HangfireIO / HangfireIO/Hangfire
Vulnerable Newtonsoft.Json dependency
- Dominant language
- C#
- Stars
- 10.1k
- Forks
- 1.8k
- Avg merge
- 1h 19m
- Merged PRs (30d)
- 1
Description
Please fix the reference to vulnerable `Newtonsoft.Json` versions, which cause build warnings/errors when building on .NET 9:
```
Package 'Newtonsoft.Json' 11.0.1 has a known high severity vulnerability, https://github.com/advisories/GHSA-5crp-9r3c-p9vr
[net9.0]
│
├─ Hangfire.AspNetCore (v1.8.15)
│ └─ Hangfire.NetCore (v1.8.15)
│ └─ Hangfire.Core (v1.8.15)
│ └─ Newtonsoft.Json (v11.0.1)
├─ Hangfire.Core (v1.8.15)
│ └─ Newtonsoft.Json (v11.0.1)
└─ Hangfire.SqlServer (v1.8.15)
└─ Hangfire.Core (v1.8.15)
└─ Newtonsoft.Json (v11.0.1)
```
Contributor guide
Research direction
Inspect the project dependency references for Newtonsoft.Json and reproduce the reported build on .NET 9. The issue is done when the vulnerable 11.0.1 reference is no longer resolved and the build warnings or errors shown here are gone.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- backend, build-system
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100