dotnet/Silk.NET

Build warning due to vulnerable transitive System.Text.Json dependency

Morilli opened this issue · 1 comments

When using Silk.NET.Core as a dependency and compiling a project with the .NET 9 SDK, warnings regarding a vulnerability in the System.Text.Json package are shown:

> Project.csproj: Warning NU1903 : Package 'System.Text.Json' 8.0.0 has a known high severity vulnerability, https://github.com/advisories/GHSA-8g4q-xg66-9fp4

This is very annoying when multiple projects are built as the warning will be shown for each where Silk.NET.Core is a (transitive) dependency.
The cause for this seems to be that Microsoft.Extensions.DependencyModel (8.0.0), which is referenced from Silk.NET.Core, depends on System.Text.Json ≥ 8.0.0. As per the security advisory, the first patched version is 8.0.5, so bumping Microsoft.Extensions.DependencyModel to at least 8.0.2 should fix this warning.

PRs welcome.