Skip to content

Snyk reporting DDoS vulneratibliy in the FluentMigrator.Runner.SqlServer.csproj due to v5.2.2 of the SqlClient dependency #1968

Description

@Steven-Beasley

Describe the bug
Snyk reporting that version 5.2.2 of the Microsoft.Data.SqlClient package due to it having a dependency on System.Runtime.Caching v8.0.0. The vulnerability was fixed in v8.0.1, which has been fixed in Microsoft.Data.SqlClient v6.0.1

To Reproduce
Reference the package in a project and run the snyk cli against the solution
You should get a Medium vulnerability warning https://security.snyk.io/vuln/SNYK-DOTNET-SYSTEMRUNTIMECACHING-8168846

Expected behavior
The vulnerability should not be present

Information (please complete the following information):

  • OS: Ubuntu 24.04
  • Platform dotnet v8.0
  • FluentMigrator version 6.2.0
  • FluentMigrator runner FluentMigrator.Runner.SqlServer
  • Database Management System SQLServer
  • Database Management System Version [ e.g., "SQL Server 2019 Enterprise Edition", "Oracle 18xe", etc ]

Additional context
Add any other context about the problem here.

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions