Dependencies are reported to contain high vulnerabilities

[WenningQiu]

NHibernate (5.5.2) brings on dependencies that are reported to contain high vulnerabilities:

Can we have a new release that moves away from those vulnerable dependencies? According to this Microsoft blog (https://devblogs.microsoft.com/nuget/nugetaudit-2-0-elevating-security-and-trust-in-package-management/), all that is needed is to release a new version that targets netstandard2.0.

Thanks.

[fredericDelaporte]

What do you mean? NHibernate already targets netstandard2.0, and not any lower version.

[WenningQiu]

@fredericDelaporte Sorry, my request should be sent to Antlr3.Runtime and Iesi.Collections which are used by NHibernate.

[WenningQiu]

It appears that Antlr3 had been replaced by Antlr4 long time ago, and even Antlr4 does not appear to be actively maintained - no one responds to a similar request (tunnelvisionlabs/antlr4cs#382) there. In fact, tunnelvisionlabs/antlr4cs#381 recommended end users to be migrated to Antlr4.Runtime.Standard.

Will NHibernate review those dead dependencies?

[fredericDelaporte]

Migrating from v3 to v4 seems to be no trivial task, and that would be a prerequisite for migrating to maintained Antlr versions. It would need a contributor available to do this and sufficiently knowledgeable about Antlr. I do not think we currently have one.

Anyway, does really theses vulnerable dependencies ends-up in an actual NHibernate deployment? If yes, we may add a forced dependency on patched versions of the vulnerable dependencies. But affected applications could do so themselves.

[WenningQiu]

I believe the vulnerable dependencies are included in application deployment, but not sure if they actually get used at runtime; however, they show up on security scanning reports and pressures are put on our dev teams.

Forced dependency is one of the solutions mentioned in the MS blog I sent, although not an ideal one. But if we go with forced dependency as a temporary mitigation, it might be better off be done close to the source of vulnerabilities than in applications.

[cremor]

The latest version of Iesi.Collections already defines target frameworks which fix the dependency issue. NHibernate should update its dependency to Iesi.Collections, but until then you can reference the latest version of Iesi.Collections directly.

For Antlr3.Runtime you can reference the latest version of NETStandard.Library to remove the unneeded dependencies.