Azure / Azure/Azure-Functions

Microsoft.Azure.Functions.Worker.Sdk pulling vulnerable Newtonsoft.Json 10.0.2

Open
#2,624 4 comments 1 reaction 0 assignees View on GitHub
bug
Dominant language
PowerShell
Stars
1.1k
Forks
215
Avg merge
4h 2m
Merged PRs (30d)
1

Description

I am trying to create a function app using Microsoft.Azure.Functions.Worker.Sdk (2.0.5). It internally tries to pull Newtonsoft.json 10.0.2 even though it is not mentioned as dependency. This newtonsoft is a vulnerable version and hence I am getting package restore error from my nuget feed.
The feed lists package 'Newtonsoft.Json.10.0.2' but multiple attempts to download the nupkg have failed. The feed is either invalid or required packages were removed while the current operation was in progress. Verify the package exists on the feed and try again.
1>Failed to restore C:\Users\jmy9smc\source\repos\WebApplication1\WebApplication1\obj\Debug\net8.0\WorkerExtensions\WorkerExtensions.csproj (in 10.37 sec).

I tried many solutions such as forcing the version in csproj file(13.0.3), setting privateassets to all, but nothing worked.

Can someone who owns this package - Microsoft.Azure.Functions.Worker.Sdk, upgrade the Newtonsoft.Json version please.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.