dotnet / dotnet/Scaffolding

Remove explicit nuget references

Open
#2,044 0 comments 1 reaction 1 assignee Claimed by @deepchoudhery View on GitHub
area-scaffolding customer-reported
Dominant language
C#
Stars
818
Forks
260
Avg merge
1d 8h
Merged PRs (30d)
10

Description

## Ask a question

With the consolidation of TFMs to a single net6.0 target, can the explicit references to some nuget packages be removed without offending any security scanner?

I tried removing the references to these packages
* `System.Security.Cryptography.X509Certificates`
* `System.Private.Uri`
* `System.Configuration.ConfigurationManager`
* `NuGet.Packaging`
* `System.Collections.Immutable`

and ran this command
`dotnet list .\All.sln package --vulnerable --include-transitive`
which didn't report any vulnerabilities.

One potential downside of removing dependencies again is that it can break re-compilation if someone already started relying on that Scaffolding includes certain nugets.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.