Upgrade SIL.Core to 10.0.0 to get past the vulnerable Newtonsoft.Json - #93
Merged
Merged
Conversation
9.0.0 carries Newtonsoft.Json 11.0.1 (GHSA-5crp-9r3c-p9vr); 10.0.0 upgrades to 13.0.1, past the fix. 3.3.0 downgraded from 17.0.0 to 9.0.0 because Mono.Unix (introduced at 10.0.0 and required by every version since) has never had a stable NuGet release, which broke nuget.exe-based consumer restores while SIL.Core was a public dependency. The unreleased change following 3.3.0 made SIL.Core private and build-time-only, so that no longer applies: consumers never see SIL.Core or Mono.Unix, and dotnet restore resolves the pinned prerelease version without issue. Verified clean dotnet restore/build/test/pack (no -Prerelease flag, no new warnings, 221/221 tests passing, empty nuspec dependencies). tools/ grows by exactly one file, Mono.Unix.dll (~0.25 MB). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
imnasnainaec
approved these changes
Sep 15, 2026
imnasnainaec
left a comment
Contributor
There was a problem hiding this comment.
@imnasnainaec reviewed 3 files and all commit messages.
Reviewable status:complete! all files reviewed, all discussions resolved (waiting on tombogle).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
9.0.0 carries Newtonsoft.Json 11.0.1 (GHSA-5crp-9r3c-p9vr); 10.0.0 upgrades to 13.0.1, past the fix. 3.3.0 downgraded from 17.0.0 to 9.0.0 because Mono.Unix (introduced at 10.0.0 and required by every version since) has never had a stable NuGet release, which broke nuget.exe-based consumer restores while SIL.Core was a public dependency. The unreleased change following 3.3.0 made SIL.Core private and build-time-only, so that no longer applies: consumers never see SIL.Core or Mono.Unix, and dotnet restore resolves the pinned prerelease version without issue.
Verified clean dotnet restore/build/test/pack (no -Prerelease flag, no new warnings, 221/221 tests passing, empty nuspec dependencies). tools/ grows by exactly one file, Mono.Unix.dll (~0.25 MB).
This change is