search

haf / DotNetZip.Semverd

Please use System.IO.Compression! A fork of the DotNetZip project without signing with a solution that compiles cleanly. This project aims to follow semver to avoid versioning conflicts. DotNetZip is a FAST, FREE class library and toolset for manipulating zip files. Use VB, C# or any .NET language to easily create, extract, or update zip files.
Other
545 stars 218 forks source link

Transitive dependency security issue Microsoft NetCore Platforms 3.1.1 #284

Open AFract opened 10 months ago

AFract commented 10 months ago

Hello,

DotNetZip is a great library and I am happy to see it's still maintained.

However, when importing DotNetZip.Semverd (last version) in a .Net 7 project, I have this notice : image

The related details are available here : https://devhub.checkmarx.com/cve-details/CVE-2021-31957/

Do you plan an update of the dependencies to prevent this please ?

Thank you very much