sonarcloud[bot]
commented
1 year ago Kudos, SonarCloud Quality Gate passed! 
0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells
No Coverage information
No Duplication information
Describe the purpose of your pull request
This PR is kind of a follow-up to https://github.com/configcat/.net-sdk/pull/68
I revised the package references of other targets than .NET framework targets as well and it seems to me that we have some unnecessary or questionable references:
System.Net.Http(v4.3.4): this is an OOB (out-of-band) package which is for backporting newer improvements/fixes for older runtimes. However, MS don't advise using the separateSystem.Net.HttpNuGet package anymore because it may lead to complications (as we also experienced that ourselves). In the case of .NET 5+, referencing the package is pointless anyway because those runtimes include a newer version. In the case of older targets, I think we shouldn't require this package either but we'd better leave the decision to the end user to reference it in their application if they want to. So I propose removing this dependency completely.System.Text.RegularExpressions(v4.3.1): this is very similar toSystem.Net.Httpbut, based on the comment, it contains some security fix(es). So in targets older than .NET 5, it may make sense to require this dependency. However, I think it would be better to leave the decision to the end user in this case as well: let them reference it in their applications if they see fit but I'm not sure that we should make the decision for them by requiring this dependency via our library.System.Text.Json(v6.0.5): our library uses features which was introduced inSystem.Text.Jsonv6.0, so we need this one (except for .NET 6 which already includes it). However, I recommend referencing the oldest version that works for us instead of some arbitrary patch version. This version would be v6.0.0.Requirement checklist (only if applicable)