Repository navigation
Desktop app and tool: patch release needed #367
Description
The latest release (v0.6.1) may ship a vulnerable dependency:
- Trivy found a high or critical vulnerability with a fix in the desktop app's SBOM (every platform), or could not scan it: see https://github.com/siebe41/SemanticRouter.NET/actions/runs/42575452881.
Update what it names on main (Directory.Packages.props, or the .NET SDK in global.json for the runtime), then tag a patch release so the desktop app updates and the tool and packages ship the fix under their own version.
Activity
siebe41 commentedon Nov 11, 2026
The scan names the package: the bundled self-contained runtime Microsoft.NETCore.App.Runtime 10.0.13, with CVE-2026-70197 (code execution, out-of-bounds) and GHSA-p3jp-9v83-76w9 (Brotli). Both are fixed in 10.0.14. That needs a
global.jsonSDK bump; the PR that would have helped (#365) can't pass locked restore. Steps and root cause are in #369.Generated by Claude Code