title: ASP.NET MVC security patch to version 3.0.0.1 breaks build
body: <p>After installing the ASP.NET MVC 3 security update <a href="http://www.microsoft.com/en-us/download/details.aspx?id=44533" rel="noreferrer"><code>KB2990942</code></a> it appears the MVC version increased from <code>3.0.0.0</code> to <code>3.0.0.1</code>. This causes Visual Studio to no longer find the reference.</p>
  
  <pre><code>&lt;Reference Include="System.Web.Mvc, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL" /&gt;
  </code></pre>
  
  <p>Resharper does not show any problems but the build fails with lots of unresolved MVC types and a warning:</p>
  
  <blockquote>
    <p><strong>Warning</strong>: Could not resolve this reference. Could not locate the
    assembly "System.Web.Mvc, Version=3.0.0.0, Culture=neutral,
    PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL". Check to
    make sure the assembly exists on disk. If this reference is required
    by your code, you may get compilation errors.</p>
  </blockquote>
  
  <p>This kind of makes sense. This version no longer exists on my machine.</p>
  
  <p>I cannot guarantee the exact MVC version on dev machines, build servers and production servers. They might have <code>3.0.0.0</code> or <code>3.0.0.1</code> and this might change at any time. Windows Update might release new MVC versions at any time. Also, I don't want to increase the version number in all *.csproj files whenever an MVC update is released.</p>
  
  <p>Multiple versions are affected by the update:</p>
  
  <ul>
  <li><a href="http://support.microsoft.com/kb/2993939" rel="noreferrer">KB 2993939: Security Update for Microsoft ASP.NET MVC 2</a></li>
  <li><a href="http://support.microsoft.com/kb/2993937" rel="noreferrer">KB 2993937: Security Update for Microsoft ASP.NET MVC 3</a></li>
  <li><a href="http://support.microsoft.com/kb/2993928" rel="noreferrer">KB 2993928: Security Update for Microsoft ASP.NET MVC 4.0</a></li>
  <li><a href="http://support.microsoft.com/kb/2992080" rel="noreferrer">KB 2992080: Security Update for Microsoft ASP.NET MVC 5.0</a></li>
  </ul>
  
  <p>The security bulletin: <a href="https://technet.microsoft.com/library/security/MS14-059" rel="noreferrer">MS14-059: Vulnerability in ASP.NET MVC Could Allow Security Feature Bypass (2990942)</a></p>
  
  <p>What's the best way to deal with this situation? How can I unbreak build and production and be safe regarding future MVC updates?</p>