Update RestSharp library version

[algorozco]

We have a dependency in our project that requires version 106.6.10 of RestSharp, but this SDK has a dependency on max v106.5.4.

IRN 414747

[alexmac05]

Hi Ana,

I will look into adding more up to date restsharp versions as they come out to our potential maintenance list. Thank you for bringing that up. Honestly, you are the first customer to bring this up as something we should consider doing. I'll look into it for our maint. plan for 2020. I am sorry I can't change it quickly enough for your project, but we can look into doing this and also adding it to our todo maint list for the longer haul. I think you bring up a good point, that we should consider being on the latest version of rest sharp.

[alexmac05]

Hi Ana,

We are waiting for another version of RestSharp, which we explain in another comment. Sorry about this inconvenience. Sorry for this.

#67 (comment)

[Mitaku716]

Yea any news on this? Broke our app when we added this because even the dependencies you guys listed are incorrect. Basically had to go rework everything in our app just to accommodate HelloSign

[janetanne]

Hi @Mitaku716:

Per this comment: #67 (comment)

We're waiting for a new version of RestSharp (likely 107) because of big backwards-incompatible changes, particularly having to do with JSON (de)serialization, which don't work with the current codebase.

Apologies for any inconvenience, but I'll make sure to follow up here with any updates.

Internal reference: 10216

[GuitarGuy11]

Hi, I have been evaluating security vulnerabilities in my company software and the dependency on RestSharp version 106.0.0 to 106.5.4 is recommended to be upgraded to 106.11.8 (106.12 is the most recent stable release). Could you please provide an update on this?

Vulnerability from Report:
Filename: RestSharp.dll | Reference: CVE-2021-27293 | CVSS Score: 7.5 | Category: CWE-697 | RestSharp < 106.11.8-alpha.0.13

I have investigated what it would take to upgrade to the latest version which has moved the JsonDeserializer to a different namespace:

HelloSign.cs:
private RestSharp.Deserializers.JsonDeserializer deserializer;
to
private RestSharp.Serialization.Json.JsonDeserializer deserializer;

[pauledrupt]

100% agree pretty sad this has not yet been actioned

[aarifResaas]

It's been almost 2 years since the initial report. I don't believe RestSharp will be releasing a 107.x anytime soon.

This limitation is preventing us from upgrading another dependency that has been deprecated for over 1 year.

[thefenry]

Any update on this? We do have some dependencies awaiting for us to upgrade to latest restsharp version.

[MichaelCrockerASG]

Is there an updated version of the HelloSign SDK that works with a later version of restsharp. A security update requires us to upgrade.

[d-thiele]

@janetanne - any chance you can provide an update on this now that RestSharp 107.x has been released for about a month? :-)

[janetanne]

@d-thiele no, sorry! i don't work at hellosign anymore. i'm sure one of the new API support engineers can help. write in at: apisupport@hellosign.com. i would email your CSM if you have one because that will be faster.

[Sora2455]

Can I add that it's really disappointing that not even the SDK version released this month supports the 106.5.4 version of RestSharp, as they've been claiming to do for at least 2 years now? I'm unable to use another dependency because of this, as it has 106.5.4 as it's minimum supported version.

[Patman0021]

PR #116 looks like it should take care of this. 2 PRs were merged 4 days ago, maybe we can finally start getting attention again!
CC: @erkkinen

[aarifResaas]

Well, almost. Although PR #116 appears to support RestSharp 107.x and v1.5.2 is now available through the NuGet repository, the library is still referencing the old 106.5.4 RestSharp as the maximum dependency version.

<PackageReference Include="RestSharp" Version="[106.0.0,106.5.4]" />

[aperlstein]

Can we get an update on this?

[Dekryptid]

Is it possible to get an update on when we can expect to utilize a version that is not vulnerable?

[collinWheeler]

The latest version of the SDK Github uses RestSharp 107. There are also two beta packages available on Github, 1.6 and 6.0. Version 1.6 used RestSharp 107, and 6.0 will have its RestSharp version updated to 107 soon.

[Dekryptid]

Thanks for the response @collinWheeler
To clarify, I was wondering when an updated NuGet package will be pushed. The 1.6 beta you mentioned, at least on NuGet, still has the nuspec restricted to restsharp 106.5.4 max.