New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade Newtonsoft.Json to v13.0.1 or later #3924

Closed

RussKie opened this issue Jun 20, 2023 · 1 comment

Labels

needs-investigation

RussKie commented Jun 20, 2023

azure-cosmos-dotnet-v3/Microsoft.Azure.Cosmos/src/Microsoft.Azure.Cosmos.csproj

Line 120 in b1d3134

<PackageReference Include="Newtonsoft.Json" Version="10.0.2" />

Multiple Component Governance alerts marked as "High" severity are being triggered, e.g. https://dev.azure.com/dnceng/internal/_componentGovernance/Azure-dotnet-extensions-experimental/alert/7903577?typeId=15711427&pipelinesTrackingFilter=0.
See the security advisory for more information.

In general, consider using Central Package Management instead of specifying package versions in multiple places.

RussKie added the needs-investigation label

Member

ealsur commented Jun 20, 2023

Already addressed at #3313

Package won't be bumped because it is considered a breaking change.

ealsur closed this as completed

ealsur mentioned this issue

update Newtonsoft.Json package to 13.0.3 #4209

Closed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment