Upgrade Vulnerable BouncyCastle and ImageSharp libraries

[MichelZ]

Is there an existing issue for this?

• [X] I have searched the existing issues

Description

We get vulnerability warnings in a scan of the built containers about packages with vulnerabilities being used:

BouncyCasle.Cryptography library version 2.2.1 Please find vulnerability information here: https://github.com/advisories/GHSA-m44j-cfrm-g8qc Please update this library to at least Version 2.3.1, It seems to be referenced in Volo.Abp.Commercial.Core

SixLabors.ImageSharp library version 3.1.4 Please find vulnerability information here: https://github.com/advisories/GHSA-63p8-c4ww-9cg7 https://github.com/advisories/GHSA-qxrv-gp6x-rc23

Please update this library to as least Version 3.1.5, it seems to be referenced in Volo.Abp.Imaging.ImageSharp

Thanks!

Reproduction Steps

No response

Expected behavior

No response

Actual behavior

No response

Regression?

No response

Known Workarounds

No response

Version

8.3.1

User Interface

Angular

Database Provider

EF Core (Default)

Tiered or separate authentication server

Separate Auth Server

Operation System

Linux

Other information

No response

[maliming]

Already fixed by https://github.com/abpframework/abp/pull/20960

[MichelZ]

@maliming While I can see Imagesharp, I would like to make sure that BouncyCastle was not missed in the Volo.Abp.Commercial.Core package, as it's not in that PR. Thanks

[maliming]

hi

We also update the Volo.Abp.Commercial.Core in private repos.

Thanks