Nuget.ProjectModel version used in Microsoft.DotNet.Scaffolding.Shared has a high vulnerability about scaffolding HOT 8 CLOSED

Microsoft.DotNet.Scaffolding.Shared 8.0.2 has released and this was fixed 🥳 Thanks everyone for helping get this out!

from scaffolding.

Microsoft.VisualStudio.Web.CodeGeneration.Design also references NuGet packages (.Common, .Protocol) with that vulnerability, even the recently released version 8.

from scaffolding.

You are correct the affected package is a transitive dependency of many packages often many packages deep.

from scaffolding.

Any news on this? Microsoft.VisualStudio.Web.CodeGeneration.Design uses version 6.3.1, and 6.8.0 is available with no vulnerabilities. I think the references could be updated safely and repackage. A severe vulnerability will make us to uninstall this feature, and I don't know if it's possible.

Is there a workaround to update it manually?

from scaffolding.

@mcurros2 the workaround is to add the affected package as an explicit dependency which will update the transitive package.

from scaffolding.

6.8.0 is now being classified as impacted. Package should be updated to atleast 6.8.1

from scaffolding.

Please push a new version of the package with the update of NuGet.* packages

from scaffolding.

Looks good, hence closing issue.

from scaffolding.