System.CommandLine v2.0.0

[ViktorHofer]

Full Changelog: v2.0.0-rc.2.25502.107...v2.0.0

---

This discussion was created from the release System.CommandLine v2.0.0.

[StevanFreeborn]

[m-soltani]

where Can I see the list of breaking changes compared to 2.0.0-beta4.22272.1 ?

[jeffhandley]

We have a full migration guide available here:
System.CommandLine migration guide to 2.0.0-beta5+ - .NET | Microsoft Learn

[m-soltani]

@jeffhandley thank you. This document was not known to me to date.

[KalleOlaviNiemitalo]

Now that 2.0.1 has been released, is 2.0.0 still supported in the sense that, if a vulnerability is found in it, then Microsoft will publish a security advisory?

Related #2679 (comment).

[ViktorHofer]

SCL follows the runtime servicing model so only the latest available patch version is supported. Like with System.Text.Json.

So if there's a CVE in example 2.0.1, a 2.0.2 version will be published with the fix and 2.0.0 and 2.0.1 will be marked as vulnerable on nuget.org.

NuGet Audit will then flag the vulnerability at restore time.

[KalleOlaviNiemitalo]

So if a vulnerability is found in 2.0.0 after 2.0.1 has been published, and the vulnerability does not apply to 2.0.1, will no security advisory be published?

[ViktorHofer]

Whatever is the case for other packages like System.Text.Json. AFAIK if there's an CVE, packages will get marked as vulnerable. So in this example 2.0.0 would get marked and a CVE would get published.

@rbhanda knows this process in more detail