Skip to content

Update to non-vulnerable version of Kiota #3109

Open
Open
Update to non-vulnerable version of Kiota#3109
Labels
type:featureNew experience request

Description

@mikepb-wtw
Michael Phillimore-Brown (mikepb-wtw)
opened on May 8, 2026

Is your feature request related to a problem? Please describe the problem.

I am trying to install the latest version of the Graph SDK but Visual Studio is telling me there are packages with high severity vulnerabilities. Viz, Microsoft.Kiota.Abstractions

GHSA-7j59-v9qr-6fq9

Describe the solution you'd like.

Please update the transitive dependency to require version 1.22 or above to resolve this.

Additional context?

No response

Activity

  1. Michael Phillimore-Brown (mikepb-wtw)
    added
    status:waiting-for-triageAn issue that is yet to be reviewed or assigned
    type:featureNew experience request
    on May 8, 2026

  2. Bellarmine-Head commented on May 10, 2026

    @Bellarmine-Head
    Bellarmine Head (Bellarmine-Head)
    on May 10, 2026
    Image

  3. Bellarmine-Head commented on May 10, 2026

    @Bellarmine-Head
    Bellarmine Head (Bellarmine-Head)
    on May 10, 2026
    Image

  4. bgavrilMS commented on May 11, 2026

    @bgavrilMS
    Bogdan Gavril (bgavrilMS)
    on May 11, 2026

    Jingjing Jia (@jingjingjia-ms) Peter Ombwa (@peombwa) - this is a high severity CVE so it's blocking builds. When can we expect a Graph SDK fix?

  5. MIchaelMainer commented on May 11, 2026

    @MIchaelMainer
    Michael Mainer (MIchaelMainer)
    on May 11, 2026
    Contributor

    This will be fixed here: #3113

  6. Michael Mainer (MIchaelMainer)
    removed
    status:waiting-for-triageAn issue that is yet to be reviewed or assigned
    on May 11, 2026

  7. Bellarmine-Head commented on May 12, 2026

    @Bellarmine-Head
    Bellarmine Head (Bellarmine-Head)
    on May 12, 2026

    I'm not going to do it because I've taken a solemn vow to never knowingly use AI, but I must admit to being very curious about what would have happened if I'd clicked on "Fix with GitHub Copilot". I suspect it would cost me money/tokens, but not actually be able to "fix" the problem. It might tell me to open a ticket for the owners of the repo.... but my own brain told me that for free.

  8. bkaankose commented on May 13, 2026

    @bkaankose
    Burak Kaan Köse (bkaankose)
    on May 13, 2026

    This should be a top priority fix across all teams in Microsoft right now. Its high severity vulnerability and prevents builds if warnings are treated as errors.

    I understand it's a core package and requires multiple teams to release in order, but please communicate and publish a new release as soon as possible.

  9. mikepb-wtw commented on May 13, 2026

    @mikepb-wtw
    Michael Phillimore-Brown (mikepb-wtw)
    on May 13, 2026
    Author

    The linked issue suggests it was updated for v6.0.0, so thank you for this but it hasn't appeared on Nuget yet. Are you planning to back-port a bump to v5 as well?

  10. mikepb-wtw commented on May 14, 2026

    @mikepb-wtw
    Michael Phillimore-Brown (mikepb-wtw)
    on May 14, 2026
    Author

    Hi Michael Mainer (@MIchaelMainer) - do you have an idea when v6.0.0 will appear on Nuget please?

  11. scottrudy commented on May 14, 2026

    @scottrudy
    Scott (scottrudy)
    on May 14, 2026

    A little primer:

    1. Microsoft.Graph (5.105.0) requires Microsoft.Graph.Core (>= 3.2.5)
    2. Microsoft.Graph.Core (3.2.5) requires Microsoft.Kiota.Abstractions (>= 1.21.1)
    3. Microsoft.Kiota.Abstractions (<= 1.21.1) is vulnerable

    How to address it prior to an update of Microsoft.Graph:

    Add an explicit reference to a non-vulnerable version of Microsoft.Kiota.Abstractions (>=1.22.0) in the same project(s) that declare Microsoft.Graph as a top-level package.

  12. mikepb-wtw commented on May 14, 2026

    @mikepb-wtw
    Michael Phillimore-Brown (mikepb-wtw)
    on May 14, 2026
    Author

    Hi Scott (@scottrudy) thanks, yes we can work around it but I don't want to spend ages going round all of our myriad repos that use Graph doing this, only for v6.0.0 to drop this evening, and then we go around them again undoing it. However if v6.0.0 is going to be a few weeks yet, then we'll do the workaround.

    To be clear I don't mind either way, just asking when is v6.0.0 scheduled so we can plan.

  13. MIchaelMainer commented on May 14, 2026

    @MIchaelMainer
    Michael Mainer (MIchaelMainer)
    on May 14, 2026
    Contributor

    Sorry for the delay folks. 6.0.3 is on NuGet. https://www.nuget.org/packages/Microsoft.Graph

  14. major-mayer commented on May 19, 2026

    @major-mayer
    Laurenz (major-mayer)
    on May 19, 2026

    The linked issue suggests it was updated for v6.0.0, so thank you for this but it hasn't appeared on Nuget yet. Are you planning to back-port a bump to v5 as well?

    Would be really nice, if this could be backported to 5.x as well

  15. mikepb-wtw commented on May 19, 2026

    @mikepb-wtw
    Michael Phillimore-Brown (mikepb-wtw)
    on May 19, 2026
    Author

    Sorry for the delay folks. 6.0.3 is on NuGet. https://www.nuget.org/packages/Microsoft.Graph

    Thank you! :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    type:featureNew experience request

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions