Repository navigation
Conversation
MailKit 2.10.1 is affected by GHSA-9j88-vvj5-vhgr (fixed in 4.16.0) and Newtonsoft.Json 12.0.3 by GHSA-5crp-9r3c-p9vr (fixed in 13.0.1). With the .NET 10 SDK, NuGet audit reports both and the solution fails to build. The MailKit sender now references MailKit 4.18.2 and the Mailgun sender Newtonsoft.Json 13.0.4. MailKitSender compiles against MailKit 4 unchanged. Building against MailKit 4 also binds SendAsync to its current signature, which fixes the MissingMethodException apps on MailKit 3 or later hit. Fixes lukencode#296
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #296.
With the .NET 10 SDK,
dotnet build FluentEmail.slnfails on master. NuGet audit reports two vulnerable dependencies, and the repo treats warnings as errors:MailKit2.10.1 in FluentEmail.MailKit: GHSA-9j88-vvj5-vhgr (STARTTLS response injection allowing a SASL downgrade), fixed in 4.16.0Newtonsoft.Json12.0.3 in FluentEmail.Mailgun: GHSA-5crp-9r3c-p9vr, fixed in 13.0.1This moves them to MailKit 4.18.2 and Newtonsoft.Json 13.0.4.
MailKitSendercompiles against MailKit 4 without changes, and both still targetnetstandard2.0.It also fixes #296. FluentEmail.MailKit was compiled against MailKit 2.x, whose
SendAsyncreturnedTask, so an app that moved to MailKit 3 or later got aMissingMethodExceptionat send time. Compiled against 4.18, it binds to the current signature.How I checked it:
netcoreapp3.1, which has no test host on Apple silicon, so I ran them retargeted tonet10.0locally (that change isn't in this PR). Liquid 9/9 and Razor 7/7 pass. In Core, the four MailKit tests pass. The sixMailgunSenderTeststhat call the live Mailgun API fail exactly as they do on master with the old versions.MailKitSenderon MailKit 4.18 to a local server, and it arrived.