Skip to content
This repository has been archived by the owner on Oct 17, 2023. It is now read-only.

Update RestSharp library version #77

Open
algorozco opened this issue Sep 18, 2019 · 18 comments
Open

Update RestSharp library version #77

algorozco opened this issue Sep 18, 2019 · 18 comments
Labels
legacy Related to legacy, non-OpenAPI SDK

Comments

@algorozco
Copy link

We have a dependency in our project that requires version 106.6.10 of RestSharp, but this SDK has a dependency on max v106.5.4.

IRN 414747

@alexmac05
Copy link
Contributor

Hi Ana,

I will look into adding more up to date restsharp versions as they come out to our potential maintenance list. Thank you for bringing that up. Honestly, you are the first customer to bring this up as something we should consider doing. I'll look into it for our maint. plan for 2020. I am sorry I can't change it quickly enough for your project, but we can look into doing this and also adding it to our todo maint list for the longer haul. I think you bring up a good point, that we should consider being on the latest version of rest sharp.

@alexmac05 alexmac05 reopened this Feb 3, 2020
@hellosign hellosign deleted a comment from hazemhamedhs Feb 3, 2020
@alexmac05
Copy link
Contributor

alexmac05 commented Feb 3, 2020

Hi Ana,

We are waiting for another version of RestSharp, which we explain in another comment. Sorry about this inconvenience. Sorry for this.

#67 (comment)

@Mitaku716
Copy link

Yea any news on this? Broke our app when we added this because even the dependencies you guys listed are incorrect. Basically had to go rework everything in our app just to accommodate HelloSign

@janetanne
Copy link
Contributor

janetanne commented Jul 30, 2020

Hi @Mitaku716:

Per this comment: #67 (comment)

We're waiting for a new version of RestSharp (likely 107) because of big backwards-incompatible changes, particularly having to do with JSON (de)serialization, which don't work with the current codebase.

Apologies for any inconvenience, but I'll make sure to follow up here with any updates.

Internal reference: 10216

@GuitarGuy11
Copy link

Hi, I have been evaluating security vulnerabilities in my company software and the dependency on RestSharp version 106.0.0 to 106.5.4 is recommended to be upgraded to 106.11.8 (106.12 is the most recent stable release). Could you please provide an update on this?

Vulnerability from Report:
Filename: RestSharp.dll | Reference: CVE-2021-27293 | CVSS Score: 7.5 | Category: CWE-697 | RestSharp < 106.11.8-alpha.0.13

I have investigated what it would take to upgrade to the latest version which has moved the JsonDeserializer to a different namespace:

HelloSign.cs:
private RestSharp.Deserializers.JsonDeserializer deserializer;
to
private RestSharp.Serialization.Json.JsonDeserializer deserializer;

@pauledrupt
Copy link

100% agree pretty sad this has not yet been actioned

@aarifResaas
Copy link

It's been almost 2 years since the initial report. I don't believe RestSharp will be releasing a 107.x anytime soon.

This limitation is preventing us from upgrading another dependency that has been deprecated for over 1 year.

@thefenry
Copy link

Any update on this? We do have some dependencies awaiting for us to upgrade to latest restsharp version.

@MichaelCrockerASG
Copy link

Is there an updated version of the HelloSign SDK that works with a later version of restsharp. A security update requires us to upgrade.

@d-thiele
Copy link

d-thiele commented Feb 4, 2022

@janetanne - any chance you can provide an update on this now that RestSharp 107.x has been released for about a month? :-)

@janetanne
Copy link
Contributor

@d-thiele no, sorry! i don't work at hellosign anymore. i'm sure one of the new API support engineers can help. write in at: [email protected]. i would email your CSM if you have one because that will be faster.

@Sora2455
Copy link

Can I add that it's really disappointing that not even the SDK version released this month supports the 106.5.4 version of RestSharp, as they've been claiming to do for at least 2 years now? I'm unable to use another dependency because of this, as it has 106.5.4 as it's minimum supported version.

@Patman0021
Copy link

PR #116 looks like it should take care of this. 2 PRs were merged 4 days ago, maybe we can finally start getting attention again!
CC: @erkkinen

@aarifResaas
Copy link

Well, almost. Although PR #116 appears to support RestSharp 107.x and v1.5.2 is now available through the NuGet repository, the library is still referencing the old 106.5.4 RestSharp as the maximum dependency version.

<PackageReference Include="RestSharp" Version="[106.0.0,106.5.4]" />

@jtreminio-dropbox jtreminio-dropbox added the legacy Related to legacy, non-OpenAPI SDK label Jun 29, 2022
@aperlstein
Copy link

Can we get an update on this?

@Dekryptid
Copy link

Is it possible to get an update on when we can expect to utilize a version that is not vulnerable?

@collinWheeler
Copy link
Contributor

The latest version of the SDK Github uses RestSharp 107. There are also two beta packages available on Github, 1.6 and 6.0. Version 1.6 used RestSharp 107, and 6.0 will have its RestSharp version updated to 107 soon.

@Dekryptid
Copy link

Thanks for the response @collinWheeler
To clarify, I was wondering when an updated NuGet package will be pushed. The 1.6 beta you mentioned, at least on NuGet, still has the nuspec restricted to restsharp 106.5.4 max.
image

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
legacy Related to legacy, non-OpenAPI SDK
Projects
None yet
Development

No branches or pull requests