RicoSuter / NSwag

The Swagger/OpenAPI toolchain for .NET, ASP.NET Core and TypeScript.
http://NSwag.org
MIT License
6.72k stars 1.29k forks source link

Vulnerability in deps chain due to Fluid.Core < 2.8.0 #4859

Open aholmis opened 5 months ago

aholmis commented 5 months ago

Created the issue here, because this is a parent package for many.

Please upgrade references to Fluid.Core in NJsonSchema.CodeGeneration[.*] as SCA scanners report vulnerabilities (in dependencies) in versions of Fluid.Core prior to 2.8.0 Please also patch v13 of NSwag and v10 of NJsonSchema, as maybe not all are ready to move to v14/v11.

Example of dependency chain: "NSwag.CodeGeneration.CSharp" Version="13.18.5" "NJsonSchema.CodeGeneration.CSharp": "10.8.0" "NJsonSchema.CodeGeneration": "10.8.0" "Fluid.Core": "2.2.15" "Microsoft.Extensions.FileProviders.Abstractions": "1.1.1" "NETStandard.Library": "1.6.1" "System.Net.Http": "4.3.0" <== Has vulnerability