chore: drop the unused Microsoft.Bcl.Memory reference (high-severity advisory) - #5
Merged
Merged
Conversation
…advisory) Microsoft.Bcl.Memory 10.0.2 carries GHSA-73j8-2gch-69rq, a high-severity .NET denial of service, so every build of pocketCrawler - which consumes this as a submodule - emitted NU1903. The reference is removed rather than bumped, because nothing here uses it. Grepped for what the package actually provides (Base64Url, the System.Buffers.Text surface, the Index/Range and Memory polyfills): no hit anywhere in RobotsTxt. It is a .NET Framework-era polyfill, and both target frameworks - net8.0 and net10.0 - have that surface in the box. Verified rather than assumed: - RobotsTxt builds on net8.0 and net10.0 with the reference gone - TestRobotsTxt: 149 passed on both frameworks - the consuming crawler's suite: 437 passed on both frameworks - NU1903 is gone from the crawler's build; the only advisory warnings left there are the two OpenTelemetry NU1902s, which are unrelated to this repo Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Microsoft.Bcl.Memory10.0.2 carries GHSA-73j8-2gch-69rq, a high-severity .NET denial of service. Every build of pocketCrawler, which consumes this repo as a submodule, emitsNU1903because of it.Removed, not bumped
Nothing here uses the package. I grepped for what it actually provides —
Base64Url, theSystem.Buffers.Textsurface, theIndex/RangeandMemorypolyfills — and there is no reference anywhere inRobotsTxt. It is a .NET Framework-era polyfill, and both target frameworks (net8.0,net10.0) have that surface in the box. Removing it fixes the advisory outright rather than moving to 10.0.4.(For the record, this repo has no .NET Framework target left to justify it:
RobotsTxtandTestRobotsTxtarenet8.0;net10.0,ConsoleApplicationisnet10.0, and the solution has onlyDebug|Release Any CPU.)Verified, not assumed
RobotsTxtbuilds on net8.0 and net10.0 with the reference goneTestRobotsTxt: 149 passed on both frameworksNU1903is gone from the crawler's build; the only advisory warnings left there are twoOpenTelemetryNU1902s, unrelated to this repo🤖 Generated with Claude Code