search

pferron / Case142127-1

0 stars 0 forks source link

Update dependency Newtonsoft.Json to v13 - autoclosed #6

Closed mend-for-github-com[bot] closed 3 weeks ago

mend-for-github-com[bot] commented 2 months ago

This PR contains the following updates:

Package Type Update Change
Newtonsoft.Json (source) nuget major 9.0.1 -> 13.0.1

By merging this PR, the below vulnerabilities will be automatically resolved:

Severity CVSS Score CVE
High High 7.5 CVE-2024-21907

Release Notes

JamesNK/Newtonsoft.Json (Newtonsoft.Json) ### [`v13.0.1`](https://redirect.github.com/JamesNK/Newtonsoft.Json/releases/tag/13.0.1) [Compare Source](https://redirect.github.com/JamesNK/Newtonsoft.Json/compare/12.0.3...13.0.1) - New feature - Add JsonSelectSettings with configuration for a regex timeout - Change - Remove portable assemblies from NuGet package - Change - JsonReader and JsonSerializer MaxDepth defaults to 64 - Change - Change InvalidCastException to JsonSerializationException on mismatched JToken - Fix - Fixed throwing missing member error on ignored fields - Fix - Fixed various nullable annotations - Fix - Fixed annotations not being copied when tokens are cloned - Fix - Fixed naming strategy not being used when deserializing dictionary enum keys - Fix - Fixed serializing nullable struct dictionaries - Fix - Fixed JsonWriter.WriteToken to allow null with string token - Fix - Fixed missing error when deserializing JToken with a contract type mismatch - Fix - Fixed JTokenWriter when writing comment to an object ### [`v12.0.3`](https://redirect.github.com/JamesNK/Newtonsoft.Json/releases/tag/12.0.3) [Compare Source](https://redirect.github.com/JamesNK/Newtonsoft.Json/compare/12.0.2...12.0.3) - New feature - Added support for nullable reference types - New feature - Added KebabCaseNamingStrategy - Change - Package now uses embedded package icon - Fix - Fixed bug when merging JToken with itself - Fix - Fixed performance of calling ICustomTypeDescriptor.GetProperties - Fix - Fixed serializing Enumerable.Empty and empty arrays on .NET Core 3.0 - Fix - Fixed deserializing some collection types with constructor - Fix - Fixed deserializing IImmutableSet to ImmutableHashSet instead of ImmutableSortedSet - Fix - Fixed deserializing IImmutableDictionary to ImmutableDictionary instead of ImmutableSortedDictionary - Fix - Fixed deserializing into constructors with more than 256 parameters - Fix - Fixed hang when deserializing JTokenReader with preceding comment - Fix - Fixed JSONPath scanning with nested indexer - Fix - Fixed deserializing incomplete JSON object to JObject - Fix - Fixed using StringEnumConverter with naming strategy and specified values ### [`v12.0.2`](https://redirect.github.com/JamesNK/Newtonsoft.Json/releases/tag/12.0.2) [Compare Source](https://redirect.github.com/JamesNK/Newtonsoft.Json/compare/12.0.1...12.0.2) - New feature - Added MissingMemberHandling to JsonObjectAttribute and JsonObjectContract - New feature - Added constructor to JTokenReader to specify initial path - New feature - Added JsonProperty.IsRequiredSpecified - New feature - Added JsonContract.InternalConverter - Change - Moved embedded debug symbols in NuGet package to a symbol package on NuGet.org - Fix - Fixed deserializing nullable struct collections - Fix - Fixed memory link when serializing enums to named values - Fix - Fixed error when setting JsonLoadSettings.DuplicatePropertyNameHandling to Replace ### [`v12.0.1`](https://redirect.github.com/JamesNK/Newtonsoft.Json/releases/tag/12.0.1) [Compare Source](https://redirect.github.com/JamesNK/Newtonsoft.Json/compare/11.0.2...12.0.1) - New feature - Added NuGet package signing - New feature - Added Authenticode assembly signing - New feature - Added SourceLink support - New feature - Added constructors to StringEnumConverter for setting AllowIntegerValue - New feature - Added JsonNameTable and JsonTextReader.PropertyNameTable - New feature - Added line information to JsonSerializationException - New feature - Added JObject.Property overload with a StringComparison - New feature - Added JsonMergeSettings.PropertyNameComparison - New feature - Added support for multiple Date constructors with JavaScriptDateTimeConverter - New feature - Added support for strict equals and strict not equals in JSON Path queries - New feature - Added EncodeSpecialCharacters setting to XmlNodeConverter - New feature - Added trace message for serializing to non-writable properties - New feature - Added support for NamingStrategy to StringEnumConverter - New feature - Added JsonLoadSettings.DuplicatePropertyNameHandling setting - Change - JTokenReader now uses JsonReader.DateTimeZoneHandling setting for date values - Change - Excluded TargetSite when serializing Exceptions without SerializableAttribute - Change - Changed StringEnumConverter.ctor(bool camelCaseText) to