HangfireIO / HangfireIO/Hangfire

Vulnerable Newtonsoft.Json dependency

Open
#2,472 1 comment 11 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
10.1k
Forks
1.8k
Avg merge
1h 19m
Merged PRs (30d)
1

Description

Please fix the reference to vulnerable `Newtonsoft.Json` versions, which cause build warnings/errors when building on .NET 9:

```
Package 'Newtonsoft.Json' 11.0.1 has a known high severity vulnerability, https://github.com/advisories/GHSA-5crp-9r3c-p9vr

[net9.0]

├─ Hangfire.AspNetCore (v1.8.15)
│ └─ Hangfire.NetCore (v1.8.15)
│ └─ Hangfire.Core (v1.8.15)
│ └─ Newtonsoft.Json (v11.0.1)
├─ Hangfire.Core (v1.8.15)
│ └─ Newtonsoft.Json (v11.0.1)
└─ Hangfire.SqlServer (v1.8.15)
└─ Hangfire.Core (v1.8.15)
└─ Newtonsoft.Json (v11.0.1)
```

Contributor guide

Open the contributing guide

Research direction

Inspect the project dependency references for Newtonsoft.Json and reproduce the reported build on .NET 9. The issue is done when the vulnerable 11.0.1 reference is no longer resolved and the build warnings or errors shown here are gone.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
backend, build-system
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.