Question regarding new nuget version

[yaeldekel]

Hi,
I saw that there was a PR a few days ago that bumped the version of Microsoft.AspNetCore.Http from 2.1.0 to 2.1.22. When do you expect to have a new release of SimpleInjector.Integration.AspNetCore containing the new version?
Thanks,
Yael

[dotnetjunkie]

Hi @yaeldekel,

I have no intentions to release a version soon. The bump from 2.1.0 to 2.1.22 has to do with a security bulletin released by Microsoft. Apart from upgrading the version, there's no functional change or bug fix in the SimpleInjector.Integration.AspNetCore and by itself our NuGet package is not affected by the security issue. You, as an application developer, however, should update your Microsoft.AspNetCore.Http NuGet package in your applications to at least 2.1.22. Considering the the amount of Microsoft packages that recently got patched, you should do a thorough check anyway to make sure your ASP.NET Core application uses non-vulnerable Microsoft packages.

I hope this helps