Skip to content

Bump the dependencies group with 12 updates#908

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/nuget/dependencies-bf76f79fdf
Open

Bump the dependencies group with 12 updates#908
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/nuget/dependencies-bf76f79fdf

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 24, 2026

Updated coverlet.msbuild from 8.0.1 to 10.0.0.

Release notes

Sourced from coverlet.msbuild's releases.

10.0.0

Improvements

  • Unique Report Filenames (coverlet.MTP and AzDO) #​1866
  • Add --coverlet-file-prefix option for unique report files #​1869
  • Introduce .NET 10 support #​1823

Fixed

  • Fix [BUG] Wrong branch rate on IAsyncEnumerable for generic type #​1836
  • Fix [BUG] Missing Coverage after moving to MTP #​1843
  • Fix [BUG] No coverage reported when targeting .NET Framework with 8.0.1 #​1842
  • Fix [BUG] Behavior changes between MTP and Legacy (msbuild) #​1878
  • Fix [BUG] Coverlet.MTP - Unable to load coverlet.mtp.appsettings.json #​1880
  • Fix [BUG] Coverlet.Collector produces empty report when Mediator.SourceGenerator is referenced #​1718 by https://github.com/yusyd
  • Fix [BUG] Crash during instrumentation (Methods using LibraryImport/DllImport have no body) #​1762

Maintenance

  • Add comprehensive async method tests and documentation for issue #​1864
  • Replace Tmds.ExecFunction Package in coverlet.core.coverage.tests #​1833
  • Add net9.0 and net10.0 targets #​1822

Diff between 8.0.1 and 10.0.0

Commits viewable in compare view.

Updated Elastic.Clients.Elasticsearch from 9.3.4 to 9.3.5.

Release notes

Sourced from Elastic.Clients.Elasticsearch's releases.

9.3.5

What's Changed

Full Changelog: elastic/elasticsearch-net@9.3.4...9.3.5

Commits viewable in compare view.

Updated FluentAssertions from 8.8.0 to 8.9.0.

Release notes

Sourced from FluentAssertions's releases.

8.9.0

What's Changed

New features

Improvements

Fixes

Documentation

Others

Commits viewable in compare view.

Updated log4net from 3.3.0 to 3.3.1.

Release notes

Sourced from log4net's releases.

3.3.1

What's Changed

New Contributors

Full Changelog: apache/logging-log4net@rel/3.3.0...rel/3.3.1
Nuget: https://www.nuget.org/packages/log4net/3.3.1

Commits viewable in compare view.

Updated Microsoft.Extensions.Http from 10.0.2 to 10.0.7.

Release notes

Sourced from Microsoft.Extensions.Http's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.NET.Test.Sdk from 18.3.0 to 18.4.0.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

18.4.0

What's Changed

New Contributors

Full Changelog: microsoft/vstest@v18.3.0...v18.4.0

Commits viewable in compare view.

Updated RabbitMQ.Client from 6.8.1 to 7.2.1.

Release notes

Sourced from RabbitMQ.Client's releases.

7.2.1

GitHub milestone

What's Changed

New Contributors

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.2.0...v7.2.1

7.2.0

GitHub milestone

What's Changed

New Contributors

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.1.2...v7.2.0

7.1.2

GitHub milestone

What's Changed

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.1.1...v7.1.2

7.1.1

GitHub milestone

What's Changed

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.1.0...v7.1.1

7.1.0

GitHub milestone

What's Changed

New Contributors

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.0.0...v7.1.0

7.1.0-alpha.1

GitHub milestone

What's Changed

New Contributors

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.0.0...v7.1.0-alpha.1

7.1.0-alpha.0

GitHub milestone

What's Changed

New Contributors

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.0.0...v7.1.0-alpha.0

7.0.0

GitHub milestone for RabbitMQ.Client version 7.0.0

What's Changed

7.0.0-rc.14

This is release candidate 14, suitable for testing in pre-production environments

What's Changed

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.0.0-rc.13...v7.0.0-rc.14

7.0.0-rc.13

This is release candidate 13, suitable for testing in pre-production environments

What's Changed

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.0.0-rc.12...v7.0.0-rc.13

7.0.0-rc.12

This is release candidate 12, suitable for testing in pre-production environments

What's Changed

New Contributors

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.0.0-rc.11...v7.0.0-rc.12

7.0.0-rc.11

This is release candidate 11, suitable for testing in pre-production environments

What's Changed

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.0.0-rc.10...v7.0.0-rc.11

7.0.0-rc.10

This is release candidate 10, suitable for testing in pre-production environments

