From ad851ddf4126ae4013753f61a82035ed27352792 Mon Sep 17 00:00:00 2001 From: KrzysztofPajak Date: Sat, 8 Aug 2026 21:39:40 +0200 Subject: [PATCH 1/2] Document why AdminShared pins Microsoft.AspNetCore.Http The package looks like a stray ASP.NET Core 2.x reference on net10.0 and was queued for removal on that reading. It is not: elFinder.Net.* 1.5.0 pulls in the ASP.NET Core 2.1.x graph, including Microsoft.AspNetCore.Http 2.1.1, which carries GHSA-hxrm-9w7p-39cc (high severity). Removing the reference lets the transitive 2.1.1 win and restore starts warning NU1903. The reference is a deliberate lift to a patched 2.x, so it stays until elFinder itself is replaced or upgraded. Co-Authored-By: Claude Opus 5 --- src/Web/Grand.Web.AdminShared/Grand.Web.AdminShared.csproj | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/Web/Grand.Web.AdminShared/Grand.Web.AdminShared.csproj b/src/Web/Grand.Web.AdminShared/Grand.Web.AdminShared.csproj index 93edf2ba1..b9613c8bf 100644 --- a/src/Web/Grand.Web.AdminShared/Grand.Web.AdminShared.csproj +++ b/src/Web/Grand.Web.AdminShared/Grand.Web.AdminShared.csproj @@ -13,6 +13,9 @@ + From 29769bd6c4e149e1faf9074fe274405b8e9f8c79 Mon Sep 17 00:00:00 2001 From: KrzysztofPajak Date: Sat, 8 Aug 2026 21:46:19 +0200 Subject: [PATCH 2/2] Remove redundant direct SixLabors.ImageSharp references ImageSharp is not used anywhere in the solution - there is no `SixLabors` identifier in any .cs file. It reached three .csproj files as a direct reference, which read like a second graphics stack alongside SkiaSharp. It is neither. `dotnet nuget why` shows it arriving transitively through Scryber.Core 9.5.0 and elFinder.Net.Core 1.5.0, both of which already ask for 3.1.12. Dropping the three references and the now-unreferenced PackageVersion resolves the same 3.1.12 with no NU1903 downgrade warning, so these were pins to a version the graph produced on its own. ImageSharp still ships in the output through those two dependencies, so the Six Labors Split License question is unaffected by this change. Co-Authored-By: Claude Opus 5 --- Directory.Packages.props | 1 - src/Business/Grand.Business.Common/Grand.Business.Common.csproj | 1 - src/Web/Grand.Web.Admin/Grand.Web.Admin.csproj | 1 - src/Web/Grand.Web.AdminShared/Grand.Web.AdminShared.csproj | 1 - 4 files changed, 4 deletions(-) diff --git a/Directory.Packages.props b/Directory.Packages.props index 24c8ecc1b..a846c02c7 100644 --- a/Directory.Packages.props +++ b/Directory.Packages.props @@ -17,7 +17,6 @@ - diff --git a/src/Business/Grand.Business.Common/Grand.Business.Common.csproj b/src/Business/Grand.Business.Common/Grand.Business.Common.csproj index 0e1569a1c..39e498108 100644 --- a/src/Business/Grand.Business.Common/Grand.Business.Common.csproj +++ b/src/Business/Grand.Business.Common/Grand.Business.Common.csproj @@ -2,7 +2,6 @@ - diff --git a/src/Web/Grand.Web.Admin/Grand.Web.Admin.csproj b/src/Web/Grand.Web.Admin/Grand.Web.Admin.csproj index 0fedbbade..618afe4d5 100644 --- a/src/Web/Grand.Web.Admin/Grand.Web.Admin.csproj +++ b/src/Web/Grand.Web.Admin/Grand.Web.Admin.csproj @@ -19,7 +19,6 @@ - diff --git a/src/Web/Grand.Web.AdminShared/Grand.Web.AdminShared.csproj b/src/Web/Grand.Web.AdminShared/Grand.Web.AdminShared.csproj index b9613c8bf..8f965a46f 100644 --- a/src/Web/Grand.Web.AdminShared/Grand.Web.AdminShared.csproj +++ b/src/Web/Grand.Web.AdminShared/Grand.Web.AdminShared.csproj @@ -17,6 +17,5 @@ Microsoft.AspNetCore.Http 2.1.1 has a known high severity advisory (GHSA-hxrm-9w7p-39cc). This reference lifts it to a patched 2.x. Remove only together with elFinder. --> -