Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Vulnerability in RestSharp #46

Open
RobJDavey opened this issue Sep 2, 2024 · 0 comments
Open

Vulnerability in RestSharp #46

RobJDavey opened this issue Sep 2, 2024 · 0 comments

Comments

@RobJDavey
Copy link

RobJDavey commented Sep 2, 2024

The current release of eBay.OAuth.Client has a dependency on RestSharp >= 110.2.0.
RestSharp versions < 112.0.0 have a vulnerability in them. See: GHSA-4rr6-2v9v-wcpc

This results in a build time warning:

warning NU1902: Package 'RestSharp' 110.2.0 has a known moderate severity vulnerability, https://github.com/advisories/GHSA-4rr6-2v9v-wcpc

While the >= 110.2.0 doesn't prevent you from upgrading to 112.0, upgrading to this version results in

Method not found: 'RestSharp.RestResponse RestSharp.RestClientExtensions.Execute(RestSharp.RestClient, RestSharp.RestRequest, System.Threading.CancellationToken)'.

due to breaking changes within RestSharp.

As a result, it's currently not possible for anyone using the eBay.OAuth.Client to remove this warning from their codebase.

Due to how often RestSharp updates result in breaking changes like this between major versions, ideally the dependency on RestSharp should be removed entirely, but for now an update to the version of RestSharp to the one without the vulnerability will at least remove this warning.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant