You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
SendGrid.Extensions.DependencyInjection brings in packages with vulnerabilities. #1218
Issue SendGrid.Extensions.DependencyInjection brings in packages Newtonsoft.Json v9.0.1 and starkbank-ecdsa v1.3.1. Both of which contain vulnerabilities.
Currently we have to curcomvent this by manually including these packages with a higher version number.
<!-- These are only here because the base dependencies from SendGrid.Extensions.DependencyInjection contain vulnerabilities-->
<ItemGroup>
<PackageReferenceInclude="Newtonsoft.Json"Version="13.0.3" />
<PackageReferenceInclude="starkbank-ecdsa"Version="1.3.3" />
</ItemGroup>
Reproduce
Incude NugetPackage SendGrid.Extensions.DependencyInjection in your project.
Compile
Error NU1903 : Warning As Error: Package 'Newtonsoft.Json' 9.0.1 has a known high severity vulnerability, GHSA-5crp-9r3c-p9vr
Solution
The sendgrid client project imports the SendGrid project which has already been updated to Newtonsoft 13.0.1. All that needs to be done is to release a new package.
changed the title [-]SendGrid.Extensions.DependencyInjection brings in Newtonsoft.Json 9.0.1 which has a vulnerability.[/-][+]SendGrid.Extensions.DependencyInjection brings in packages with vulnerabilities.[/+]on Feb 21, 2025
Activity
[-]SendGrid.Extensions.DependencyInjection brings in Newtonsoft.Json 9.0.1 which has a vulnerability.[/-][+]SendGrid.Extensions.DependencyInjection brings in packages with vulnerabilities.[/+]