NCrunch.Framework v 4.17.0.5 apparently has a vulnerability in System.Net.Http 4.3.0 via the transitive dependency?
[img=https://i.imgur.com/YySXneJ.png]screenshot[/img]
Build/Test Issues
NCrunch.Framework 4.17.0.5 transitive dependency vulnerability
Started by GreenMoose on 1,341 views
Remco NCrunch Developer
#16871
14 Sep 2023 23:22 UTC
I would argue that this is probably a false positive. NCrunch.Framework only has one package reference, which is to System.Collections.NonGeneric.
I expect this is probably being raised because NCrunch.Framework is compiled to target netstandard 1.5, which is done for compatibility with older versions of .NET Core. Running later versions of .NET/.NETCore will automatically roll forward on system packages. This means the only way you'd get a dependency on System.Net.Http 4.3.0 is if you were running on an early version of netcore and referencing the offending package yourself.
Considering the above, I don't think this is a sensible error/warning. Especially considering that NCrunch.Framework contains no network code at all and is basically just a set of attributes.
I expect this is probably being raised because NCrunch.Framework is compiled to target netstandard 1.5, which is done for compatibility with older versions of .NET Core. Running later versions of .NET/.NETCore will automatically roll forward on system packages. This means the only way you'd get a dependency on System.Net.Http 4.3.0 is if you were running on an early version of netcore and referencing the offending package yourself.
Considering the above, I don't think this is a sensible error/warning. Especially considering that NCrunch.Framework contains no network code at all and is basically just a set of attributes.
Post a reply
Log in to reply.