Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Vulnerability in deps chain due to Fluid.Core < 2.8.0 #4859

Open
aholmis opened this issue Apr 17, 2024 · 0 comments
Open

Vulnerability in deps chain due to Fluid.Core < 2.8.0 #4859

aholmis opened this issue Apr 17, 2024 · 0 comments

Comments

@aholmis
Copy link

aholmis commented Apr 17, 2024

Created the issue here, because this is a parent package for many.

Please upgrade references to Fluid.Core in NJsonSchema.CodeGeneration[.*] as SCA scanners report vulnerabilities (in dependencies) in versions of Fluid.Core prior to 2.8.0
Please also patch v13 of NSwag and v10 of NJsonSchema, as maybe not all are ready to move to v14/v11.

Example of dependency chain:
"NSwag.CodeGeneration.CSharp" Version="13.18.5"
"NJsonSchema.CodeGeneration.CSharp": "10.8.0"
"NJsonSchema.CodeGeneration": "10.8.0"
"Fluid.Core": "2.2.15"
"Microsoft.Extensions.FileProviders.Abstractions": "1.1.1"
"NETStandard.Library": "1.6.1"
"System.Net.Http": "4.3.0" <== Has vulnerability

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant