AutoFixture vulnerabilities found in Snyk

[ingshak]

I've been running Snyk on my project (.net 6) and I've been getting multiple vulnerabilities from AutoFixture mostly because of System.Net.Http@4.3.0 and System.Text.RegularExpressions@4.3.0. Are there any plans to update System.Net.Http or any other ideas on how to fix this?
Examples of the vulnerabilities are:
Denial of Service (DoS)
Improper Certificate Validation
Privilege Escalation
Regular Expression Denial of Service (ReDoS)

[aivascu]

AutoFixture does not have a direct dependency on System.Net.Http and System.Text.RegularExpressions.

So they're likely transient dependencies of NETStandard.Library. The version 1 has been dropped already in the preview version but v2 that still has those dependencies might be staying for one or two major releases.

You should likely stop seeing the warning if you would install the latest preview version on the MyGet feed, since that one targets net5.0.

[Shadow1307]

Sorry for necroing this question,

But is there an idea when the Preview updates will be added to the stable release?
I saw it was Fare Nuget that was causing the Snyk report to fail.

Preview does indeed fix it, but sadly company mandated to not use preview if we can help it.
Thanks for the awesome project, been immensely helpful

[aivascu]

@Shadow1307 the v5 roadmap is near completion. There's a few more breaking changes that need to go in before RC/Release.
Everything that will not require breaking changes will be completed after 5.0 is published.
I'd like it to be done in 1~2 months but can't give certain deadlines, since it heavily depends on how much free time I get, which is not a lot.