Skip to content

Fix NU1903 warnings (Lombiq Technologies: OSOE-925)#19167

Merged
Piedone merged 1 commit intoOrchardCMS:mainfrom
sarahelsaig:issue/OSOE-925-NU1903
Apr 18, 2026
Merged

Fix NU1903 warnings (Lombiq Technologies: OSOE-925)#19167
Piedone merged 1 commit intoOrchardCMS:mainfrom
sarahelsaig:issue/OSOE-925-NU1903

Conversation

@sarahelsaig
Copy link
Copy Markdown
Contributor

@sarahelsaig sarahelsaig commented Apr 17, 2026

System.Security.Cryptography.Xml, MailKit and MimeKit trigger security warning errors, such as

Warning NU1903 : Package 'System.Security.Cryptography.Xml' 10.0.5 has a known high severity vulnerability, GHSA-37gx-xxp4-5rgx
Package 'MailKit' 4.15.1 has a known moderate severity vulnerability, GHSA-9j88-vvj5-vhgr

System.Security.Cryptography.Xml is referenced indirectly by Microsoft.Identity.Web and Microsoft.AspNetCore.DataProtection.StackExchangeRedis, updating those two automatically pulls it up to the secure patch version, as confirmed with dotnet nuget why System.Security.Cryptography.Xml.

@hishamco
Copy link
Copy Markdown
Member

I saw this in VS, but I presume @Piedone created an auto bump for the packages

@sarahelsaig
Copy link
Copy Markdown
Contributor Author

If you mean Renovate, it doesn't look like it has engaged for this one. Maybe because System.Security.Cryptography.Xml is an indirect dependency and Renovate only looks at the source code without engaging with the build process.

@Piedone
Copy link
Copy Markdown
Member

Piedone commented Apr 18, 2026

Yeah, these will be updated following the normal update schedule, which will trigger on Sunday in a few hours. But this is useful to unblock the build due to the warning before that even.

@Piedone Piedone merged commit 80ac92c into OrchardCMS:main Apr 18, 2026
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants