It seems like in general if the Microsoft.Data.SqlClient package were updated to use v8.x rather than v6.x of various dependencies, all this noise would go away as the sub-dependencies like Microsoft.IdentityModel.Protocols.OpenIdConnect have been updated so that they just rely on the .net core provided versions instead.

The current tree looks like this (for a different vulnerability)

               └─ Microsoft.Data.SqlClient (v5.2.2)
                  ├─ Azure.Identity (v1.12.0)
                  │  └─ Azure.Core (v1.40.0)
                  │     ├─ System.ClientModel (v1.0.0)
                  │     │  └─ System.Memory.Data (v1.0.2)
                  │     │     └─ System.Text.Encodings.Web (v4.7.2)
                  │     ├─ System.Memory.Data (v1.0.2)
                  │     │  └─ System.Text.Encodings.Web (v4.7.2)
                  │     └─ System.Text.Encodings.Web (v4.7.2)
                  ├─ Microsoft.IdentityModel.JsonWebTokens (v6.35.0)
                  │  └─ System.Text.Encodings.Web (v4.7.2)
                  └─ Microsoft.IdentityModel.Protocols.OpenIdConnect (v6.35.0)
                     └─ System.IdentityModel.Tokens.Jwt (v6.35.0)
                        └─ Microsoft.IdentityModel.JsonWebTokens (v6.35.0)
                           └─ System.Text.Encodings.Web (v4.7.2)

Transitive CVE in System.Runtime.Caching #2908

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions