search

andrewlock / NetEscapades.AspNetCore.SecurityHeaders

Small package to allow adding security headers to ASP.NET Core websites
MIT License
704 stars 73 forks source link

Should target only supported .net versions, ie 8.0 instead of the obsolete unsupported 3.1 #206

Closed madhon closed 1 month ago

madhon commented 1 month ago

You should change the targets to at the minimum .net 6.0 but preferably 8.0 as 3.1 has been out of support for a few years now, also it drags in insecure versions of newtonsoft.json for example

twenzel commented 1 month ago

I would also like to have the minimum version increased at least to .NET 6. The NetEscapades.AspNetCore.SecurityHeaders.TagHelpers package references a VERY old Microsoft.AspNetCore.MvcRazor v2.1 which will add a lot of old references to my .NET 8 project image

andrewlock commented 1 month ago

This is an accidental regression introduced in the previous release, and is fixed in #205. It has nothing to do with the target framework, and rather is related to the accidental inclusion of the obsolete reference. It will be fixed in the next release (which will likely happen in the next couple of days)

madhon commented 1 month ago

regardless of it been a regression or not I still think you should not be targeting a framework version that has been unsupported for almost two years now, and instead should only target supported versions.

andrewlock commented 1 month ago

regardless of it been a regression or not I still think you should not be targeting a framework version that has been unsupported for almost two years now, and instead should only target supported versions.

I'm genuinely interested in why you think that @madhon? It makes essentially zero difference to you as a consumer, assuming you're targeting a recent version