Build warning for dependency Newtonsoft.Json 11.0.1

Author: seanterryCreated Nov 15, 2024Updated Sep 15, 2026

Labelsduplicate

.NET 9 now generates build warnings for known vulnerabilities in transitive dependencies. This causes build failures if you treat warnings as errors.

Warning NU1903 : Package 'Newtonsoft.Json' 11.0.1 has a known high severity vulnerability, https://github.com/advisories/GHSA-5crp-9r3c-p9vr

I have no reason to believe this vulnerability can be exploited via Hangfire.

dotnet nuget why output:

  [net9.0]
   │  
   └─ MyProject (v1.0.0)
      ├─ Hangfire.AspNetCore (v1.8.15)
      │  └─ Hangfire.NetCore (v1.8.15)
      │     └─ Hangfire.Core (v1.8.15)
      │        └─ Newtonsoft.Json (v11.0.1)
      ├─ Hangfire.PostgreSql (v1.20.10)
      │  └─ Hangfire.Core (v1.8.15)
      │     └─ Newtonsoft.Json (v11.0.1)
      ├─ Hangfire.Pro (v3.0.4)
      │  └─ Hangfire.Core (v1.8.15)
      │     └─ Newtonsoft.Json (v11.0.1)
      └─ Hangfire.Pro.Redis (v3.0.10)
         └─ Hangfire.Core (v1.8.15)
            └─ Newtonsoft.Json (v11.0.1)

Repro steps:

Install .NET 9 SDK.
Build a net9.0 or net8.0 project containing a reference to Hangfire 1.8.15.

Source: HangfireIO/Hangfire

View original on GitHub View discussion on GitHub