firebase / firebase/firebase-admin-dotnet
Transitive dependency with high security vulnerabilities (Newtonsoft.Json)
Open
api: core
- Dominant language
- C#
- Stars
- 408
- Forks
- 146
- Avg merge
- 22h 7m
- Merged PRs (30d)
- 1
Description
I've run `dotnet list package --vulnerable --include-transitive`
and got this output:
```
Użyto następujących źródeł:
https://api.nuget.org/v3/index.json
Projekt „Test.Consumer” ma następujące pakiety podatne na zagrożenia
[net7.0]:
Pakiet przechodni Rozpoznane Ważność Adres URL porady
> Newtonsoft.Json 12.0.3 High https://github.com/advisories/GHSA-5crp-9r3c-p9vr
```
I'm currently using FirebaseAdmin version 2.3.0
Ideally, Newtonsoft.Json should be removed in favor of System.Text.Json (or maybe we could pick the serializer that we want to use).
Contributor guide
Assessment
This issue has not been assessed yet.