From b3310d27966951691e863f5a9db5b3415f2c7d68 Mon Sep 17 00:00:00 2001
From: Mikel Blanchard <mblanchard@macrosssoftware.com>
Date: Tue, 8 Oct 2024 11:32:45 -0700
Subject: [PATCH 1/3] Bump STJ to 8.0.5 on net8.0 targets.

---
 Directory.Packages.props                        | 2 +-
 src/OpenTelemetry.Exporter.Console/CHANGELOG.md | 8 +++++---
 src/OpenTelemetry.Exporter.Zipkin/CHANGELOG.md  | 8 +++++---
 3 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index 747cff1b7d1..892565c6092 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -4,7 +4,7 @@
     <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
     <OTelLatestStableVer>1.9.0</OTelLatestStableVer>
     <SystemTextEncodingsWebOutOfBandMinimumCoreAppVer>8.0.0</SystemTextEncodingsWebOutOfBandMinimumCoreAppVer>
-    <SystemTextJsonOutOfBandMinimumCoreAppVer>8.0.4</SystemTextJsonOutOfBandMinimumCoreAppVer>
+    <SystemTextJsonOutOfBandMinimumCoreAppVer>8.0.5</SystemTextJsonOutOfBandMinimumCoreAppVer>
   </PropertyGroup>
 
   <!--
diff --git a/src/OpenTelemetry.Exporter.Console/CHANGELOG.md b/src/OpenTelemetry.Exporter.Console/CHANGELOG.md
index 0a6734593e0..57758cf65e8 100644
--- a/src/OpenTelemetry.Exporter.Console/CHANGELOG.md
+++ b/src/OpenTelemetry.Exporter.Console/CHANGELOG.md
@@ -7,9 +7,11 @@ Notes](../../RELEASENOTES.md).
 ## Unreleased
 
 * Added direct reference to `System.Text.Json` for the `net8.0` target with
-  minimum version of `8.0.4` in response to
-  [CVE-2024-30105](https://github.com/advisories/GHSA-hh2w-p6rv-4g7w).
-  ([#5874](https://github.com/open-telemetry/opentelemetry-dotnet/pull/5874))
+  minimum version of `8.0.5` in response to
+  [CVE-2024-30105](https://github.com/advisories/GHSA-hh2w-p6rv-4g7w) &
+  [CVE-2024-43485](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43485).
+  ([#5874](https://github.com/open-telemetry/opentelemetry-dotnet/pull/5874),
+  [#XXXX](https://github.com/open-telemetry/opentelemetry-dotnet/pull/XXXX))
 
 ## 1.10.0-beta.1
 
diff --git a/src/OpenTelemetry.Exporter.Zipkin/CHANGELOG.md b/src/OpenTelemetry.Exporter.Zipkin/CHANGELOG.md
index bae3b61acbf..d09717aae67 100644
--- a/src/OpenTelemetry.Exporter.Zipkin/CHANGELOG.md
+++ b/src/OpenTelemetry.Exporter.Zipkin/CHANGELOG.md
@@ -7,9 +7,11 @@ Notes](../../RELEASENOTES.md).
 ## Unreleased
 
 * Added direct reference to `System.Text.Json` for the `net8.0` target with
-  minimum version of `8.0.4` in response to
-  [CVE-2024-30105](https://github.com/advisories/GHSA-hh2w-p6rv-4g7w).
-  ([#5874](https://github.com/open-telemetry/opentelemetry-dotnet/pull/5874))
+  minimum version of `8.0.5` in response to
+  [CVE-2024-30105](https://github.com/advisories/GHSA-hh2w-p6rv-4g7w) &
+  [CVE-2024-43485](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43485).
+  ([#5874](https://github.com/open-telemetry/opentelemetry-dotnet/pull/5874),
+  [#XXXX](https://github.com/open-telemetry/opentelemetry-dotnet/pull/XXXX))
 
 ## 1.10.0-beta.1
 

From 5cff27910d5900d22e332edf8de0ca4e880db80a Mon Sep 17 00:00:00 2001
From: Mikel Blanchard <mblanchard@macrosssoftware.com>
Date: Tue, 8 Oct 2024 11:52:06 -0700
Subject: [PATCH 2/3] CHANGELOG patch.

