add comment explaining unexpected dependencies

tonerdo · Jul 30, 2024 · 1805131 · 1805131
1 parent 3c7901d
commit 1805131
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 0 deletions.
diff --git a/src/DotNetEnv/DotNetEnv.csproj b/src/DotNetEnv/DotNetEnv.csproj
@@ -24,6 +24,8 @@
     <PackageReference Include="Microsoft.Extensions.Configuration" Version="1.1.2" />
     <PackageReference Include="Microsoft.Extensions.Configuration.Abstractions" Version="1.1.2" />
     <PackageReference Include="Sprache" Version="2.3.1" />
+    <!-- Http + RegEx versions are manually updated to address sprache having a vulnerable, out of date library -->
+    <!-- https://github.com/tonerdo/dotnet-env/issues/68 -->
     <PackageReference Include="System.Net.Http" Version="4.3.4" />
     <PackageReference Include="System.Text.RegularExpressions" Version="4.3.1" />
   </ItemGroup>

diff --git a/test/DotNetEnv.Tests/DotNetEnv.Tests.csproj b/test/DotNetEnv.Tests/DotNetEnv.Tests.csproj
@@ -44,6 +44,8 @@
   <ItemGroup>
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.8.0" />
     <PackageReference Include="Sprache" Version="2.3.1" />
+    <!-- Http + RegEx versions are manually updated to address sprache having a vulnerable, out of date library -->
+    <!-- https://github.com/tonerdo/dotnet-env/issues/68 -->
     <PackageReference Include="System.Net.Http" Version="4.3.4" />
     <PackageReference Include="System.Text.RegularExpressions" Version="4.3.1" />
     <PackageReference Include="xunit" Version="2.6.2" />