[
https://issues.apache.org/jira/browse/AVRO-3551?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18107873#comment-18107873
]
Ismaël Mejía commented on AVRO-3551:
------------------------------------
This looks already resolved on current main and can be closed as Fixed.
The request was to upgrade Newtonsoft.Json to >= 13.0.1 (WS-2022-0161). The C#
build now pins the minimum well past that: lang/csharp/versions.props sets
NewtonsoftJsonMinimumVersion to 13.0.4, and Avro.main.csproj references
Newtonsoft.Json with Version=$(NewtonsoftJsonMinimumVersion). 13.0.4 >= 13.0.1,
so the vulnerable range is no longer in use.
Recommend closing as Fixed.
> Security Vulnerability - WS-2022-0161 in Newtonsoft dependendy
> --------------------------------------------------------------
>
> Key: AVRO-3551
> URL: https://issues.apache.org/jira/browse/AVRO-3551
> Project: Apache Avro
> Issue Type: Bug
> Components: csharp
> Affects Versions: 1.11.0
> Reporter: Michael Ahrens
> Priority: Major
>
> Please upgrade Newtonsoft dependency to 13.0.1 in next version. Below
> versions have a security vulnerability: WS-2022-0161
> Thanks
> Michael
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
