Skip to content

chore(ci): Use prodsec security orb#435

Draft
rrama wants to merge 1 commit intomainfrom
chore/use-prodsec-security-orb
Draft

chore(ci): Use prodsec security orb#435
rrama wants to merge 1 commit intomainfrom
chore/use-prodsec-security-orb

Conversation

@rrama
Copy link
Copy Markdown
Contributor

@rrama rrama commented Jan 16, 2026

Description

Provide description of this PR and changes, if linked Jira ticket doesn't cover it in full.

Checklist

Screenshots / GIFs

Visuals that may help the reviewer. Please add screenshots for any UI change. GIFs are most welcome!

@rrama rrama temporarily deployed to snyk-msbuild-envs January 16, 2026 13:36 — with GitHub Actions Inactive
@snyk-io
Copy link
Copy Markdown

snyk-io bot commented Jan 16, 2026

Snyk checks have passed. No issues have been found so far.

Status Scanner Critical High Medium Low Total (0)
Open Source Security 0 0 0 0 0 issues
Licenses 0 0 0 0 0 issues
Code Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@rrama
Copy link
Copy Markdown
Contributor Author

rrama commented Jan 16, 2026

The OSS scan is failing with:

✗ Inefficient Algorithmic Complexity [High Severity][https://security.snyk.io/vuln/SNYK-DOTNET-SYSTEMTEXTJSON-8168848] in System.Text.Json@6.0.0
introduced by Microsoft.VisualStudio.SDK@17.4.33103.184 > Microsoft.VisualStudio.Package.LanguageService.15.0@17.4.33103.184 > Microsoft.VisualStudio.Shell.Framework@17.4.33103.184 > System.Text.Json@6.0.0 and 11 other path(s)
This issue was fixed in versions: 6.0.10, 8.0.5

This was ignored in the .snyk: https://github.com/snyk/snyk-visual-studio-plugin/blob/main/.snyk#L57-L63 but has expired.

Edit: Changing to use the prod-sec orb has changed the project-name that is sent to the backend, so it sees it as a different project to the one we were using. We should figure out how we want to do the migration properly or use symbolic links to keep the project-name the same.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant