Dependency Microsoft.Extensions.Caching.Memory 6.0.1 is vulnerable (UE5)

11

This is a recent error I encountered while creating a new project.

EpicGames.Horde.csproj: Warning NU1903: Package 'Microsoft.Extensions.Caching.Memory' 6.0.1 has a known high vulnerability [...]

There seems to be a Nuget package vulnerability in Microsoft.Extensions.Caching.Memory 6.0.1, which Unreal Engine 5.4 uses.

It seemed like an unnecessary problem to solve (as the package was only used in the EpicGames.Horde related programs), but I still wanted to resolve the issue. I resolved the issue by rebuilding the engine with an updated version of the package.

1. Open the engine with an IDE

2. Change the version within the source

There are two places you have to update,

// First - Line 47 
Engine/Source/Programs/Shared/EpicGames.Horde.Tests/EpicGames.Horde.csproj

// Second - Line 34
Engine/Source/Programs/Shared/EpicGames.Horde.Tests/EpicGames.Horde.Tests.csproj

I changed the version 6.0.1 to 6.0.2

// Before 
<PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="6.0.1" />

// After 
<PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="6.0.2" />

Source: https://nuget.health.go.ke/packages/microsoft.extensions.caching.memory/6.0.2

3. Rebuild and check the changes

The issue has been resolved.