Closed
Description
Could you please update the references to 3rd party packages? Currently those old package versions are either vulnerable/deprecated themselves or bring in some other transient dependencies which are vulnerable/deprecated.
System.Text.Json5.0.2 is deprecatedMicrosoft.AspNet.WebApi.Client5.2.4 ->Newtonsoft.Json.Bson1.0.1 ->NETStandard.Library1.6.1 -> multiple vulnerable packages
Output for a new xUnit test project with FluentAssertions.Web:
> dotnet list package --include-transitive --vulnerable
Transitive Package Resolved Severity Advisory URL
> System.Net.Http 4.3.0 High https://github.com/advisories/GHSA-7jgj-8wvc-jh57
> System.Text.RegularExpressions 4.3.0 High https://github.com/advisories/GHSA-cmhx-cq75-c4mj
> dotnet list package --include-transitive --deprecated
Transitive Package Resolved Reason(s) Alternative
> System.Text.Json 5.0.2 Other,Legacy
Metadata
Metadata
Assignees
Labels
No labels