search

autofac / Autofac.Extras.DynamicProxy

Interceptor and decorator support for Autofac IoC via Castle DynamicProxy
MIT License
106 stars 33 forks source link

Security vulnerability due to Castle.Core 4.4.0 dependency #51

Closed sstassen-wowcorp closed 1 year ago

sstassen-wowcorp commented 1 year ago

Dependency on Castle.Core 4.4.0 takes out a dependency on NETStandard.Library 1.6.1, which in turn depends on System.Text.RegularExpressions 4.3.0, which has a security vulnerability. See https://github.com/dotnet/announcements/issues/111

olfonur commented 1 year ago

Castle.Core version looks upgraded in the latest version. But in the latest version of package System.Text.RegularExpressions 4.3.0

tillig commented 1 year ago

Oh, yup, looks like we forgot to release. Let me get on that.

tillig commented 1 year ago

I submitted a PR to update the build a little and add a net6 target before we release so we're closer to the new Castle.Core target-wise. We'll release right after that.

olfonur commented 1 year ago

Unfortunately PR merge failed.Would you check please?

tillig commented 1 year ago

Please be patient. The build failed, but even if it had passed it hadn't been reviewed. We'll get there.

olfonur commented 1 year ago

We have a security vulnerability in one of our projects. The due date given to us is about to pass, so I'm hurrying :)

tillig commented 1 year ago

You are free to grab a pre-release from MyGet and get past that. I respect you have deadlines, but at the same time, you're getting free software from 100% unpaid volunteers doing this all in their spare time instead of spending time with families or doing other hobbies.

https://www.myget.org/F/autofac/api/v3/index.json is the feed location.

olfonur commented 1 year ago

You are doing a very valuable job. I respect. Thanks again 🙏

tillig commented 1 year ago

Sorry for the delay, v7.0.0 is out.