[Autofix] Fix 1 OSS risk#2
Open
vardior9 wants to merge 1 commit into
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
✅ Fixed
OSS · View in Apiiro
Summary:
Pinned System.Drawing.Common to version 4.7.3 in WorkflowCore.Sample17.csproj to remediate a critical vulnerability in the transitive dependency (previously resolved to 4.7.0).
What Changed:
Added a direct PackageReference for System.Drawing.Common version 4.7.3 in src/samples/WorkflowCore.Sample17/WorkflowCore.Sample17.csproj. This overrides the transitive resolution of System.Drawing.Common@4.7.0 that was pulled in through the chain: WorkflowCore.Persistence.SqlServer → Microsoft.EntityFrameworkCore.SqlServer@5.0.1 → Microsoft.Data.SqlClient@2.0.1 → ... → System.Drawing.Common@4.7.0.
Why This Fix:
SubDependencyPinning was chosen because the vulnerable package (System.Drawing.Common@4.7.0) is a deep transitive dependency. The overlay lists 4.7.3 as the nearest fix version, which is a patch-level bump within the same major.minor series — minimizing compatibility risk. Upgrading the top-level parent (Microsoft.EntityFrameworkCore.SqlServer to 6.x+) would require a target framework change from netcoreapp3.1 to net6.0+, which is a much larger and riskier change for a sample project.
Files Changed:
src/samples/WorkflowCore.Sample17/WorkflowCore.Sample17.csprojPotential Impact:
This is a patch-level bump (4.7.0 → 4.7.3) of a transitive system library in a sample project. The risk of behavioral change is minimal. The project targets netcoreapp3.1 which is itself end-of-life, so this fix addresses the immediate critical vulnerability while keeping the change surface small.
About Apiiro Autofix
This PR was automatically generated by Apiiro Autofix. Review all changes carefully before merging and run your test suite to verify no regressions.