High Severity Vulnerabilities

[leeoades]

Newtonsoft.Json and System.Net.Http have been flagged as containing known high severity vulnerabilities.

Upgrading them seems essential.

Is the best practice to upgrade to the lowest possible safe version? The most up-to-date version. Something in between?

D:\a\stateless\stateless\test\Stateless.Tests\Stateless.Tests.csproj : error NU1903: Warning As Error: Package 'Newtonsoft.Json' 9.0.1 has a known high severity vulnerability, https://github.com/advisories/GHSA-5crp-9r3c-p9vr [D:\a\stateless\stateless\Stateless.sln]
D:\a\stateless\stateless\test\Stateless.Tests\Stateless.Tests.csproj : error NU1903: Warning As Error: Package 'System.Net.Http' 4.1.0 has a known high severity vulnerability, https://github.com/advisories/GHSA-7jgj-8wvc-jh57 [D:\a\stateless\stateless\Stateless.sln]

[leeoades]

Ah. So they were implicit references through Microsoft.NET.Test.Sdk.

PR: #608