Bump Scriban from 6.2.0 to 6.6.0 (security fix)

[LukeA07]

The current version of Scriban used by the project (6.2.0) has been flagged for known vulnerabilities, which is causing our build pipelines to fail.

A patched version (6.6.0) has since been released by the library maintainer to address these issues. Would it be possible to update the dependency to a non-vulnerable version?

[Fazer01]

We can totally relate to this and would love to see updates for this ;)

[MaxSigmax]

Yes we would love to see an update 😄

[martinothamar]

I believe these are the relevant issues:

• GHSA-5rpf-x9jg-8j5p
• GHSA-grr9-747v-xvcp
• GHSA-wgh7-7m3c-fx25

Scriban is of course only used during source generation here, so this is not relevant for your running services and apps using this library. One issue: 6.6 adds System.Text.Json as a dependency. Adding dependencies to Roslyn analyzers in general is pretty horrible, System.Text.Json in particular I've had personal experience with 😄 doable but not great. We currently reference Scriban using PackageScribanIncludeSource as recommended, but adding System.Text.Json complicates this usecase significantly

[martinothamar]

In the meantime, note that it is possible to do <WarningsNotAsErrors>NU1901;NU1902;NU1903;NU1904</WarningsNotAsErrors> and similar if you have builds failing due to this

[danny-may]

I also ran into this, but didnt feel comfortable disabling all package vulnerability warnings. Disabling just the 3 warnings for Scriban worked for me:

<ItemGroup>
    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-wgh7-7m3c-fx25" />
    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-grr9-747v-xvcp" />
    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-5rpf-x9jg-8j5p" />
</ItemGroup>

[martinothamar]

Good point @danny-may thanks 🙏

Will wait to see how this turns out: scriban/scriban#655 (comment)
checking back in later today

[LukeA07]

Looks like the System.Text.Json issue in Scriban 6.6.0 has been fixed

[generik0]

Yes plz bump the package version to include Scriban

[xavierjohn]

Probably need to wait for a new Scriban package to be released.

[AJ1000]

When will that be? Getting pressure from work? Thanks. I will ask Scriban as well.

[xavierjohn]

I suppressed and moved on since I can't wait.

https://github.com/xavierjohn/Trellis/blob/main/Directory.Build.props#L37

[xavierjohn]

scriban v7 is out, since it is a major version, it could have breaking changes.
https://www.nuget.org/packages/Scriban/7.0.0

[martinothamar]

Fixed in v3.0.2 and v3.1.0-rc.1

It took a little more changes than I'd like, please test and let me know if there are any issues

[LukeA07]

The updated version seems to be working in my project. Really appreciate the quick fix and all the effort you’ve put into this library, Thanks!

[coderdnewbie]

It is working in my project as well. Thanks.