Critical vulnerability in dependency chain

[the-black-wolf]

Description

Prism.Avalonia (including prerelease) has a versioned dependency chain starting with System.Configuration.ConfigurationManager 4.7.0 which ends in package System.Drawing.Common 4.7.0 which has a known critical severity vulnerability, GHSA-rxg9-xrhp-64gj

Reference should be upgraded to the latest 8.0.0 version.

Environment

• OS: All
• Prism.Avalonia Version: 9.0.401.11110-pre, but others are affected
• Avalonia Version: 11.2.0-beta2

Severity (1-5)

3 its annoying, but also causes errors in TreatWarningsLikeErrors build configs.

Steps To Reproduce

Steps to reproduce the behavior:
Just add the package and build under latest toolkit, warning should popup:

` C:\projects\Foo\Fai\Fo\Fam.csproj : warning NU1904: Package 'System.Drawing.Common' 4.7.0 has a known critical severity vulnerability, GHSA-rxg9-xrhp-64gj

Expected Behavior

Updated references

Screenshots

n/a

Additional context

n/a

[DamianSuess]

Wonderful catch, thank you for the heads up

[the-black-wolf]

Wonderful catch, thank you for the heads up

Hm, not to be a stickler but can we expect a nuget release with the updated references. We are kind of getting our ears pulled by CI.

[DamianSuess]

@the-black-wolf, just a heads up, The 9.0 release was pulled as we are moving to be fully integrated with the Prism project. All new releases starting with 9.0 will be created over there moving forward.

[the-black-wolf]

@DamianSuess hi, can you please point me as I dont see Avalonia in the main Prism project?

[DamianSuess]

We're still working on the migration to get things published.

What's the best way to reach you to get the support you need?

[the-black-wolf]

@DamianSuess
its not that big of a deal that I would want to waste your time. I am happy to just track the progression of this, if there is an issue or a pull request I can follow. For now I added a v8 reference into project, overriding transitive one from Prism.Avalonia, to get us through the CI. I have no way of knowing if this will causes us any regression issues, but for now we are into development and not yet into CD. There is still some time left before we have to roll it out.