.NET Core 8 Upgrade and Package Vulnerabilities

[acasciani]

Are there any plans to upgrade Microsoft.Graph.Core to .NET 8 now that .NET 6 is EOL? This library is using a System.Text.Encodings.Web which contains the following vulnerabilities:

1. CVE-2022-24464
2. CVE-2023-21538
3. CVE-2022-29117

[andrueastman]

Thanks for raising this @acasciani

We'll be looking to update library to target the NET 8 targets for LTS support on the next breaking change of library as we'd need drop the MAUI targets here.

Out of curiosity, are able to share more info on the package System.Text.Encodings.Web as we do not currently take a dependency on it? Is it a transient package? Or from the runtime?

https://www.nuget.org/packages/Microsoft.Graph.Core/3.2.1#dependencies-body-tab

[acasciani]

Thanks for the response. It looks like it is a transient package through Microsoft.Kiota.Authentication.Azure which references Azure.Core which references System.Text.Encoding.Web