HangfireIO / HangfireIO/Hangfire

Update to newer Newtonsoft or switch to System.Text.json

Open
#2,202 11 comments 27 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
10.1k
Forks
1.8k
Avg merge
1h 19m
Merged PRs (30d)
1

Description

The version of Newtonsoft referenced has known vulnerabilities. Anyone referencing this has to also reference a newer version of Newtonsoft to clear security scans. My solution is Newtonsoft free and I'd rather not add packages for my dev teams to accidentally use. If possible I think it would be better to switch to System.Text.Json or extract serialization in a similar fashion to how database was done.

Thanks

Vulnerability info:
https://github.com/advisories/GHSA-5crp-9r3c-p9vr

Contributor guide

Open the contributing guide

Research direction

No files, tests, or entry points are named. Start by locating the Newtonsoft reference and the serialization paths it supports, then review the linked vulnerability advisory and assess whether updating Newtonsoft or switching to System.Text.Json is feasible. Done means the vulnerability no longer appears in security scans without requiring unwanted package references for consumers.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
backend, security
Issue type
Refactor
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.