What's Changed

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.0.0-rc.9...v7.0.0-rc.10

7.0.0-rc.9

This is release candidate 9, suitable for testing in pre-production environments

What's Changed

New Contributors

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.0.0-rc.8...v7.0.0-rc.9

7.0.0-rc.8

This is release candidate 8, suitable for testing in pre-production environments

What's Changed

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.0.0-rc.7...v7.0.0-rc.8

7.0.0-rc.7

This is release candidate 7, suitable for testing in pre-production environments

What's Changed

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.0.0-rc.6...v7.0.0-rc.7

7.0.0-rc.6

This is release candidate 6, suitable for testing in pre-production environments

What's Changed

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.0.0-rc.5...v7.0.0-rc.6

7.0.0-rc.5

This is release candidate 5, suitable for testing in pre-production environments

What's Changed

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.0.0-rc.4...v7.0.0-rc.5

7.0.0-rc.4

This is release candidate 4, suitable for testing in pre-production environments

What's Changed

New Contributors

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.0.0-rc.3...v7.0.0-rc.4

7.0.0-rc.3

This is release candidate 3, suitable for testing in pre-production environments

What's Changed

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.0.0-rc.2...v7.0.0-rc.3

7.0.0-rc.2

This is release candidate 2, suitable for testing in pre-production environments

What's Changed

New Contributors

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.0.0-alpha.6...v7.0.0-rc.2

7.0.0-rc.1

This is release candidate 1, suitable for testing in pre-production environments

What's Changed

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.0.0-alpha.6...v7.0.0-rc.1

7.0.0-alpha.6

This is an early alpha release, suitable for testing in pre-production environments

What's Changed

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.0.0-alpha.5...v7.0.0-alpha.6

7.0.0-alpha.5

This is an early alpha release, suitable for testing in pre-production environments

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.0.0-alpha.4...v7.0.0-alpha.5

7.0.0-alpha.4

This is an early alpha release, suitable for testing in pre-production environments

What's Changed

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.0.0-alpha.3...v7.0.0-alpha.4

7.0.0-alpha.3

This is an early alpha release, suitable for testing in pre-production environments

What's Changed

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.0.0-alpha.2...v7.0.0-alpha.3

7.0.0-alpha.2

What's Changed

This is an early alpha release, suitable for testing in pre-production environments. This release fixes a stack overflow error in ExchangeDeclareAsync that was reported several times:

Other fixes:

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.0.0-alpha.1...v7.0.0-alpha.2

7.0.0-alpha.1

GitHub Milestone

This alpha release includes changes from #​1347, which adds async methods to the public API, and is appropriate to test in your pre-production environments.

7.0.0-alpha.0

This is a very early pre-release of version 7. The goal is to test publishing the NuGet package from GitHub Actions.

https://www.nuget.org/packages/RabbitMQ.Client/7.0.0-alpha.0

Commits viewable in compare view.

Updated SonarAnalyzer.CSharp from 10.22.0.136894 to 10.24.0.138807.

Release notes

Sourced from SonarAnalyzer.CSharp's releases.

10.24

 This release brings a batch of false negative fixes and analyzer crash fixes.

Bug Fixes

  • NET-3596 - Fix S1144 AD0001: Index out of range exception with type named Nullable
  • NET-3522 - Fix S1215 AD0001: ArgumentOutOfRangeException
  • NET-3521 - Fix S2053 AD0001: NRE
  • NET-3520 - Fix S3267 AD0001: NRE

False Positives

  • NET-2276 - Fix S1192 FP: EF migration classes

False Negatives

  • NET-3569 - Fix T0008 and T0009 FN: Support extension blocks
  • NET-2875 - Fix S2092 FN: Null Conditional Assignment
  • NET-2857 - Fix S3330 FN: Null Conditional Assignment
  • NET-2719 - Fix S4136 FN: Extension methods
  • NET-2688 - Fix S4433 FN: Null-conditional assignment in tracker
  • NET-2675 - Fix S6418 FN: Field keyword
  • NET-2667 - Fix S2934 FN: Null-conditional assignment and field keyword
  • NET-2658 - Fix S127 FN: BitShiftCompound

10.23

This release brings a bunch of fixes! Enjoy.

