Binaries in nuget packet version 1.10.11 include 13 high vulnerabilities - update to latest version required

Open
  • Is something wrong?
#191 3 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
45/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Quiet
Tech stack
csharp
Domain
build-system, release, security

Research direction

Start by inspecting how HDF.PInvoke/1.10.11 packages its bundled HDF5 binaries and how a release is produced; compare the bundled version with HDF5 2.1.1. Done means a new NuGet package is produced with the updated binaries and the reported high vulnerabilities are no longer present.

Written by the indexing model from the issue text.

Description

Could you please create a new nuget package that include the latest HDF5 binaries (currently 2.1.1). The problem is that binaries included in https://www.nuget.org/packages/HDF.PInvoke/1.10.11 are flagged with 13 high vulnerabilities and (even more lower priority vulnerabilities). This means that this package can no longer be distributed due to the European Cyber Resilience Act.

Dominant language
C#
Stars
87
Forks
32
No merged PRs in 30d

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from HDFGroup/HDF.PInvoke

All issues in HDFGroup/HDF.PInvoke

Similar issues

More C# issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.