Upgrade System.Text.Json to 8.0.4 for CVE-2024-30105 (grafana#102)

* bump System.Text.Json to 8.0.4 for CVE-2024-30105 GHSA-hh2w-p6rv-4g7w * CHANGELOG entry
matt-hensley · Jul 15, 2024 · 1ad160b · 1ad160b
1 parent 2425736
commit 1ad160b
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 1 deletion.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## Unreleased
+
+### Bug Fixes
+
+* Use 8.0.4 of System.Text.Json to remediate CVE-2024-30105
+  ([#102](https://github.com/grafana/grafana-opentelemetry-dotnet/pull/102))
+
 ## 0.8.1-beta.1
 
 ### BREAKING CHANGES

diff --git a/src/Grafana.OpenTelemetry.Base/Grafana.OpenTelemetry.Base.csproj b/src/Grafana.OpenTelemetry.Base/Grafana.OpenTelemetry.Base.csproj
@@ -22,7 +22,7 @@
     <PackageReference Include="Microsoft.Extensions.Configuration" Version="8.0.0" />
     <PackageReference Include="Microsoft.Extensions.Configuration.EnvironmentVariables" Version="8.0.0" />
     <PackageReference Include="Microsoft.Extensions.Logging" Version="8.0.0" />
-    <PackageReference Include="System.Text.Json" Version="8.0.0" />
+    <PackageReference Include="System.Text.Json" Version="8.0.4" />
     <PackageReference Include="MinVer" Version="4.3.0">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>