obsolete - Change - Changed StringEnumConverter.CamelCaseText to obsolete - Fix - Fixed incorrect overflow when reading decimal values from JSON - Fix - Fixed error message when trying to deserialize an abstract serializable type - Fix - Fixed parsing decimals from a string with an exponent - Fix - Fixed losing DateTime.Kind when deserializing ISO date strings - Fix - Fixed calling constructors with ref and in parameters - Fix - Fixed rare race condition in name table when serializing - Fix - Fixed unhelpful exception message when unable to convert JSON value to DateTime - Fix - Fixed error when deserializing empty array in DataTable - Fix - Fixed deserializing empty string to empty byte array - Fix - Fixed blank extension data values with required properties and deserializing with constructor - Fix - Fixed ignored values being set in extension data when deserializing - Fix - Fixed comparing equal integer and floating point values in JSON Path - Fix - Fixed BsonReader when reading multiple content - Fix - Fixed setting extension data with existing key - Fix - Fixed including array attribute in XML with namespaces when converting JSON to XML - Fix - Fixed error when serializing ref struct properties by excluding them from serialization ### [`v11.0.2`](https://redirect.github.com/JamesNK/Newtonsoft.Json/releases/tag/11.0.2) [Compare Source](https://redirect.github.com/JamesNK/Newtonsoft.Json/compare/11.0.1...11.0.2) - Change - Revert DataContractAttribute to not force JSON object serialization (use JsonObjectAttribute instead) - Fix - Fixed JPropertyDesciptor.GetValue and SetValue to not throw for non-JObject argument - Fix - Fixed JObject ICustomTypeDescriptor.GetProperty to return the current instance - Fix - Fixed serializing FileInfo/DirectoryInfo with a JsonConverter in .NET Standard - Fix - Fixed serializing F# enums - Fix - Fixed serializing types with multiple members of the same name ### [`v11.0.1`](https://redirect.github.com/JamesNK/Newtonsoft.Json/releases/tag/11.0.1) [Compare Source](https://redirect.github.com/JamesNK/Newtonsoft.Json/compare/10.0.3...11.0.1) - New feature - Added netstandard2.0 build - New feature - Added generic JsonConverter - New feature - Added UnixDateConverter for converting Unix timestaps - New feature - Added support for regex operator in JSON Paths - New feature - Added JsonObjectAttribute.ItemNullValueHandling - New feature - Added JsonObjectContract.ItemNullValueHandling - New feature - Improved performance when resolving serialization contracts by using ConcurrentDictionary - New feature - Improved performance of JToken.Path with a faster reverse - New feature - Improved performance of parsing Int32 JSON integer values - New feature - Improved performance of parsing and writing enum names - New feature - Added IgnoreIsSpecifiedMembers to DefaultContractResolver - New feature - Added IgnoreShouldSerializeMembers to DefaultContractResolver - New feature - Added support for reading multiple comma delimited values with JsonReader.SupportMultipleContent - New feature - Improved error message when an object is reused with PreserveReferencesHandling - New feature - Added IConvertible support to netstandard1.3 - New feature - Added INotifyPropertyChanging support to netstandard1.3 - New feature - Optimized internal buffering when writing very large strings - New feature - JObject.ContainsKey is now public - New feature - Improved the error message when serialized ByRef properties - New feature - Improved the error message when serializing FileInfo/DictionaryInfo without ISerializable - New feature - Improved the error message when failing conversion in JsonReader.ReadAsInt32 and JsonReader.ReadAsDecimal - New feature - Improved the error message when deserializing badly formatted regex strings - Change - Types that implement ISerializable but don't have \[SerializableAttribute] are not serialized using ISerializable - Change - Changed JsonProperty.MemberConverter to obsolete - Change - Changed camel casing logic for all caps words to not leave last character capitalized - Change - Changed enum serialization in dictionary keys to use EnumMemberAttribute - Fix - Fixed converting default datetime in JSON to XML on netstandard1.3 - Fix - Fixed deserializing ObservableCollection in .NET Core 2.0 - Fix - Fixed incorrectly allowing static IsSpecified properties - Fix - Fixed not preserving trailing zeros when deserializing decimals - Fix - Fixed JValue.CompareTo with number and string values - Fix - Fixed not erroring when reading undefined for nullable long - Fix - Fixed serializing immutable collections when .NET 4.0 or previous Newtonsoft.Json assembly is GACed - Fix - Fixed writing null values by XmlNodeConverter and RegexConverter - Fix - Fixed deserializing with a TraceWriter when the reader is not at the start - Fix - Fixed