Skip to content

chore: fix vulnerable packages #4757

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 8 commits into from
Nov 26, 2025
Merged

chore: fix vulnerable packages #4757

merged 8 commits into from
Nov 26, 2025

Conversation

@Flash0ver
Copy link
Member

@Flash0ver Flash0ver commented Nov 20, 2025 •
edited
Loading

Fixes #2814

After #4756, revisiting #2814.

Fixing most vulnerabilities.

Except Hangfire.Core (through Sentry.Hangfire)

Project `Sentry.Hangfire` has the following vulnerable packages
   [net462]: 
   Transitive Package      Resolved   Severity   Advisory URL                                                                                                                                                                                                                                                                                                                                                                              
   > Newtonsoft.Json       5.0.1      High       https://github.com/advisories/GHSA-5crp-9r3c-p9vr

   [net10.0]:
   [net9.0]:
   [net8.0]:
   Transitive Package      Resolved   Severity   Advisory URL                                                                                                                                                                                                                                                                                                                                                                              
   > Newtonsoft.Json       11.0.1     High       https://github.com/advisories/GHSA-5crp-9r3c-p9vr

This is tracked via issue #4616.

Also removing some packages transitively pinned, where I believe through other changes in the meantime the vulnerable package is no longer in use.

@Flash0ver Flash0ver self-assigned this Nov 20, 2025
Flash0ver
Flash0ver commented Nov 20, 2025
View reviewed changes
Flash0ver
Flash0ver commented Nov 20, 2025
View reviewed changes
@Flash0ver Flash0ver mentioned this pull request Nov 20, 2025
Merged
@codecov
Copy link

codecov bot commented Nov 20, 2025 •
edited
Loading

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.87%. Comparing base (cf2c8cc) to head (80cffc8).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files 
@@           Coverage Diff           @@
##             main    #4757   +/-   ##
=======================================
  Coverage   73.87%   73.87%           
=======================================
  Files         485      485           
  Lines       17689    17689           
  Branches     3497     3497           
=======================================
  Hits        13068    13068           
- Misses       3759     3760    +1     
+ Partials      862      861    -1

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@Flash0ver
Copy link
Member Author

Flash0ver commented Nov 20, 2025

@sentry review

sentry[bot]
sentry bot reviewed Nov 20, 2025
View reviewed changes
@Flash0ver Flash0ver marked this pull request as ready for review November 21, 2025 11:34
jamescrosswell
jamescrosswell reviewed Nov 23, 2025
View reviewed changes
jamescrosswell
jamescrosswell approved these changes Nov 26, 2025
View reviewed changes
Copy link
Collaborator

@jamescrosswell jamescrosswell left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm happy if the analysers are happy 😉

@jamescrosswell jamescrosswell merged commit ac97aef into main Nov 26, 2025
35 checks passed
@jamescrosswell jamescrosswell deleted the chore/fix-vulnerable-packages branch November 26, 2025 21:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jamescrosswell jamescrosswell jamescrosswell approved these changes

+1 more reviewer

@sentry sentry[bot] sentry[bot] left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

@Flash0ver Flash0ver

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Fix vulnerable package dependencies

3 participants

@Flash0ver @jamescrosswell