Package Upgrade: package version upgrade required as per Snyk scan result

[gpgygx]

Snyk scan detects two packages need an update.

In PowerCAT.PackageDeployer.Package.csproj

Can you please upgrade the below package version to the newest?

• Microsoft.CrmSdk.XrmTooling.CoreAssembly

• System.Text.Json

[patilravikiran]

Hi @gpgygx, what package versions are you looking for? We have some restrictions with respect to Dataverse plugins. We have used .Net frameowork within plugin.

[gpgygx]

Hi @gpgygx, what package versions are you looking for? We have some restrictions with respect to Dataverse plugins. We have used .Net frameowork within plugin.

Below new versions are appeared to be compliant in Synk if you may use

Microsoft.CrmSdk.XrmTooling.CoreAssembly 9.1.1.65
System.Text.Json 9.0.4

[patilravikiran]

Hi @gpgygx,
We are not using Microsoft.CrmSdk.XrmTooling.CoreAssembly within our project. We have upgraded other packages like System.Text.Json & Microsoft.CrmSdk.CoreAssemblies which will be available in coming release.

[gpgygx]

Hi @gpgygx, We are not using Microsoft.CrmSdk.XrmTooling.CoreAssembly within our project. We have upgraded other packages like System.Text.Json & Microsoft.CrmSdk.CoreAssemblies which will be available in coming release.

Hi @patilravikiran. Thanks for the update. Please see line 13 in PowerCAT.PackageDeployer.Package/PowerCAT.PackageDeployer.Package.csproj where it references the package Microsoft.CrmSdk.XrmTooling.CoreAssembly.

Power-CAT-Copilot-Studio-Kit/PowerCAT.PackageDeployer.Package/PowerCAT.PackageDeployer.Package.csproj

Line 13 in d78a0aa

<PackageReference Include="Microsoft.CrmSdk.XrmTooling.CoreAssembly" Version="9.1.0.79" PrivateAssets="all" />

Can you please confirm if the project is using this package? if not, can you remove it? Thanks

[patilravikiran]

Hi @gpgygx, please help me to understand why you are scanning entire GitHub repo. These are supported packages which we are using to create release artifacts. Ideally you should only scan solutions (Copilot Studio Kit & Creator Kit) which you are importing into your environment.

[gpgygx]

Hi @gpgygx, please help me to understand why you are scanning entire GitHub repo. These are supported packages which we are using to create release artifacts. Ideally you should only scan solutions (Copilot Studio Kit & Creator Kit) which you are importing into your environment.

thanks for the clarification. i will change the scan scope and let you know the updated results

[patilravikiran]

Hi @gpgygx, Thanks for taking our feedback. Please let us know if we can close this issue.