Repository navigation
Pin the patched System.Text.Json under the notebook extension - #2116
Merged
Rafael-SOWNet merged 1 commit intoOct 24, 2026
Merged
Rafael-SOWNet merged 1 commit into
Rafael-SOWNet merged 1 commit into
Conversation
Microsoft.DotNet.Interactive 1.0.0-beta.23611.1 brings System.Text.Json 8.0.0 into AngouriMath.Interactive, with two high severity advisories, both denials of service: GHSA-hh2w-p6rv-4g7w and GHSA-8g4q-xg66-9fp4. A direct reference to 8.0.6, the patched build on the same major line, pulls it forward, as #797 did for System.Security.Cryptography.Xml under the terminal. Not an upgrade of Microsoft.DotNet.Interactive, although its newest beta depends on System.Text.Json 10.0.0: the notebook host supplies that package, and building against a newer one than the host's is how FSharp.Core 10.1 hung a kernel in #2108. dotnet list --vulnerable --include-transitive goes from two advisories to none, the build has no warnings, and the Interactive wrapper tests pass, 19 with 1 skipped. Packed with AngouriMath and AngouriMath.FSharp at a dev version to a local feed and loaded in the binder image (dotnet-interactive 1.0.712001), the F# sample runs all 39 of its code cells and a C# kernel loads the extension and runs its cells, with no errors. The System.Text.Json loaded is the host's own, 10.0.0.0 from the shared framework. Part of #542 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012sonx8iAspMiwRwokT1Ura
Rafael-SOWNet
deleted the
pin-the-patched-system-text-json-in-the-notebook-extension
branch
October 25, 2026 03:43
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #542.
Microsoft.DotNet.Interactive1.0.0-beta.23611.1 bringsSystem.Text.Json8.0.0 intoAngouriMath.Interactive, with two high advisories, GHSA-hh2w-p6rv-4g7w and GHSA-8g4q-xg66-9fp4. A direct reference to 8.0.6, the patched build on the same major line, pulls it forward, as #797 did for the terminal. It is not an upgrade ofMicrosoft.DotNet.Interactive, because the notebook host supplies it, and building against a newer one than the host's is how FSharp.Core hung a kernel in #2108.dotnet list … package --vulnerable --include-transitiveInteractiveWrapperUnitTestsAngouriMath.InteractivethereSystem.Text.Jsonthe kernel loadsNo answer changes, so no BREAKING-CHANGES entry.
🤖 Generated with Claude Code
https://claude.ai/code/session_012sonx8iAspMiwRwokT1Ura