search

madelson / DistributedLock

A .NET library for distributed synchronization
MIT License
1.75k stars 182 forks source link

Update minimum SqlClient versions to avoid vulnerability #149

Closed madelson closed 11 months ago

madelson commented 1 year ago

See https://github.com/advisories/GHSA-8g2p-5pqh-5jmc

Obviously app consumers can perform the update themselves since we just set a lower bound, but by updating we can be sure that we won't bring a bad version in transitively.

jinghua395 commented 1 year ago

Hi,

I would like to upvote this issue.

As I have tried to run this lib in Linux, and it crashed my app, as the current version Microsoft.Data.SqlClient 2.2.0 is not compatible with Linux.

madelson commented 1 year ago

@jinghua395 thanks for the feedback. The library specifies a lower bound so you can install a higher version of Microsoft.Data.SqlClient in your app just by adding a package reference.

I wasn't aware that 2.2 didn't support Linux; do you know what version adds Linux support?

I'm reluctant to require version 5+ given this issue.