Skip to content

chore(deps): bump Microsoft.AspNetCore.Server.Kestrel.Core to 2.3.6 #4639

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jpnurmi merged 1 commit into from
Oct 15, 2025
Merged

chore(deps): bump Microsoft.AspNetCore.Server.Kestrel.Core to 2.3.6 #4639

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions test/Sentry.AspNetCore.TestUtils/Sentry.AspNetCore.TestUtils.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,8 +36,8 @@
<PackageReference Include="Microsoft.AspNetCore.Http" Version="2.1.22" />
<PackageReference Include="Microsoft.AspNetCore.TestHost" Version="2.1.1" />

<!-- This is needed because the version that is brought in transitively also has a vulnerability warning -->
<PackageReference Include="Microsoft.AspNetCore.Server.Kestrel.Core" Version="2.1.25" />
<!-- https://github.com/advisories/GHSA-5rrx-jjjq-q2r5 -->
<PackageReference Include="Microsoft.AspNetCore.Server.Kestrel.Core" Version="2.3.6" />
Copy link

@cursor cursor bot Oct 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Kestrel Update Causes Compatibility Issues

Updating Microsoft.AspNetCore.Server.Kestrel.Core to 2.3.6 for net48 creates a version mismatch with other 2.1.* ASP.NET Core packages in the same ItemGroup. This goes against the documented policy for .NET Framework compatibility and could cause runtime issues.

Fix in Cursor Fix in Web

Copy link
Collaborator Author

@jpnurmi jpnurmi Oct 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

According to the comment above, we deliberately chose to test with 2.1:

sentry-dotnet/test/Sentry.AspNetCore.TestUtils/Sentry.AspNetCore.TestUtils.csproj

Lines 18 to 31 in fd73ec4

<!--
ASP.NET Core on .NET Framework is supported by Microsoft indefinitely on version 2.1 only.
Indeed, version 2.1 has newer nuget packages than version 2.2 (which is out of support).
Thus, we will test on 2.1.*, not 2.*.
See https://dotnet.microsoft.com/platform/support/policy/aspnet
And https://github.com/dotnet/aspnetcore/issues/3753#issuecomment-438046364
Also, JetBrains Rider (via Checkmarx) may report the following security vulnerabilities:
CVE-2019-0815
CVE-2020-1045
CVE-2020-1597
These are safe to ignore for our tests. A real project would resolve them by installing
an updated version of the ASP.NET Core runtime on their hosting server.
See https://github.com/dotnet/aspnetcore/issues/15423
-->

However, all Microsoft.AspNetCore.Server.Kestrel.Core versions <= 2.3.0 are affected by CVE-2025-55315. The vulnerability has only been patched in version 2.3.6. The latest version in the 2.1.x series is the previously pinned version 2.1.25 from 2021.

Either we need to accept the mismatch or bump the others too...?

Copy link
Member

@Flash0ver Flash0ver Oct 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If the tests complete successfully, I prefer just bumping the vulnerable versions, and keeping everything else as "2.1.*"-y as possible.

<!-- https://github.com/advisories/GHSA-vmch-3w2x-vhgq -->
<PackageReference Include="Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets" Version="2.1.40" />

Expand Down
Loading