Squirrel dependency packages update

[GraySerg]

Hi! Is it safe to update dependency packages of suirrel package to latest version?
For now VS suggest me to update
DeltaCompressionDotNet from 1.0.0 to 1.1.0
Mono.Cecil from 0.9.6.1 to 0.9.6.4
Splat from 1.6.2 to 2.0.0

[Thieum]

DeltaCompressionDotNet has been updated to 1.1.0 in #803

[Thieum]

Request to update DeltaCompression to 2.0.0 - #1181
Mono.Cecil tested ok with 0.9.6.4, not with 0.10.0 - #1337
multiple issues with old version of SharpCompress - #1253
Splat bug - #1336

[stephenegriffin]

Porting over security note from #1253 so it's not lost:

There's an advisory on SharpCompress < 0.21 (adamhathcock/sharpcompress@80ceb1c)

[peppy]

Don't forget #1362 (#1181 was closed in favour of this issue but this issue doesn't mention SharpCompress outside of follow-up comments).

[shiftkey]

@peppy thanks for the extra context. I'll also link to this comment to remind me about this:

The last time we tried [SharpCompress] it broke NuGet's garbage Zip parsing and broke a bunch of people

#1362 (comment)

[jeremy-bridges]

In order to support version 7.0.1 of Splat, Squirrel would need to require version 4.6.1 of the .NET Framework. Microsoft's guidance on this is below. Any feedback on making this move?

https://docs.microsoft.com/en-us/dotnet/framework/migration-guide/versions-and-dependencies

[jmagly]

4.6.1 is 5 years old now, personally I would say go for it but I am just a user with only about 20 customers.

[thecodetinker]

Porting over security note from #1253 so it's not lost:

There's an advisory on SharpCompress < 0.21 (adamhathcock/sharpcompress@80ceb1c)

Hello - is there any progress on the SharpCompress update please? I am working to promote Squirrel for deploying applications within my company, but it's hard to make a case for it when it contains a known vulnerability.

From reading the background I appreciate this isn't a two-minute fix, but it would be great to have an idea of the current status, if possible? Thanks!

[Thieum]

@thecodetinker merging #1362 would bring us to 0.22

/cc @shiftkey @robmen

[Thieum]

@peppy thanks for the extra context. I'll also link to this comment to remind me about this:

The last time we tried [SharpCompress] it broke NuGet's garbage Zip parsing and broke a bunch of people

#1362 (comment)

Would it make sense to have a beta channel if this kind of issue are hard to track through unit tests?

[thecodetinker]

@peppy thanks for the extra context. I'll also link to this comment to remind me about this:

The last time we tried [SharpCompress] it broke NuGet's garbage Zip parsing and broke a bunch of people

#1362 (comment)

Would it make sense to have a beta channel if this kind of issue are hard to track through unit tests?

Thank you - I would be happy to use a beta channel for now. We don't have enough users (yet) that breaking would be a massive problem.