Skip to content

Avoid vulnerable System.Text.Json 8.0.0-8.0.4#171

Merged
jeremydmiller merged 1 commit intoJasperFx:mainfrom
dmytro-pryvedeniuk:avoid-vulnerable-dependencies
Mar 27, 2026
Merged

Avoid vulnerable System.Text.Json 8.0.0-8.0.4#171
jeremydmiller merged 1 commit intoJasperFx:mainfrom
dmytro-pryvedeniuk:avoid-vulnerable-dependencies

Conversation

@dmytro-pryvedeniuk
Copy link
Copy Markdown
Contributor

This PR helps to avoid JasperFx bringing vulnerable System.Text.Json 8.0.0. E.g. currently in Alba you can see

  [WRN] Restore: /home/runner/work/alba/alba/src/IdentityServer.New/IdentityServer.New.csproj : warning NU1903: Package 'System.Text.Json' 8.0.4 has a known high severity vulnerability, https://github.com/advisories/GHSA-8g4q-xg66-9fp4 [/home/runner/work/alba/alba/src/Alba.sln]
  [WRN] Restore: /home/runner/work/alba/alba/src/WebApiNet6/WebApiNet6.csproj : warning NU1903: Package 'System.Text.Json' 8.0.0 has a known high severity vulnerability, https://github.com/advisories/GHSA-8g4q-xg66-9fp4 [/home/runner/work/alba/alba/src/Alba.sln]

Dependency graph is the following

JasperFx for .net8
	Microsoft.Extensions.Hosting 8.0.0
		Microsoft.Extensions.DependencyInjection.Abstractions (>= 8.0.0)
		Microsoft.Extensions.Configuration.Json (>= 8.0.0)
			System.Text.Json (>= 8.0.0)
                

With this PR

JasperFx for .net8
	Microsoft.Extensions.Hosting 8.0.1
		Microsoft.Extensions.DependencyInjection.Abstractions (>= 8.0.2)
		Microsoft.Extensions.Configuration.Json (>= 8.0.1)
			~ no dependency on System.Text.Json

Microsoft.Extensions.Logging.Abstractions is updated to 8.0.2. Also, xunit.runner.visualstudio is updated to 3.0.0 to fix the warning

 warning NU1603: EventTests depends on xunit.runner.visualstudio (>= 2.9.2) but xunit.runner.visualstudio 2.9.2 was not found. xunit.runner.visualstudio 3.0.0 was resolved instead.

@dmytro-pryvedeniuk dmytro-pryvedeniuk changed the title Avoid vulnerable System.Text.Json 8.0.0 Avoid vulnerable System.Text.Json 8.0.0-8.0.4 Mar 26, 2026
@jeremydmiller jeremydmiller merged commit 789a475 into JasperFx:main Mar 27, 2026
1 of 2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants