chore(deps): bump Microsoft.AspNetCore.Server.Kestrel.Core to 2.3.6#4639
chore(deps): bump Microsoft.AspNetCore.Server.Kestrel.Core to 2.3.6#4639
Conversation
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
| <!-- This is needed because the version that is brought in transitively also has a vulnerability warning --> | ||
| <PackageReference Include="Microsoft.AspNetCore.Server.Kestrel.Core" Version="2.1.25" /> | ||
| <!-- https://github.com/advisories/GHSA-5rrx-jjjq-q2r5 --> | ||
| <PackageReference Include="Microsoft.AspNetCore.Server.Kestrel.Core" Version="2.3.6" /> |
There was a problem hiding this comment.
Bug: Kestrel Update Causes Compatibility Issues
Updating Microsoft.AspNetCore.Server.Kestrel.Core to 2.3.6 for net48 creates a version mismatch with other 2.1.* ASP.NET Core packages in the same ItemGroup. This goes against the documented policy for .NET Framework compatibility and could cause runtime issues.
There was a problem hiding this comment.
According to the comment above, we deliberately chose to test with 2.1:
However, all Microsoft.AspNetCore.Server.Kestrel.Core versions <= 2.3.0 are affected by CVE-2025-55315. The vulnerability has only been patched in version 2.3.6. The latest version in the 2.1.x series is the previously pinned version 2.1.25 from 2021.
Either we need to accept the mismatch or bump the others too...?
There was a problem hiding this comment.
If the tests complete successfully, I prefer just bumping the vulnerable versions, and keeping everything else as "2.1.*"-y as possible.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #4639 +/- ##
=======================================
Coverage 73.51% 73.51%
=======================================
Files 483 483
Lines 17692 17692
Branches 3492 3492
=======================================
Hits 13007 13007
Misses 3796 3796
Partials 889 889 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
2 participants
See Microsoft Security Advisory CVE-2025-55315: .NET Security Feature Bypass Vulnerability.
https://github.com/getsentry/sentry-dotnet/actions/runs/18529128444/job/52807115247
#skip-changelog (only used in tests)