-
Notifications
You must be signed in to change notification settings - Fork 325
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Potential breaking change: Upgrade to exclusively use Newtonsoft.Json >= 13.0.1 #1156
Comments
My initial disposition is not to take such a change. Bond is not preventing any app from using a newer version of Newtonsoft.JSON. Both Bond and Newtonsoft.JSON are low level dependencies used across thousands and thousands of projects. Dependency resolution can be painful to deal with, and Bond strives to make this easy for consumers by having a wide range of Newtonsoft.JSON versions it can work with. Any dependency version change in Bond will have huge ripple effects. The project's policy thus far has been to be conservative about making breaking changes like this. I don't think Bond should use its dependency on Newtonsoft.JSON to "help" apps consumer newer versions of Newtonsoft.JSON, however laudable that goal may be. I'd love to get more feedback from the Bond community and see if there's a consensus one way or the other here.
|
I don't see a compelling reason to take this breaking change in Bond, so I'm going to leave Bond at the minimum version of Newtonsoft.Json that is requires. |
In the wake of a new vulnerability discovered in the Newtonsoft.Json library, it is recommended that consumers use version greater than or equal to 13.0.1. (JamesNK/Newtonsoft.Json#2457)
In order to comply with the recommendation, I propose the community to consider upgrading the dependency on Netwonsoft.Json to the recommended version. It will help all the consumers of the Bond library to make their applications and services inherently more secure.
The Bond library states it's dependency as >= 9.0.1, and consumers are free to use any version that suits their needs. While this recommendation is not incorrect, it's not in the best interests of the consumers as we have the knowledge of the Newtonsoft issue. As a best practice, the latest version of the library should be using the most secure dependencies.
If there are enough community members that agree to this proposal, I'd be happy to work with the community and contribute to the proposed change.
The text was updated successfully, but these errors were encountered: