Azure-cosmos-dotnet-v3: SDK references vulnerable version of System.ServiceModel.Primitives

[johngallardo]

Describe the bug
The 3.9.1 version of the Cosmos nuget package has a dependency on 4.5.0 System.ServiceModel.Primitives. This package has a known vulnerability described in:
https://github.com/dotnet/announcements/issues/73

In order for applications consuming the Cosmos SDK to not include this vulnerable package, they are required to add a direct dependency.

To Reproduce
Consume the Cosmos nuget package in a dotnet core application.

Expected behavior
An updated Cosmos package should not require additional mitigations by consumers to ensure a non-vulnerable package is consumed.

Environment summary
SDK Version: 3.9.0
OS Version (e.g. Windows, Linux, MacOSX): Windows

[konradbartecki]

@johngallardo as a workaround can you pinpoint and add System.ServiceModel.Primitives NuGet manually to your project? azure-cosmos-dotnet-v3 depends on System.ServiceModel.Primitives that is equal or greater than 4.5.0

[johngallardo]

Yes, this is a workaround as called out in the "Describe the bug" statement.

However, see my "Expected Behavior" WRT the ask to not require additional mitigations by the library consumer.

[konradbartecki]

Ah right, you're correct. I wrote that too fast, let's wait for a proper fix then.

[j82w]

The update is in progress. Just in the progress of updating the internal direct package. Once it's updated and published I'll send out a PR to update the SDK.