TraceJsonWriter.WriteValue(object) writing value twice - Fix - Fixed deserializing with constructor and readonly collection property - Fix - Fixed error when writing unknown null value as JSON - Fix - Fixed merging null string values - Fix - Fixed missing CancellationToken usages in JsonTextWriter.WriteAsync - Fix - Fixed error with JsonSerializer.Populate and comments in JSON array - Fix - Fixed error handling when deserializing certain dictionary and lists - Fix - Fixed serializing collection that is nullable - Fix - Fixed JsonTextReader sync read in async method - Fix - Fixed JsonConverter not called when target type is list and token is a string - Fix - Fixed serializing a property that is defined in multiple interfaces - Fix - Fixed error when deserializing null value into ConcurrentDictionary - Fix - Fixed escaping special characters in generated JSON Paths - Fix - Fixed reading escaped special characters in JSON Paths - Fix - Fixed using extension data with dictionary that explicitly implements Add method - Fix - Fixed parsing enum name to exact casing value before falling back to case-insensitive value - Fix - Fixed DataContractAttribute not forcing object serialization of classes - Fix - Fixed bug when deserializing into existing non-IList collection - Fix - Fixed bug when deserializing into existing non-IDictionary collection - Fix - Fixed JsonReader.ReadAsInt32 with BigInteger values ### [`v10.0.3`](https://redirect.github.com/JamesNK/Newtonsoft.Json/releases/tag/10.0.3) [Compare Source](https://redirect.github.com/JamesNK/Newtonsoft.Json/compare/10.0.2...10.0.3) - New feature - Added support for deserializing XmlElement, XmlNode, XObject, XNode and XContainer with XmlNodeConverter - Change - MinClientVersion 2.12 added to NuGet package to restrict to compatible clients - Fix - Fixed JsonSerializer.Binder to not throw an error when binder instance is compatible - Fix - Fixed stack overflow when deserializing incomplete JSON to XML - Fix - Fixed JSON Path recursive descent queries - Fix - Fixed serializing ConcurrentDictionary in .NET Core 2.0 - Fix - Fixed serializing ConcurrentStack/Queue/Bag - Fix - Fixed MemoryTraceWriter thread safety - Fix - Fixed JSON Path root filter sometimes not correctly returning root token - Fix - Fixed properties with JsonIgnore not being ignored with ItemRequired - Fix - Fixed JToken.Load not reading past comment when CommentHandling is Ignore - Fix - Fixed JsonReader.ReadAsDecimal with a JValue containing a BigInteger value - Fix - Fixed converting JSON values to XML attributes to ignore current culture - Fix - Fixed converting JSON byte array data to XML - Fix - Fixed reading some types from KeyValuePairConverter incorrectly - Fix - Fixed comparing high precision decimal JValues - Fix - Fixed JsonWriter.WriteToken(JsonReader) not erroring on incomplete token - Fix - Fixed not preventing negative integers with StringEnumConverters.AllowIntegerValues ### [`v10.0.2`](https://redirect.github.com/JamesNK/Newtonsoft.Json/releases/tag/10.0.2) [Compare Source](https://redirect.github.com/JamesNK/Newtonsoft.Json/compare/10.0.1...10.0.2) - Change - .NET 4 portable class library target added back to NuGet package - Change - Changed NuGet dependencies to use NETStandard.Library 1.6.1 - Change - Changed double parsing back to double.TryParse to avoid small floating point precision errors - Fix - Fixed binary serialization of JsonException and friends - Fix - Fixed JsonLoadSettings.LineInfoHandling not being used correctly when loading JTokens - Fix - Fixed serializing IListSource implementations - Fix - Fixed handling errors when reading metadata properties during deserialization ### [`v10.0.1`](https://redirect.github.com/JamesNK/Newtonsoft.Json/releases/tag/10.0.1) [Compare Source](https://redirect.github.com/JamesNK/Newtonsoft.Json/compare/9.0.1...10.0.1) - New feature - Added async read support to JsonReader - New feature - Added async write support to JsonWriter - New feature - Added async support for loading JObject and JArray - New feature - Added non-allocating parsing of double and decimal values - New feature - Added support for TypeConverters to netstandard1.0+ - New feature - Added support for BigInteger to netstandard1.3+ - New feature - Added support for ISerializable to netstandard1.3+ - New feature - Added support for XmlDocument to netstandard1.3+ - New feature - Added support for SerializableAttribute and NonSerializedAttribute to netstandard1.3+ - New feature - Added ISerializationBinder - New feature - Added SerializationBinder properties to JsonSerializer and JsonSerializerSettings - New feature - Added TypeNameAssemblyFormatHandling - New feature - Added TypeNameAssemblyFormatHandling properties to JsonSerializer and JsonSerializerSettings - New feature - Added support for root object selector in JSONPath filters - New