---
 src/OpenTelemetry.Exporter.Console/CHANGELOG.md | 2 +-
 src/OpenTelemetry.Exporter.Zipkin/CHANGELOG.md  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/OpenTelemetry.Exporter.Console/CHANGELOG.md b/src/OpenTelemetry.Exporter.Console/CHANGELOG.md
index 57758cf65e8..d50c0cd8be5 100644
--- a/src/OpenTelemetry.Exporter.Console/CHANGELOG.md
+++ b/src/OpenTelemetry.Exporter.Console/CHANGELOG.md
@@ -11,7 +11,7 @@ Notes](../../RELEASENOTES.md).
   [CVE-2024-30105](https://github.com/advisories/GHSA-hh2w-p6rv-4g7w) &
   [CVE-2024-43485](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43485).
   ([#5874](https://github.com/open-telemetry/opentelemetry-dotnet/pull/5874),
-  [#XXXX](https://github.com/open-telemetry/opentelemetry-dotnet/pull/XXXX))
+  [#5891](https://github.com/open-telemetry/opentelemetry-dotnet/pull/5891))
 
 ## 1.10.0-beta.1
 
diff --git a/src/OpenTelemetry.Exporter.Zipkin/CHANGELOG.md b/src/OpenTelemetry.Exporter.Zipkin/CHANGELOG.md
index d09717aae67..617098116d9 100644
--- a/src/OpenTelemetry.Exporter.Zipkin/CHANGELOG.md
+++ b/src/OpenTelemetry.Exporter.Zipkin/CHANGELOG.md
@@ -11,7 +11,7 @@ Notes](../../RELEASENOTES.md).
   [CVE-2024-30105](https://github.com/advisories/GHSA-hh2w-p6rv-4g7w) &
   [CVE-2024-43485](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43485).
   ([#5874](https://github.com/open-telemetry/opentelemetry-dotnet/pull/5874),
-  [#XXXX](https://github.com/open-telemetry/opentelemetry-dotnet/pull/XXXX))
+  [#5891](https://github.com/open-telemetry/opentelemetry-dotnet/pull/5891))
 
 ## 1.10.0-beta.1
 

From d8ba817da2dd89a4c21b09dc289fc0dcbb29b963 Mon Sep 17 00:00:00 2001
From: Mikel Blanchard <mblanchard@macrosssoftware.com>
Date: Tue, 8 Oct 2024 12:33:24 -0700
Subject: [PATCH 3/3] Tweak notes/comments.

---
 Directory.Packages.props | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index 892565c6092..a24c8c7dbe8 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -3,6 +3,8 @@
   <PropertyGroup>
     <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
     <OTelLatestStableVer>1.9.0</OTelLatestStableVer>
+
+    <!-- Mitigate https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43485. -->
     <SystemTextEncodingsWebOutOfBandMinimumCoreAppVer>8.0.0</SystemTextEncodingsWebOutOfBandMinimumCoreAppVer>
     <SystemTextJsonOutOfBandMinimumCoreAppVer>8.0.5</SystemTextJsonOutOfBandMinimumCoreAppVer>
   </PropertyGroup>
@@ -59,6 +61,11 @@
   </ItemGroup>
 
   <ItemGroup>
+    <!--
+        Note: See TargetFrameworksRequiringSystemTextJsonDirectReference for the
+        list of targets where System.Text.Json direct reference is applied.
+    -->
+
     <!--
         We use conservative versions of these packages for older runtimes where
         an upgrade might introduce breaking changes. For example see:
@@ -67,7 +74,7 @@
     <PackageVersion Include="System.Text.Encodings.Web" Version="4.7.2" />
     <PackageVersion Include="System.Text.Json" Version="4.7.2" />
 
-    <!-- Bump System.Text.Json on NETCoreApp targets to mitigate https://github.com/advisories/GHSA-hh2w-p6rv-4g7w. -->
+    <!-- Newer NETCoreApp runtimes need to be redirected to safe versions. -->
     <PackageVersion Update="System.Text.Encodings.Web" Version="$(SystemTextEncodingsWebOutOfBandMinimumCoreAppVer)" Condition="'$(TargetFrameworkIdentifier)' == '.NETCoreApp'" />
     <PackageVersion Update="System.Text.Json" Version="$(SystemTextJsonOutOfBandMinimumCoreAppVer)" Condition="'$(TargetFrameworkIdentifier)' == '.NETCoreApp'" />
   </ItemGroup>