mirror of
https://github.com/junian/Standard.Licensing.git
synced 2026-04-25 05:45:51 +03:00
[GH-ISSUE #35] Update BouncyCastle to latest version #33
Labels
No labels
pull-request
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/Standard.Licensing#33
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @ahmadreza-hadidi on GitHub (Jun 29, 2024).
Original GitHub issue: https://github.com/junian/Standard.Licensing/issues/35
Hi, @junian Thank you for your good work
Please update BouncyCastle to latest version because of vulnerability in older versions
@junian commented on GitHub (Jul 1, 2024):
Hi @ahmadreza-hadidi, Can you give reference which vulnerability?
@kfrancis commented on GitHub (Jul 8, 2024):
https://github.com/advisories/GHSA-8xfc-gm6g-vgpv
https://github.com/advisories/GHSA-v435-xc8x-wvr9
https://github.com/advisories/GHSA-8xfc-gm6g-vgpv
You're also using a forked version, it looks like. Can you please use the standard version? https://www.nuget.org/packages/BouncyCastle.Cryptography
They updated it to remove the need to use the portable version when they depreciated the BouncyCastle.Crypto version.
@kfrancis commented on GitHub (Jul 8, 2024):
https://www.nuget.org/packages/BouncyCastle
@kfrancis commented on GitHub (Jul 8, 2024):
I do understand that you're using 1.9.0, but there's an official package so you don't need to reference the external repo.
@kfrancis commented on GitHub (Jul 8, 2024):
This is the other reason why it's important. Can't use packages with vulnerabilities, and can't use the standard library because yours brings in a transitive reference:
I've put a pull request together to fix all that up.
@kfrancis commented on GitHub (Jul 19, 2024):
@junian Have you had a chance to check the pull request?
@junian commented on GitHub (Jul 23, 2024):
Thank you. I'll review it soon.
@kfrancis commented on GitHub (Jul 29, 2024):
Appreciate it. It's somewhat urgent.
@junian commented on GitHub (Jul 31, 2024):
Thank you @kfrancis for the contribution, it's being validated on NuGet right now, should be available soon.
@kfrancis commented on GitHub (Aug 1, 2024):
The release works great, thank you. Also, I can confirm that the change in BouncyCastle doesn't require a change in existing licenses - they work as is.