feature - Added support for multiple names in JSONPath scan filter - New feature - Added support for any combination of paths and values in JSONPath filter expressions - New feature - Added support for extension data names to NamingStrategy - New feature - Added ProcessExtensionDataNames flag to NamingStrategy - New feature - Added JsonWriter.AutoCompleteOnClose to control whether JSON is auto-completed on JsonWriter.Close - New feature - Added JsonReaderException constructor with path, line number, line position - New feature - Added JsonWriterException constructor with path - New feature - Added JsonReader.SetToken method overload with option not to update position array index - New feature - Added support for automatically calling single constructor on immutable structs - Change - Removed .NET 4 portable class library target from NuGet package - Change - Removed obsolete JsonConverter.GetSchema method - Change - Removed obsolete constructor from DefaultContractResolver - Change - Removed obsolete async methods from JsonConvert - Change - Removed obsolete OnDeserialized, OnDeserializing, OnSerialized, OnSerializing, OnError from JsonContract - Change - Removed obsolete JsonDictionaryContract.PropertyNameResolver - Change - Removed obsolete ConstructorParameters, OverrideConstructor, ParametrizedConstructor from JsonObjectContract - Change - Obsoleted TypeNameAssemblyFormat properties on JsonSerializer and JsonSerializerSettings - Change - Obsoleted SerializationBinder - Change - Obsoleted Binder properties on JsonSerializer and JsonSerializerSettings - Change - Obsoleted FormatterAssemblyStyle in non-full .NET targets - Change - Obsoleted Newtonsoft.Json.Bson (moved to new NuGet package) - Change - Improved constructor parameter binding on .NET Core and portable builds - Change - Improved error when attempting to convert root JSON object property to an XML attribute - Change - Changed exception thrown when parsing invalid Unicode escape sequence to JsonReaderException - Change - Changed StringEnumConverter.AllowIntegerValues to also reject reading integer strings - Change - Changed StringEnumConverter.AllowIntegerValues to also reject writing enum values with no name - Fix - Fixed JsonTextReader.ReadAsXXX methods not erroring on missing commas between values - Fix - Fixed error when serializing F# lists with F# 4.1+ - Fix - Fixed StringEnumConverter reading specified enum names that contain a comma - Fix - Fixed using a TraceWriter with nullable bytes - Fix - Fixed deserializing null Regex values - Fix - Fixed deserializing DataTable with error handling - Fix - Fixed DynamicReflectionDelegateFactory creating typed value type constructors - Fix - Fixed deserializing with type naming and complex nested generic types - Fix - Fixed error when converting certain JSON to XML on .NET Core - Fix - Fixed error handling skipping reading the next object value - Fix - Fixed date XML precision when converting certain JSON to XML on portable builds - Fix - Fixed not serializing readonly properties as references if they have corresponding creator parameters - Fix - Fixed type name being written with nullable structs and TypeNameHandling.Auto - Fix - Fixed deserializing a duplicate dictionary key from a parameterized constructor - Fix - Fixed not erroring when deserializing incomplete JSON with a parameterized constructor - Fix - Fixed incorrectly parsing scan filter when name is quoted - Fix - Fixed return type for SByte and SByteNullable in JToken.ToObject - Fix - Fixed deserializing generic only IList types with a constructor override - Fix - Fixed null reference error with ReadAsBytes and an empty JSON object - Fix - Fixed StringEnumConverter when EnumMember defines members that differ only by case - Fix - Fixed serializing protected override properties - Fix - Fixed merging null with complex type and MergeNullValueHandling.Ignore - Fix - Fixed roundtripping double.MaxValue and float.MaxValue as dictionary keys - Fix - Fixed JsonValidatingReader not closing underlying reader - Fix - Fixed writing duplicate nulls to trace with TraceJsonWriter.WriteValue for object, Uri, byte\[] - Fix - Fixed BsonWriter.WriteValue erroring for null Uri or byte\[] - Fix - Fixed not calling nullable WriteValue overloads in TraceJsonWriter - Fix - Fixed serializer not throwing an error when there is a comment followed by additional content when CheckAdditionalContent is true - Fix - Fixed JObject/JArray Parse not throwing an error when there is a comment followed by additional content - Fix - Fixed deserializing non-string values in some XML nodes - Fix - Fixed converting XML to JSON when json:Array and xmlns:json attributes are used directly on the array's element - Fix - Fixed error when attempting to populate values into read-only collection after creating object from non-default constructor