Skip to content

Conversation

@Flash0ver
Copy link
Member

@Flash0ver Flash0ver commented Nov 20, 2025

Fixes #2814


After #4756, revisiting #2814.

Fixing most vulnerabilities.

Except Hangfire.Core (through Sentry.Hangfire)

Project `Sentry.Hangfire` has the following vulnerable packages
   [net462]: 
   Transitive Package      Resolved   Severity   Advisory URL                                                                                                                                                                                                                                                                                                                                                                              
   > Newtonsoft.Json       5.0.1      High       https://github.com/advisories/GHSA-5crp-9r3c-p9vr

   [net10.0]:
   [net9.0]:
   [net8.0]:
   Transitive Package      Resolved   Severity   Advisory URL                                                                                                                                                                                                                                                                                                                                                                              
   > Newtonsoft.Json       11.0.1     High       https://github.com/advisories/GHSA-5crp-9r3c-p9vr

This is tracked via issue #4616.

Also removing some packages transitively pinned, where I believe through other changes in the meantime the vulnerable package is no longer in use.

@Flash0ver Flash0ver self-assigned this Nov 20, 2025
@codecov
Copy link

codecov bot commented Nov 20, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.84%. Comparing base (356f8e9) to head (d376daf).

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #4757      +/-   ##
==========================================
- Coverage   73.85%   73.84%   -0.01%     
==========================================
  Files         485      485              
  Lines       17689    17689              
  Branches     3496     3496              
==========================================
- Hits        13064    13063       -1     
- Misses       3765     3769       +4     
+ Partials      860      857       -3     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@Flash0ver
Copy link
Member Author

@sentry review

@Flash0ver Flash0ver marked this pull request as ready for review November 21, 2025 11:34
<PackageReference Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="4.3.0"/>
</ItemGroup>
<ItemGroup>
<PackageReference Include="Microsoft.CodeAnalysis.CSharp.Analyzer.Testing" Version="1.1.3-beta1.25564.1" />
Copy link
Collaborator

@jamescrosswell jamescrosswell Nov 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

beta??? Should we stick to the stable packages?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Fix vulnerable package dependencies

3 participants