Vulnerability issue: Any update on the new version

[artkamote]

Getting vulnerability issue CVE-2019-0820 on v 4.17

[aivascu]

@artkamote thank you for raising this. I'll try to release a patch version ASAP.

[aivascu]

@artkamote have you tried installing a higher version of System.Text.RegularExpressions in your test projects?

[artkamote]

Hi @aivascu ,

I haven't installed it directly.

[aivascu]

@artkamote could you try to install it? Theoretically if you install the package into your test projects, Fare and DataAnnotations should use your local package, instead of the minimum required version.

[artkamote]

It did work except for conflict with System.Text package. ☹️
Thanks.

[jnyrup]

Fare 2.2.0 has been released with a netstandard2.1 target, which shouldn't trigger nuget scanners about a vulnerable System.Text.RegularExpressions.
As AutoFixture 4.17 doesn't have any targets that can consume a netstandard2.1 package, this won't currently change the situation.

But with AutoFixture 5 adding support for netstandard2.1 in #1331, we could bump Fare to 2.2.0 and get rid of the warning for many users of AutoFixture.

[aivascu]

The Fare dependency has been updated on the release/5.0.0 branch and is available on NuGet.org after 5.0.0-preview0006.

[Marty1703]

The same applies to System.ComponentModel.Annotations.

[aivascu]

@Marty1703 might sound stupid, but what tool are you using? 😅Just so we don't go back and forth on each transitive dependency.

[Marty1703]

Dependency-Track, but also other tools, like @artkamote used returns the same tree.

[aivascu]

@Marty1703 I wasn't aware of these tools. So far I've been able to find a feature in the dotnet CLI and some enterprise solutions nowhere near my budget. Thank you!

[aivascu]

The Fare dependency has been updated on the release/5.0.0 branch and is available on NuGet.org after 5.0.0-preview0006.