Newtonsoft.Json 9.0.1 has known vulnerability. Can it be updated?

[taurit]

Hi!

NBGV tool seems to currently rely on Newtonsoft.Json 9.0.1:

<PackageReference Include="Newtonsoft.Json" Version="9.0.1" />

This version has a known vulnerability reported by some scanners. Here's an alert from WhiteSource/Mend scanner:

WS-2022-0161
Improper Handling of Exceptional Conditions in Newtonsoft.Json. Newtonsoft.Json prior to version 13.0.1 is vulnerable to Insecure Defaults (...)

This vulnerability might not be exploitable in scenario where Nerdbank.GitVersioning is typically used, but nevertheless, it generates alerts and makes it problematic to use in corporate environments ;) Is there any way that this reference could be bumped up to the most recent version? 13.0.1 fixes this problem.

[KalleOlaviNiemitalo]

Dependabot suggested the same in #777, but that was closed

[taurit]

Thanks for the link, I see there is no comment in the Pull Request on why it was closed. Maybe it can be re-considered...

[AArnott]

Yes, we should be able to fix this. At least for nbgv.

[AArnott]

This is fixed in the v3.5 branch and will release to nuget.org soon.

[taurit]

Awesome, thanks Andrew!