Skip to content

Fix 'Microsoft.AspNetCore.Server.Kestrel.Core' 2.3.0 has a known critical severity vulnerability, https://github.com/advisories/GHSA-5rrx-jjjq-q2r5 #72

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
+4 −3
Open

Fix 'Microsoft.AspNetCore.Server.Kestrel.Core' 2.3.0 has a known critical severity vulnerability, https://github.com/advisories/GHSA-5rrx-jjjq-q2r5 #72

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,3 +10,4 @@ debug/
.env.development
.env.test
.env.production
/.vs
6 changes: 3 additions & 3 deletions src/Clerk/BackendAPI/Clerk.BackendAPI.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
<Project Sdk="Microsoft.NET.Sdk">
<Project Sdk="Microsoft.NET.Sdk">

<PropertyGroup>
<IsPackable>true</IsPackable>
Expand Down Expand Up @@ -54,9 +54,9 @@ Please see https://clerk.com/docs for more information.</Description>
</PropertyGroup>

<ItemGroup>
<PackageReference Include="newtonsoft.json" Version="13.0.3" />
<PackageReference Include="Microsoft.AspNetCore.Http" Version="2.3.0" />
Copy link

Copilot AI Nov 13, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The package Microsoft.AspNetCore.Http version 2.3.0 is severely outdated for a .NET 8.0 project and may contain security vulnerabilities. This version is from the .NET Core 2.x era (circa 2018), while the project targets .NET 8.0. The test project uses Microsoft.AspNetCore.TestHost version 8.0.11, indicating that modern ASP.NET Core 8.x packages should be used instead.

Recommendation: Update to Microsoft.AspNetCore.Http version 8.0.x (e.g., 8.0.11) to match the target framework and ensure security patches are applied. Additionally, the PR title mentions a vulnerability in Microsoft.AspNetCore.Server.Kestrel.Core, but this change adds Microsoft.AspNetCore.Http instead. Please verify that this addresses the actual vulnerability or if Microsoft.AspNetCore.Server.Kestrel.Core also needs to be referenced with an updated version.

Suggested change
<PackageReference Include="Microsoft.AspNetCore.Http" Version="2.3.0" />
<PackageReference Include="Microsoft.AspNetCore.Http" Version="8.0.11" />

Copilot uses AI. Check for mistakes.
<PackageReference Include="newtonsoft.json" Version="13.0.4" />
Copy link

Copilot AI Nov 13, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The Newtonsoft.Json package update from 13.0.3 to 13.0.4 is inconsistent with the test project's dependencies. The test project (Tests.csproj) still references Newtonsoft.Json version 13.0.3 (line 9), which could lead to version conflicts or inconsistencies during testing.

Recommendation: Also update the Newtonsoft.Json reference in Tests.csproj to version 13.0.4 to maintain consistency across the solution.

Copilot uses AI. Check for mistakes.
<PackageReference Include="nodatime" Version="3.1.9" />
<PackageReference Include="Microsoft.AspNetCore" Version="2.3.0" />
<PackageReference Include="System.IdentityModel.Tokens.Jwt" Version="8.2.0" />
<PackageReference Include="Microsoft.SourceLink.GitHub" Version="8.0.0" PrivateAssets="All"/>
</ItemGroup>
Expand Down