HangfireIO / HangfireIO/Hangfire.InMemory
Hangfire.InMemory cannot be installed in .NET 10 project with NuGet security audit enabled
- Dominant language
- C#
- Stars
- 92
- Forks
- 22
- PR merge metrics
- No merged PRs in 30d
Description
**Environment**
- .NET SDK: 10.0.101
- Hangfire.InMemory: 1.0.0
- NuGet: Central Package Management enabled (`Directory.Packages.props`)
- IDE: JetBrains Rider 2024.3 (but the issue reproduces via `dotnet restore`)
**Steps to reproduce**
1. Create a .NET 10 solution that uses Central Package Management:
```xml
true
```
2. Add `` to a project (e.g., Infrastructure.csproj).
3. Run `dotnet restore` (NuGet security auditing is on by default in the .NET 10 SDK).
**Actual result**
Restore fails with:
```
Warning As Error: Package 'Newtonsoft.Json' 11.0.1 has a known high severity vulnerability, https://github.com/advisories/GHSA-5crp-9r3c-p9vr
NuGet.PackageManagement.PackageReferenceRollbackException: Package restore failed. Rolling back package changes for 'Infrastructure'.
```
Hangfire.InMemory depends on `Hangfire.Core 1.3.4`, which in turn pulls `Newtonsoft.Json 11.0.1`. Because NuGet security audit treats this as a high severity vulnerability, restore is blocked.
**Expected result**
Hangfire.InMemory should depend on a version of `Newtonsoft.Json` without known vulnerabilities so that .NET 10 projects with auditing enabled can install it.
**Additional notes**
- The package currently only targets .NET Framework TFMs (`net461`-`net481`). A `netstandard` or `net6.0`/`net7.0` build would eliminate the need to carry legacy dependencies and would allow the package to run in modern ASP.NET Core applications without compatibility warnings.
- Until the package updates its dependency graph, anyone using default .NET 10 tooling cannot install Hangfire.InMemory.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.