microsoft / microsoft/nodejstools
Microsoft.JavaScript.UnitTest references a vulnerable NewtonSoft.Json package
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 1.8k
- Forks
- 355
- PR merge metrics
- No merged PRs in 30d
Description
I use the package Microsoft.JavaScript.UnitTest 1.5.10610.1 is a C# project (ASP.NET) to run typescript tests.
The build and Visual Studio warn me about a vulnerable NewtonSoft.Json package.
NU1903 Package 'Newtonsoft.Json' 12.0.2 has a known high severity vulnerability, https://github.com/advisories/GHSA-5crp-9r3c-p9vr
As a workaround i installed Newtonsoft.Json 13.0.3 but I do my serialization using System.Text.Json.
So it would be nice to have a dependency update and a newly published package of Microsoft.JavaScript.UnitTest.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Locate the project or package definition for Microsoft.JavaScript.UnitTest and inspect how Newtonsoft.Json 12.0.2 is declared. Verify that the dependency is updated to a non-vulnerable version and that a new package can be published; the issue provides no test or file path to run.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp, typescript
- Domain
- devtools, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100