Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update Azure.Identity #33668

Open
LeviateK opened this issue May 3, 2024 · 2 comments
Open

Update Azure.Identity #33668

LeviateK opened this issue May 3, 2024 · 2 comments

Comments

@LeviateK
Copy link

LeviateK commented May 3, 2024

Resolve alerts on a dependency vulnerability within microsoft.entityframeworkcore.sqlserver --> Azure.Identity v1.10.4
Ref: GHSA-wvxc-855f-jvrv

Upgrade to Azure.Identity version 1.11.0 or higher

@roji
Copy link
Member

roji commented May 3, 2024

Azure.Identity is a dependency of SqlClient, not of EF; SqlClient 5.1.6 is planned to depend on a new version of Azure.Identity that doesn't have the security issue. Once that's out, EF can update its own dependency on SqlClient.

In the meantime, you can simply take a direct dependency on a newer version of Azure.Identity in your csproj.

@LeviateK
Copy link
Author

LeviateK commented May 6, 2024

Thanks for the update/nfo - I was going off the Advanced Security detections in DevOps - The other root dependency, Microsoft.Identity.Web, has a merge in-flight to address already.

image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants