVEs-->
-	<PackageReference Include="Microsoft.AspNetCore.App" />
+    <!-- To access Kestrel, use metapackage and leverage framework dependency on AspNetCore.
+    This allows us to avoid dependency on outdated Kestrel packages from NuGet, which may have CVEs-->
+    <PackageReference Include="Microsoft.AspNetCore.App" />
 	<PackageReference Include="Microsoft.Extensions.Azure" Version="1.1.1" />
     <PackageReference Include="Microsoft.Extensions.Http" Version="2.2.0" />
     <PackageReference Include="Microsoft.Azure.DurableTask.ApplicationInsights" Version="0.1.*" />

From 2754cf74c7d029e1253a32d2c8934ab6a42262e0 Mon Sep 17 00:00:00 2001
From: David Justo <david.justo.1996@gmail.com>
Date: Wed, 29 May 2024 19:43:13 -0700
Subject: [PATCH 4/5] fix formatting further

---
 .../WebJobs.Extensions.DurableTask.csproj                       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/WebJobs.Extensions.DurableTask/WebJobs.Extensions.DurableTask.csproj b/src/WebJobs.Extensions.DurableTask/WebJobs.Extensions.DurableTask.csproj
index aa48ff9a7..47224d413 100644
--- a/src/WebJobs.Extensions.DurableTask/WebJobs.Extensions.DurableTask.csproj
+++ b/src/WebJobs.Extensions.DurableTask/WebJobs.Extensions.DurableTask.csproj
@@ -102,7 +102,7 @@
     <!-- To access Kestrel, use metapackage and leverage framework dependency on AspNetCore.
     This allows us to avoid dependency on outdated Kestrel packages from NuGet, which may have CVEs-->
     <PackageReference Include="Microsoft.AspNetCore.App" />
-	<PackageReference Include="Microsoft.Extensions.Azure" Version="1.1.1" />
+    <PackageReference Include="Microsoft.Extensions.Azure" Version="1.1.1" />
     <PackageReference Include="Microsoft.Extensions.Http" Version="2.2.0" />
     <PackageReference Include="Microsoft.Azure.DurableTask.ApplicationInsights" Version="0.1.*" />
     <!-- The gRPC dependencies in this package are not compatible with older frameworks, like .NET Core 2.x -->

From 876a207223998cece0e6cf5da5daf131e8b2b9c4 Mon Sep 17 00:00:00 2001
From: David Justo <david.justo.1996@gmail.com>
Date: Wed, 29 May 2024 19:43:49 -0700
Subject: [PATCH 5/5] fix typo

---
 .../WebJobs.Extensions.DurableTask.csproj                       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/WebJobs.Extensions.DurableTask/WebJobs.Extensions.DurableTask.csproj b/src/WebJobs.Extensions.DurableTask/WebJobs.Extensions.DurableTask.csproj
index 47224d413..34b883787 100644
--- a/src/WebJobs.Extensions.DurableTask/WebJobs.Extensions.DurableTask.csproj
+++ b/src/WebJobs.Extensions.DurableTask/WebJobs.Extensions.DurableTask.csproj
@@ -100,7 +100,7 @@
     <PackageReference Include="Microsoft.Azure.WebJobs" Version="3.0.37" />
     <PackageReference Include="Microsoft.AspNetCore.Mvc.WebApiCompatShim" Version="2.2.0" />
     <!-- To access Kestrel, use metapackage and leverage framework dependency on AspNetCore.
-    This allows us to avoid dependency on outdated Kestrel packages from NuGet, which may have CVEs-->
+    This allows us to avoid taking dependency on outdated Kestrel packages from NuGet, which may have CVEs-->
     <PackageReference Include="Microsoft.AspNetCore.App" />
     <PackageReference Include="Microsoft.Extensions.Azure" Version="1.1.1" />
     <PackageReference Include="Microsoft.Extensions.Http" Version="2.2.0" />