Bug Fixes

  • NET-3557 - Fix SE AD0001 when SyntaxTreeOptionsProvider is null
  • NET-3519 - Fix AD0001: NRE in PropertiesAccessCorrectField

False Positives

  • NET-3532 - Fix S2583 FP: Any called two times
  • NET-3468 - Fix S1144 FP: Erroneously flagged Add() method used in Collection Initializer
  • NET-3454 - Fix S3267 FP: ref struct in foreach body cannot be captured in LINQ lambda
  • NET-3164 - Fix S125 FP: Improve semicolon heuristic
  • NET-2559 - Fix S5944 FP: When method name is also a class name of generic argument
  • NET-2438 - Fix S1067 FP: Do not raise an issue inside Equals() implementation
  • NET-1565 - Fix S1192 FP: Shouldn't raise on Dapper parameters
  • NET-1168 - Fix S1172 FP: When parameter conditionally used in local function
  • NET-52 - Fix S4017 FP: Do not raise when implementing abstract class/interface

False Negatives

  • NET-1642 - Fix S3415, S2701, S2699, S2187 FN: Support NUnit 4.0
  • NET-348 - Fix S4144 FN: Methods with generic return types

Commits viewable in compare view.

Updated System.Diagnostics.EventLog from 10.0.5 to 10.0.7.

Release notes

Sourced from System.Diagnostics.EventLog's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated System.Security.Permissions from 10.0.3 to 10.0.7.

Release notes

Sourced from System.Security.Permissions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated System.Text.Encoding.CodePages from 10.0.5 to 10.0.7.

Release notes

Sourced from System.Text.Encoding.CodePages's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated System.Text.Json from 10.0.5 to 10.0.7.

Release notes

Sourced from System.Text.Json's releases.

No release notes found for this version range.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps coverlet.msbuild from 8.0.1 to 10.0.0
Bumps Elastic.Clients.Elasticsearch from 9.3.4 to 9.3.5
Bumps FluentAssertions from 8.8.0 to 8.9.0
Bumps log4net from 3.3.0 to 3.3.1
Bumps Microsoft.Extensions.Http from 10.0.2 to 10.0.7
Bumps Microsoft.NET.Test.Sdk from 18.3.0 to 18.4.0
Bumps RabbitMQ.Client from 6.8.1 to 7.2.1
Bumps SonarAnalyzer.CSharp from 10.22.0.136894 to 10.24.0.138807
Bumps System.Diagnostics.EventLog from 10.0.5 to 10.0.7
Bumps System.Security.Permissions from 10.0.3 to 10.0.7
Bumps System.Text.Encoding.CodePages from 10.0.5 to 10.0.7
Bumps System.Text.Json from 10.0.5 to 10.0.7

---
updated-dependencies:
- dependency-name: coverlet.msbuild
  dependency-version: 10.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: Elastic.Clients.Elasticsearch
  dependency-version: 9.3.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: FluentAssertions
  dependency-version: 8.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: log4net
  dependency-version: 3.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: Microsoft.Extensions.Http
  dependency-version: 10.0.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: RabbitMQ.Client
  dependency-version: 7.2.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: SonarAnalyzer.CSharp
  dependency-version: 10.24.0.138807
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: System.Diagnostics.EventLog
  dependency-version: 10.0.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: System.Security.Permissions
  dependency-version: 10.0.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: System.Text.Encoding.CodePages
  dependency-version: 10.0.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: System.Text.Json
  dependency-version: 10.0.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added .NET Pull requests that update .net code dependencies Pull requests that update a dependency file nuget packages labels Apr 24, 2026
@guibranco guibranco enabled auto-merge (squash) April 24, 2026 15:35
@gstraccini gstraccini Bot added the ☑️ auto-merge Automatic merging of pull requests (gstraccini-bot) label Apr 24, 2026
@github-actions github-actions Bot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Apr 24, 2026
Copy link
Copy Markdown
Owner

@guibranco guibranco left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Automatically approved by gstraccini[bot]

@gstraccini gstraccini Bot added the 🤖 bot Automated processes or integrations label Apr 24, 2026
@github-actions
Copy link
Copy Markdown
Contributor

Infisical secrets check: ✅ No secrets leaked!

