Microsoft.Azure.Functions.Worker.Sdk pulling vulnerable Newtonsoft.Json 10.0.2
- Dominant language
- PowerShell
- Stars
- 1.1k
- Forks
- 215
- Avg merge
- 4h 2m
- Merged PRs (30d)
- 1
Description
I am trying to create a function app using Microsoft.Azure.Functions.Worker.Sdk (2.0.5). It internally tries to pull Newtonsoft.json 10.0.2 even though it is not mentioned as dependency. This newtonsoft is a vulnerable version and hence I am getting package restore error from my nuget feed.
The feed lists package 'Newtonsoft.Json.10.0.2' but multiple attempts to download the nupkg have failed. The feed is either invalid or required packages were removed while the current operation was in progress. Verify the package exists on the feed and try again.
1>Failed to restore C:\Users\jmy9smc\source\repos\WebApplication1\WebApplication1\obj\Debug\net8.0\WorkerExtensions\WorkerExtensions.csproj (in 10.37 sec).
I tried many solutions such as forcing the version in csproj file(13.0.3), setting privateassets to all, but nothing worked.
Can someone who owns this package - Microsoft.Azure.Functions.Worker.Sdk, upgrade the Newtonsoft.Json version please.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.