microsoft / microsoft/AdaptiveCards
Update AdaptiveCards to support LST of Swiper (12+)
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 2k
- Forks
- 595
- Avg merge
- 1d 19h
- Merged PRs (30d)
- 1
Description
Target Platforms
Other
SDK Version
3.0.2
Application Name
not applicable
Problem Description
AdaptiveCards Swiper dependency v8 has a critical vulnerability that is resolved in latest stable versions (>v12).
Vulnerability details:
swiper@8.2.6 - Prototype Pollution Currently pinned for adaptivecards compatibility. Versions 6.5.1-12.1.1 are vulnerable, fix is 12.2.0. Advisory: GHSA-hmx5-qpq5-p643
Screenshots
No response
Card JSON
not applicable
Sample Code Language
No response
Sample Code
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Inspect the AdaptiveCards dependency manifests to find where swiper@8.2.6 is pinned and why that version is required for compatibility. Check the supported swiper release at or above 12.2.0, then run the existing AdaptiveCards build and tests to verify compatibility and confirm that the vulnerable version is no longer resolved.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100