Bugsnag now contains references to out of date and insecure dependencies -- is an update planned?

[daleholborow]

Latest version of BugSnag nuget is now very out of date last version is 2022? Is this under active development and support, or is Bugsnag ignoring the .NET ecosystem?

See attached image:

[mclack]

Hi @daleholborow

Thanks for raising this.

We are still maintaining bugsnag-dotnet, and have scheduled some time in Q1 of 2025 to get to these fixes. We will make sure to post any updates regarding that work here; thank you for your patience in the meantime.

We also wanted to briefly explain why we haven't prioritised work on bugsnag-dotnet sooner. As you may be aware, we've been investing a lot of time into our new Performance Monitoring product in BugSnag, adding OpenTelemetry support for server platforms (including .NET). We recently also launched Distributed Tracing for tracking requests across your system, and our roadmap includes plenty of features to continue to enhance this functionality. We also have work planned to more closely tie our Error and Performance Monitoring products together to give you deeper insights into where in your application things are going wrong.

[daleholborow]

I appreciate that the feature set is evolving, but I do question the decision to de-emphasise security fixes as a result. This makes me (and presumably others) particularly hesitant to recommend/incorporate Bugsnag in my client projects, now and in future, and I am a bit disappointed given that I have only recently made the recommendation that my clients adopt Bugsnag. I see @pmachapman's MR (which is much appreciated), is there anything preventing that from rolling out sooner?

[AlexanderVanMeerten]

Cannot add Bugsnag to our projects like this. Please resolve.

[yurykovshov]

Such minor security issues should be resolved as the highest priority. It is a low-hanging fruit.

[RobertoSmartBear]

Thank you for your patience and involvement. We consider security issues very seriously, which is why we’ve already scheduled work on the .NET BugSnag library update for the upcoming weeks. We will make the update available as soon as possible and keep you posted on the release.