add CheckNugetStatus.yml and fix findings

Directory.Packages.props

@@ -61,7 +61,11 @@
     <PackageVersion Include="xunit.runner.visualstudio" Version="2.5.3"/>
     <PackageVersion Include="envdte" Version="17.7.37355" />
 
-    <PackageVersion Include="System.Memory" Version="4.5.5" />
     <PackageVersion Include="System.Buffers" Version="4.5.1" />
+    <PackageVersion Include="System.Memory" Version="4.5.5" />
+    <PackageVersion Include="System.Net.Http" Version="4.3.4" />
+    <PackageVersion Include="System.Security.Cryptography.Pkcs" Version="6.0.4" />
+    <PackageVersion Include="System.Text.Encoding.CodePages" Version="6.0.0" />
+    <PackageVersion Include="System.Text.RegularExpressions" Version="4.3.1" />
   </ItemGroup>
 </Project>

eng/CheckNugetStatus.yml

@@ -0,0 +1,72 @@
+# File: CheckNugetStatus.yml
+# the template will write lists of outdated, deprecated or vulnerable nuget packages to build log for every C# project. If a deprecated or vulnerable package is detected, an error will be written to the build log.
+# Precondition: restore and build was executed before this template is used
+# Limitation:   dotnet SDK does not provide .NET framework MSBuild targets like "Microsoft.WebApplication.targets". This c# projects will be ignored and "An error occurred for <file name of C# project>" message is added in build log.
+
+parameters:
+  condition: 'succeeded()'
+  enableQualitySteps: true
+  sourcePath: ''
+  nugetConfig: ''
+  breakBuild: false
+
+steps:
+- task: NuGetAuthenticate@0
+  condition: ${{parameters.condition}}
+  enabled: ${{parameters.enableQualitySteps}}
+
+- task: PowerShell@2
+  displayName: 'Check nuget package status'
+  inputs:
+    targetType: 'inline'
+    pwsh: true
+    script: |
+        Write-Information -MessageData "sourcePath='${{parameters.sourcePath}}'" -InformationAction Continue
+        Write-Information -MessageData "nugetConfig='${{parameters.nugetConfig}}'" -InformationAction Continue
+        Write-Information -MessageData "#########################################" -InformationAction Continue
+        if (!(Test-Path "${{parameters.nugetConfig}}" -PathType Leaf)) {
+          Write-Host "##vso[task.LogIssue type=error;]nuget config file not found."
+        }
+        if (!(Test-Path "${{parameters.sourcePath}}" -PathType Container)) {
+          Write-Host "##vso[task.LogIssue type=error;]sourcePath does not exist."
+        }
+        $existsDeprecatedPackage = $false
+        $existsVulnerablePackage = $false
+
+        $projectFiles = Get-ChildItem -Path ${{parameters.sourcePath}} -Filter *.csproj -Recurse
+        foreach ($project in $projectFiles) {
+            try {
+            $outdatedList = dotnet list $project package --outdated --include-transitive --source https://api.nuget.org/v3/index.json --config ${{parameters.nugetConfig}}
+            if ($LASTEXITCODE -gt 0)  {
+                Throw "The command exited with error code: $lastexitcode"
+            }
+            $outdatedList
+            $deprecatedList = dotnet list $project package --deprecated --include-transitive --source https://api.nuget.org/v3/index.json
+            if ($deprecatedList.Length -gt 5) {
+                $deprecatedList
+                $existsDeprecatedPackage = $true
+            } else {
+                $deprecatedList[4]
+            }
+            $vulnerableList = dotnet list $project package --vulnerable --source https://api.nuget.org/v3/index.json
+            if ($vulnerableList.Length -gt 5) {
+                $vulnerableList
+                $existsVulnerablePackage = $true
+            } else {
+                $vulnerableList[4]
+            }
+            } catch { "An error occurred for $($project.PSChildName)" }
+        }
+        if ( $existsDeprecatedPackage -or $existsVulnerablePackage) {
+            Write-Host "##vso[task.LogIssue type=error;]Detected nuget package: Deprecated = $existsDeprecatedPackage, Vulnerable =  $existsVulnerablePackage"
+            if ("${{parameters.breakBuild}}" -eq "true") {
+                exit 42
+            }
+        } else {
+            Write-Information -MessageData "Did not detected deprecated or vulnerable nuget package." -InformationAction Continue
+        }
+        exit 0
+  env:
+    SYSTEM_ACCESSTOKEN: $(System.AccessToken)
+  condition: ${{parameters.condition}}
+  enabled: ${{parameters.enableQualitySteps}}

eng/azure-pipelines.yml

@@ -37,6 +37,11 @@ jobs:
       ArtifactName: Packages
       publishLocation: Container
     condition: eq(variables['BuildConfiguration'], 'Release')
+  - template: eng/CheckNugetStatus.yml
+    parameters:
+      sourcePath: '$(Build.SourcesDirectory)/'
+      breakBuild: false
+     # nugetConfig: '$(Build.SourcesDirectory)/nuget.config'
 
 - job: macOS
   displayName: macOS

test/coverlet.core.tests/coverlet.core.tests.csproj

@@ -26,8 +26,10 @@
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
+    <PackageReference Include="System.Collections.Immutable" Version="6.0.0" />
     <PackageReference Include="System.Buffers" Version="4.5.1" />
     <PackageReference Include="System.Memory" Version="4.5.5" />
+    <PackageReference Include="System.Text.Encoding.CodePages" Version="6.0.0" />
   </ItemGroup>
 
   <ItemGroup>

test/coverlet.integration.tests/coverlet.integration.tests.csproj

@@ -16,6 +16,7 @@
     <PackageReference Include="xunit.runner.visualstudio" Version="2.5.3"/>
     <PackageReference Include="System.Buffers" Version="4.5.1" />
     <PackageReference Include="System.Memory" Version="4.5.5" />
+    <PackageReference Include="System.Security.Cryptography.Pkcs" Version="6.0.4" />
   </ItemGroup>
 
   <ItemGroup>