HangfireIO / HangfireIO/Hangfire
Update to newer Newtonsoft or switch to System.Text.json
- Dominant language
- C#
- Stars
- 10.1k
- Forks
- 1.8k
- Avg merge
- 1h 19m
- Merged PRs (30d)
- 1
Description
The version of Newtonsoft referenced has known vulnerabilities. Anyone referencing this has to also reference a newer version of Newtonsoft to clear security scans. My solution is Newtonsoft free and I'd rather not add packages for my dev teams to accidentally use. If possible I think it would be better to switch to System.Text.Json or extract serialization in a similar fashion to how database was done.
Thanks
Vulnerability info:
https://github.com/advisories/GHSA-5crp-9r3c-p9vr
Contributor guide
Research direction
No files, tests, or entry points are named. Start by locating the Newtonsoft reference and the serialization paths it supports, then review the linked vulnerability advisory and assess whether updating Newtonsoft or switching to System.Text.Json is feasible. Done means the vulnerability no longer appears in security scans without requiring unwanted package references for consumers.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- backend, security
- Issue type
- Refactor
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100