Tracking: C#MS NuGet vulnerability warnings reported by Barnstorm (7 transitive advisories from Beamable packages)

[mhijaziB]

Context

Barnstorm (Richard, beam-shared-barnstorm, 2 Sep 2026) sent a Rider screenshot with seven "contains vulnerabilities" entries in their C#MS project and asked whether they should be bumping packages to silence them. They should not. Every entry is a transitive dependency of our own NuGet packages, and every advisory was published between April and July 2026 against pins we have not moved since 2025. Nothing changed on their side; the advisory feeds caught up with our pins.

Reproduced on main with dotnet list package --vulnerable --include-transitive on a net10.0 service referencing the local Beamable.Microservice.Runtime build. Output matches the customer screenshot.

Flagged package	Enters through	Advisory	Fix issue
Snappier 1.0.0	MongoDB.Driver 3.3.0	GHSA-pggp-6c3x-2xmx (high)	#4827
SharpCompress 0.30.1	MongoDB.Driver 3.3.0	GHSA-6c8g-7p36-r338 (moderate)	#4827
System.Security.Cryptography.Xml 8.0.2	System.ServiceModel.Primitives 8.1.2 in Tooling.Common (unused)	8 high GHSAs	#4826
OpenTelemetry.Api 1.12.0	direct pins in 4 csproj files	GHSA-g94r-2vxg-569j (moderate)	#4828
OpenTelemetry.Exporter.OpenTelemetryProtocol 1.12.0	direct pins	GHSA-4625-4j76-fww9 (moderate)	#4828
System.Net.Http 4.3.0	SourceGen nuspec → Roslyn 4.0.0 → Humanizer.Core → NETStandard.Library 1.6.1	CVE-2018-8292 (facade, never executes)	#4829
System.Text.RegularExpressions 4.3.0	same chain	CVE-2019-0820 (facade, never executes)	#4829

The last two only show up in Rider's own Checkmarx-based inspection. NuGet audit does not report them, and the .NET 10 SDK prunes them from net10.0 graphs. They still look red to a customer.

Work

• Beamable.Tooling.Common carries an unused System.ServiceModel.Primitives reference that pulls 8 high-severity System.Security.Cryptography.Xml advisories into every C#MS #4826 Remove the dead System.ServiceModel.Primitives reference
• Bump MongoDB.Driver past 3.9.0 so C#MS stop shipping vulnerable Snappier 1.0.0 and SharpCompress 0.30.1 #4827 Bump MongoDB.Driver to 3.9.0+
• Align OpenTelemetry packages at 1.15.3+ across runtime, tooling.common and otel exporter to clear two moderate advisories #4828 Align OpenTelemetry at 1.15.3+ in all four csproj files
• Beamable.Microservice.SourceGen leaks Roslyn 4.0.0 as a runtime dependency: phantom CVE warnings and ~19 MB of compiler DLLs in every C#MS Docker image #4829 Stop Beamable.Microservice.SourceGen leaking Roslyn as a runtime dependency, and harden the template reference

The first three are low-risk dependency work. The fourth is the one with a real payoff beyond scanner hygiene: it removes roughly 19 MB of compiler DLLs from every customer Docker image.

Exposure, for whoever answers the customer

None of these are reachable in normal microservice usage. Snappier and SharpCompress are only touched by Mongo wire compression against the customer's own database. Nothing calls XML crypto. The OpenTelemetry header advisory needs an upstream caller forwarding oversized propagation headers. The two 4.3.0 packages are type-forwarding facades on .NET 8+.

Customer-side interim, if they want a clean Problems tab before we ship: pin Snappier 1.3.1, SharpCompress 0.48.0, System.Security.Cryptography.Xml 10.0.10 and OpenTelemetry / OpenTelemetry.Exporter.OpenTelemetryProtocol 1.15.3 directly in the service csproj, or suppress the advisory URLs with NuGetAuditSuppress. Neither is required.

Done when

A fresh beam project new service on the released CLI shows zero entries in dotnet list package --vulnerable --include-transitive, and its published bin/beamApp/support contains no Microsoft.CodeAnalysis*.dll.