💻 Scan logs
2026-04-24T15:36:08Z INF scanning for exposed secrets...
3:36PM INF 797 commits scanned.
2026-04-24T15:36:09Z INF scan completed in 1.21s
2026-04-24T15:36:09Z INF no leaks found

@socket-security
Copy link
Copy Markdown

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Block Medium
System shell access: nuget coverlet.msbuild

Location: Package overview

From: Tests/CrispyWaffle.I18n.PtBr.Tests/CrispyWaffle.I18n.PtBr.Tests.csprojnuget/coverlet.msbuild@10.0.0

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/coverlet.msbuild@10.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Dynamic code execution: nuget coverlet.msbuild

Location: Package overview

From: Tests/CrispyWaffle.I18n.PtBr.Tests/CrispyWaffle.I18n.PtBr.Tests.csprojnuget/coverlet.msbuild@10.0.0

ℹ Read more on: This package | This alert | What is dynamic code execution?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/coverlet.msbuild@10.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Dynamic code execution: nuget elastic.esql

Location: Package overview

From: Src/CrispyWaffle.ElasticSearch/CrispyWaffle.ElasticSearch.csprojnuget/elastic.clients.elasticsearch@9.3.5nuget/elastic.esql@0.11.0

ℹ Read more on: This package | This alert | What is dynamic code execution?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/elastic.esql@0.11.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: nuget elastic.transport

Location: Package overview

From: Src/CrispyWaffle.ElasticSearch/CrispyWaffle.ElasticSearch.csprojnuget/elastic.clients.elasticsearch@9.3.5nuget/elastic.transport@0.16.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/elastic.transport@0.16.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Dynamic code execution: nuget elastic.transport

Location: Package overview

From: Src/CrispyWaffle.ElasticSearch/CrispyWaffle.ElasticSearch.csprojnuget/elastic.clients.elasticsearch@9.3.5nuget/elastic.transport@0.16.0

ℹ Read more on: This package | This alert | What is dynamic code execution?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/elastic.transport@0.16.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: nuget log4net

Location: Package overview

From: Src/CrispyWaffle.Log4Net/CrispyWaffle.Log4Net.csprojnuget/log4net@3.3.1

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/log4net@3.3.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Dynamic code execution: nuget log4net

Location: Package overview

From: Src/CrispyWaffle.Log4Net/CrispyWaffle.Log4Net.csprojnuget/log4net@3.3.1

ℹ Read more on: This package | This alert | What is dynamic code execution?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/log4net@3.3.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: nuget microsoft.codecoverage

Location: Package overview

From: Tests/CrispyWaffle.I18n.PtBr.Tests/CrispyWaffle.I18n.PtBr.Tests.csprojnuget/microsoft.net.test.sdk@18.4.0nuget/microsoft.codecoverage@18.4.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/microsoft.codecoverage@18.4.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
System shell access: nuget microsoft.codecoverage

Location: Package overview

From: Tests/CrispyWaffle.I18n.PtBr.Tests/CrispyWaffle.I18n.PtBr.Tests.csprojnuget/microsoft.net.test.sdk@18.4.0nuget/microsoft.codecoverage@18.4.0

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/microsoft.codecoverage@18.4.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Dynamic code execution: nuget microsoft.codecoverage

Location: Package overview

From: Tests/CrispyWaffle.I18n.PtBr.Tests/CrispyWaffle.I18n.PtBr.Tests.csprojnuget/microsoft.net.test.sdk@18.4.0nuget/microsoft.codecoverage@18.4.0

ℹ Read more on: This package | This alert | What is dynamic code execution?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/microsoft.codecoverage@18.4.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: nuget microsoft.extensions.http

Location: Package overview

From: Src/CrispyWaffle.HttpClient/CrispyWaffle.HttpClient.csprojnuget/microsoft.extensions.http@10.0.7

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/microsoft.extensions.http@10.0.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
System shell access: nuget microsoft.extensions.http

Location: Package overview

From: Src/CrispyWaffle.HttpClient/CrispyWaffle.HttpClient.csprojnuget/microsoft.extensions.http@10.0.7

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/microsoft.extensions.http@10.0.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Dynamic code execution: nuget microsoft.extensions.http

Location: Package overview

From: Src/CrispyWaffle.HttpClient/CrispyWaffle.HttpClient.csprojnuget/microsoft.extensions.http@10.0.7

ℹ Read more on: This package | This alert | What is dynamic code execution?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/microsoft.extensions.http@10.0.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
System shell access: nuget microsoft.testplatform.objectmodel

Location: Package overview

From: Tests/CrispyWaffle.I18n.PtBr.Tests/CrispyWaffle.I18n.PtBr.Tests.csprojnuget/microsoft.net.test.sdk@18.4.0nuget/microsoft.testplatform.objectmodel@18.4.0

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/microsoft.testplatform.objectmodel@18.4.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Dynamic code execution: nuget microsoft.testplatform.objectmodel

Location: Package overview

From: Tests/CrispyWaffle.I18n.PtBr.Tests/CrispyWaffle.I18n.PtBr.Tests.csprojnuget/microsoft.net.test.sdk@18.4.0nuget/microsoft.testplatform.objectmodel@18.4.0

