Consider publishing new version of System.Data.Common without transitive vulnerability

[Banner-Keith]

The latest version of System.Data.Common 4.3.0 is widely used with 310k downloads and is dependent on System.Text.RegularExpressions 4.3.0 which has a vulnerability (#29550). Please consider publishing System.Data.Common 4.3.1 with a dependency of System.Text.RegularExpressions 4.3.1.

[dotnet-policy-service]

Tagging subscribers to this area: @roji, @ajcvickers
See info in area-owners.md if you want to be subscribed.

[roji]

/cc @ericstj what's our policy for these things?

[huoyaoyuan]

I don't think the System.Text.RegularExpressions NuGet package is functional for any supported runtime. For net462, it simply provides nothing. For net47 or above, it provides a shim that forwards to inbox implementation. For net6.0 or above, the inbox version has higher version and will win.

Thus, the vulnerability should not be applicable at all.

[huoyaoyuan]

System.Data.Common package still provides content for supported framework net462 to net47. It's inbox for net471 or above. However, it doesn't bring System.Text.RegularExpressions when on .NET Framework.

The suggestion is to just remove the package for .NET Standard and .NET 6+. For .NET Framework, the package can be kept and no vulnerable dependency will be brought.

[ericstj]

Correct, we'd recommend that folks remove their dependency on this package. It's not required for .NETFramework, .NETStandard2.0, nor .NET. The only reason it might be brought in is some old library that's still building against .NETStandard1.x - and if that's the case here you can just as easily update any other transitive dependency.

@Banner-Keith do you have a direct dependency on this package? Would you like us to take a look at your library and help you remove it?

cc @carlossanlop

[Banner-Keith]

It's not being pulled in by me directly, but rather through the popular MiniProfiler library.

The MiniProfiler.Shared nuget package has a dependency on System.Data.Common. They use it in anything targeting .net standard 2.0.

After digging in to their csproj it looks like the reason I am seeing this now is that we use .net 8 and they target .net 6, .net standard 2.0, and .net 4.6.1. So now that we aren't on .net 6 we are getting the old dependencies. I will ask them to swap over to .net 8 support.