I see that similar situations to this have been reported in the past, with some debate about whether the references here should be updated or not (e.g. #341), but raising the question in case:
There is a transitive dependency to System.Text.Json v8.0.0 via Microsoft.Extensions.DependencyModel v8.0.0.
This got flagged up by Mend in a project at work that uses Serilog.Settings.Configuration.
Microsoft have now released a version 8.0.1 of Microsoft.Extensions.DependencyModel which bumps the System.Text.Json dependency to 8.0.4, which has fixed the issue.
So - I'm wondering what thoughts are on updating the Microsoft.Extensions.DependencyModel dependency here to 8.0.1 ?
I see that similar situations to this have been reported in the past, with some debate about whether the references here should be updated or not (e.g. #341), but raising the question in case:
There is a transitive dependency to System.Text.Json v8.0.0 via Microsoft.Extensions.DependencyModel v8.0.0.
Microsoft just announced a set of CVEs in that version - https://github.com/advisories/GHSA-hh2w-p6rv-4g7w
This got flagged up by Mend in a project at work that uses Serilog.Settings.Configuration.
Microsoft have now released a version 8.0.1 of Microsoft.Extensions.DependencyModel which bumps the System.Text.Json dependency to 8.0.4, which has fixed the issue.
So - I'm wondering what thoughts are on updating the Microsoft.Extensions.DependencyModel dependency here to 8.0.1 ?