ℹ Read more on: This package | This alert | What is dynamic code execution?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/microsoft.testplatform.objectmodel@18.4.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: nuget microsoft.testplatform.testhost

Location: Package overview

From: Tests/CrispyWaffle.I18n.PtBr.Tests/CrispyWaffle.I18n.PtBr.Tests.csprojnuget/microsoft.net.test.sdk@18.4.0nuget/microsoft.testplatform.testhost@18.4.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/microsoft.testplatform.testhost@18.4.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
System shell access: nuget microsoft.testplatform.testhost

Location: Package overview

From: Tests/CrispyWaffle.I18n.PtBr.Tests/CrispyWaffle.I18n.PtBr.Tests.csprojnuget/microsoft.net.test.sdk@18.4.0nuget/microsoft.testplatform.testhost@18.4.0

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/microsoft.testplatform.testhost@18.4.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Dynamic code execution: nuget microsoft.testplatform.testhost

Location: Package overview

From: Tests/CrispyWaffle.I18n.PtBr.Tests/CrispyWaffle.I18n.PtBr.Tests.csprojnuget/microsoft.net.test.sdk@18.4.0nuget/microsoft.testplatform.testhost@18.4.0

ℹ Read more on: This package | This alert | What is dynamic code execution?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/microsoft.testplatform.testhost@18.4.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: nuget sonaranalyzer.csharp

Location: Package overview

From: Src/CrispyWaffle.Configuration/CrispyWaffle.Configuration.csprojnuget/sonaranalyzer.csharp@10.24.0.138807

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/sonaranalyzer.csharp@10.24.0.138807. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
System shell access: nuget sonaranalyzer.csharp

Location: Package overview

From: Src/CrispyWaffle.Configuration/CrispyWaffle.Configuration.csprojnuget/sonaranalyzer.csharp@10.24.0.138807

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/sonaranalyzer.csharp@10.24.0.138807. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Dynamic code execution: nuget sonaranalyzer.csharp

Location: Package overview

From: Src/CrispyWaffle.Configuration/CrispyWaffle.Configuration.csprojnuget/sonaranalyzer.csharp@10.24.0.138807

ℹ Read more on: This package | This alert | What is dynamic code execution?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/sonaranalyzer.csharp@10.24.0.138807. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
System shell access: nuget system.diagnostics.eventlog

Location: Package overview

From: Src/CrispyWaffle.EventLog/CrispyWaffle.EventLog.csprojnuget/system.diagnostics.eventlog@10.0.7

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/system.diagnostics.eventlog@10.0.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Dynamic code execution: nuget system.diagnostics.eventlog

Location: Package overview

From: Src/CrispyWaffle.EventLog/CrispyWaffle.EventLog.csprojnuget/system.diagnostics.eventlog@10.0.7

ℹ Read more on: This package | This alert | What is dynamic code execution?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/system.diagnostics.eventlog@10.0.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Dynamic code execution: nuget system.text.encoding.codepages

Location: Package overview

From: Src/CrispyWaffle.Elmah/CrispyWaffle.Elmah.csprojnuget/system.text.encoding.codepages@10.0.7

ℹ Read more on: This package | This alert | What is dynamic code execution?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/system.text.encoding.codepages@10.0.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
System shell access: nuget system.threading.ratelimiting

Location: Package overview

From: Src/CrispyWaffle.RabbitMQ/CrispyWaffle.RabbitMQ.csprojnuget/rabbitmq.client@7.2.1nuget/system.threading.ratelimiting@8.0.0

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/system.threading.ratelimiting@8.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Dynamic code execution: nuget system.threading.ratelimiting

Location: Package overview

From: Src/CrispyWaffle.RabbitMQ/CrispyWaffle.RabbitMQ.csprojnuget/rabbitmq.client@7.2.1nuget/system.threading.ratelimiting@8.0.0

ℹ Read more on: This package | This alert | What is dynamic code execution?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/system.threading.ratelimiting@8.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

See 21 more rows in the dashboard

View full report

@AppVeyorBot
Copy link
Copy Markdown

Build CrispyWaffle 10.0.1572 failed (commit a66c1e0f57 by @dependabot[bot])

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

☑️ auto-merge Automatic merging of pull requests (gstraccini-bot) 🤖 bot Automated processes or integrations dependencies Pull requests that update a dependency file .NET Pull requests that update .net code nuget packages size/S Denotes a PR that changes 10-29 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants