
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Carbon.WebApplication
Advanced tools
4.6.6 - Refactored OwnershipFilter to use async/await for external service calls; improved Authorization header handling and permission checks. 4.6.5 - Microsoft.Extensions.Logging package added 4.6.4 - HybridModelBinding updated to 0.17.0 on net8.0 target framework 4.6.3 - Dotnet 8.0 target framework added for minimal api 4.6.2 - Dotnet 8.0 target framework added 4.5.6 - Added a property named overrideMessageAndCode to the CarbonException class. The default value of this property is set to true. In the constructor of CarbonException, check this property to determine whether the message and code are overridden or not. - Update IPageableDto validator for assign PageSize 0. When PageSize 0 the datas returns without pagination with development in version 4.5.3. 4.5.3 - Upgrade Carbon.PagedList (Remove pageSize and pageNumber validation check) 4.5.2 - Updated Carbon.Common nuget package (Added StringExtensions class with ReplaceTurkishChars and ContainsTurkishIgnoreCase methods) 4.5.0 - Degraded health check HTTP status code changed as custom 218 (This Is Fine) status code. Because even if system is degraed it should be working normally, so returning 5XX status code is not right for degraded state. 4.4.1 - Cors should come first before authentication and authorization in startup pipeline 4.4.0 - Carbon.Common updated and Serilog.Enrichers.Sensitive Enricher added for masking sensitive values within logs. 4.3.0 - OwnershipFilter check now disregards solution id header during endpoint permission check 4.2.1 - UnauthorizedOperationException response body is fixed 4.2.0 - UnauthorizedOperationException handling is added 4.1.9 - Carbon.Common updated and IQueryable OrderBy extension method bug fixed 4.1.8 - Carbon.Common updated and nested ordering achieved 4.1.7 - Add CorrelationId to log OnException 4.1.6 - Cors Policy changes(Location parameter is added to WithExposedHeaders) 4.1.5 - ApiPagedResponse is added for PagedListOk. 4.1.4 - Some dependencies updated. 4.1.3 - Cors Allow Credentials support added with any origin accepted - Cors Wildcards accepted 4.1.1 - CarbonException messages are take arguments for dynamic exception messages 4.1.0 - Critical bug fixed for Directory separator char to specific platform (Windows,Linux) 4.0.0 - Carbon now supports Dotnet 6 in terms of both minimal and not minimal - Fluent Validation Upgraded - Swagger Upgraded - BodyRewind deprecated, thus RoleFilteredDto is now unsupported as it is unnecessary just after repository-level validation introduced - Some Performance Improvements
FAQs
4.6.6 - Refactored OwnershipFilter to use async/await for external service calls; improved Authorization header handling and permission checks. 4.6.5 - Microsoft.Extensions.Logging package added 4.6.4 - HybridModelBinding updated to 0.17.0 on net8.0 target framework 4.6.3 - Dotnet 8.0 target framework added for minimal api 4.6.2 - Dotnet 8.0 target framework added 4.5.6 - Added a property named overrideMessageAndCode to the CarbonException class. The default value of this property is set to true. In the constructor of CarbonException, check this property to determine whether the message and code are overridden or not. - Update IPageableDto validator for assign PageSize 0. When PageSize 0 the datas returns without pagination with development in version 4.5.3. 4.5.3 - Upgrade Carbon.PagedList (Remove pageSize and pageNumber validation check) 4.5.2 - Updated Carbon.Common nuget package (Added StringExtensions class with ReplaceTurkishChars and ContainsTurkishIgnoreCase methods) 4.5.0 - Degraded health check HTTP status code changed as custom 218 (This Is Fine) status code. Because even if system is degraed it should be working normally, so returning 5XX status code is not right for degraded state. 4.4.1 - Cors should come first before authentication and authorization in startup pipeline 4.4.0 - Carbon.Common updated and Serilog.Enrichers.Sensitive Enricher added for masking sensitive values within logs. 4.3.0 - OwnershipFilter check now disregards solution id header during endpoint permission check 4.2.1 - UnauthorizedOperationException response body is fixed 4.2.0 - UnauthorizedOperationException handling is added 4.1.9 - Carbon.Common updated and IQueryable OrderBy extension method bug fixed 4.1.8 - Carbon.Common updated and nested ordering achieved 4.1.7 - Add CorrelationId to log OnException 4.1.6 - Cors Policy changes(Location parameter is added to WithExposedHeaders) 4.1.5 - ApiPagedResponse is added for PagedListOk. 4.1.4 - Some dependencies updated. 4.1.3 - Cors Allow Credentials support added with any origin accepted - Cors Wildcards accepted 4.1.1 - CarbonException messages are take arguments for dynamic exception messages 4.1.0 - Critical bug fixed for Directory separator char to specific platform (Windows,Linux) 4.0.0 - Carbon now supports Dotnet 6 in terms of both minimal and not minimal - Fluent Validation Upgraded - Swagger Upgraded - BodyRewind deprecated, thus RoleFilteredDto is now unsupported as it is unnecessary just after repository-level validation introduced - Some Performance Improvements
We found that carbon.webapplication demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.