Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump System.Text.RegularExpressions to 4.3.1 #1174

Merged

Conversation

igor-toporet
Copy link
Contributor

Currently, when using Wolverine, dotnet build emits the following warning:

warning NU1903:
Package 'System.Text.RegularExpressions' 4.3.0 has a known high severity vulnerability,
https://github.com/advisories/GHSA-cmhx-cq75-c4mj    

See GHSA-cmhx-cq75-c4mj for details.

Using the following command

dotnet nuget why System.Text.RegularExpressions

I was able to trace it to the following graph:

Project '<masked>' has the following dependency graph(s) for 'System.Text.RegularExpressions':

  [net9.0]
   │
   ├─ <masked> (v1.0.0)
   │  └─ WolverineFx.Marten (v3.5.0)
   │     └─ WolverineFx.Postgresql (v3.5.0)
   │        └─ WolverineFx.RDBMS (v3.5.0)
   │           └─ System.Data.Common (v4.3.0)
   │              └─ System.Text.RegularExpressions (v4.3.0)
   ...

I checked the https://www.nuget.org/packages/System.Data.Common but it does not have a patched version after v4.3.0.

So the only option I can see is to reference it directly in WolverineFx.RDBMS.

I hope you find this valuable enough and meeting the repository standards.

@igor-toporet
Copy link
Contributor Author

I am not sure why this test failed
CoreTests.Acceptance.multi_tenancy.invoke_with_tenant_with_expected_result

@jeremydmiller jeremydmiller merged commit 325ae64 into JasperFx:main Dec 18, 2024
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants