The latest version of JustMock contains a reference to System.Drawing.Common 5.0.0. That component has a critical severity security alert associated with it. I know I could add a reference to the latest System.Drawing.Common package to every project that is referencing JustMock, but since this is dozens of projects and I will never remember to remove this hard reference to the drawing package once it is fixed, it would be better if JustMock updated its reference. Is this possible to get into the next release?
1 Answer, 1 is accepted
0
Hello Tyler,
According to ILSpy JustMock has the following references:
.NET Framework
.NET Standard
If you use an installed version of the product, probably some of the installed assemblies refer the mentioned one, could you please clarify how you concluded this?
Regards,
Ivo
Progress Telerik
Love the Telerik and Kendo UI products and believe more people should try them? Invite a fellow developer to become a Progress customer and each of you can get a $50 Amazon gift voucher.
Tyler
commented on 24 Jul 2024, 03:45 PM
Top achievements
Rank 1
Rank 1
VS nuget manager is saying it is a transitive package brought in via JustMock:
Ivo
commented on 25 Jul 2024, 09:03 AM
Telerik team
Hello Tyler, I got it. The transitive dependency comes from System.Security.Permissions 5.0.0. Thanks for pointing this out, we will fix it in the upcoming 2024 Q3 release which is expected to be available in the first half of August.