Update vulnerable libraries #604
Conversation
|
This is meant to be branching from https://github.com/castleproject/Core/tree/v4.4.1, so should probably not go to master, but rather a new branch |
| @@ -43,6 +43,11 @@ | |||
| <PackageReference Include="System.ComponentModel" Version="4.3.0" /> | |||
| <PackageReference Include="System.ComponentModel.TypeConverter" Version="4.3.0" /> | |||
| </ItemGroup> | |||
|
|
|||
| <ItemGroup Condition="'$(TargetFramework)'!='net35'AND'$(TargetFramework)'!='net40'"> | |||
| <PackageReference Include="System.Net.Http" Version="4.3.4" /> | |||
There was a problem hiding this comment.
These packages should probably be defined with open upper version so application layer can have higher version installed
|
Wouldn't it be way better to add netstandard2.0 / net5.0 / net6.0 compilation targets and not have any dependencies for those? |
|
I created an issue: #606 but I dont know is anybody maintaining this project? |
Yes, it would certainly be better. However, this is meant as a small non-breaking change for the V4 branch. It seems the work on V5 will resolve this issues, so this is only until then. From recent issues and comments in this repository, this is something getting more attention. And it would be easier to get dependant projects (e.g. AutoMoq) to update to a minor version. |
|
Hmm, yeah but adding new target frameworks should not be breaking change if old target frameworks are not removed. Change is easy to do, but getting maintainers attention to publish new version is difficult :( |
|
I'm going to close this until it is clear in #602 why this change should go into Castle. |
|
Can you add modern target frameworks to official castle core package and upload it to nuget please? It would be nice to avoid larger refactoring away from castle.core |
This is meant as an update for the current 4.4.1 version. Suggested version is 4.4.2 as it is only minor changes.
Aim is to update the dependencies System.Net.Http and System.Text.RegularExpressions to versions with security fixes. It is resolved in the new version 5 on master, however, with no suggested release date, this acts as an intermediary fix.
Feel free to comment, if you see this as a wrong approach, or if code needs to be altered.