[Bug]: CVE affecting legacy .NET versions, fix in main branch is unreleased

[derekm]

Describe the bug 🐞

A CVE happened affecting .NET versions prior to .NET 8.0.6. GitHub's advisory

Force-upgrade to System.Text.Json 8.0.4 for legacy frameworks should be released as Refit 7.1.3.

Step to reproduce

1. Include Refit in a new .NET project
2. Security scan project
3. See "HIGH" denial-of-service vulnerability

Reproduction repository

https://github.com/reactiveui/refit

Expected behavior

Recent releases should be free of HIGH vulns.

Screenshots 🖼️

No response

IDE

No response

Operating system

No response

Version

No response

Device

No response

Refit Version

7.1.2

Additional information ℹ️

Refit main branch force-upgrades to System.Text.Json 8.0.4 for netstandard2.0 or net462, and this should be released ASAP as Refit 7.1.3.

[ChrisPulman]

Hi, thank you for raising this however, for .net6/8 we don't take a dependency on this package, please use net 8.0.6+ to resolve this issue. We have a dependency for netstandard2.0 and netframework as this is the only way we can use the functionality provided.
Therefore this is not a bug in Refit but a bug in the net 8.0 libraries.

[derekm]

We have a dependency for netstandard2.0 and netframework as this is the only way we can use the functionality provided.

My bug description is wrong, so I will edit it.

My security scanner is ignoring my use of net8.0-latest, and it is seeing your use of System.Text.Json 8.0.3 in the legacy frameworks. In main branch, you've updated legacy frameworks to System.Text.Json 8.0.4.

The bug is that you haven't released the 8.0.4 force-upgrade for legacy frameworks as Refit 7.1.3.

Cf., https://www.nuget.org/packages/Refit#dependencies-body-tab where it says, "System.Text.Json (>= 8.0.3)". Refit 7.1.3 will say, "System.Text.Json (>= 8.0.4)".

[ChrisPulman]

At the moment we are working to apply a new code signing certificate, as soon as this is complete we will be making a release. Thank you for your feedback.

[Russ256]

The 7.2.0 release notes say this has been fixed, but looks like the pr never got merged so this is still an issue.

[ChrisPulman]

[Russ256]

This affects all versions, I'm getting a cve issue raised on a .net 8 project. The linked pr looks like the fix but was never merged.

[ChrisPulman]

Please update to 7.2.1 this issue should be resolved, thank you

[github-actions]

This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.