GHSA-8g2p-5pqh-5jmc VS announcements

... Project `Planfact.Infrastructure.Calendar` has the following vulnerable packages [net6.0]: Top-level Package Requested Resolved Severity Advisory URL > System.Data.SqlClient 4.8.3 4.8.3 Moderate https://github.com/advisories/GHSA-8g2p-5pqh-5jmc High https://github.com/advisories/GHSA-98g6-xh36-x2p7 The given project `Planfact.Infrastructure.Common` has no vulnerable packages given the current sources. Project `Planfact.Infrastructure.Currency` has the following vulnerable packages [net6.0]: Top-level Package Requested Resolved Severity Advisory URL > System.Data.SqlClient 4.8.3 4.8.3 Moderate https://github.com/advisories/GHSA-8g2p-5pqh-5jmc High https://github.com/advisories/GHSA-98g6-xh36-x2p7 Project `Planfact.Infrastructure.Locker` has the following vulnerable packages [net6.0]: Top-level Package Requested Resolved Severity Advisory URL > System.Data.SqlClient 4.8.3 4.8.3 Moderate https://github.com/advisories/GHSA-8g2p-5pqh-5jmc High https://github.com/advisories/GHSA-98g6-xh36-x2p7 The given project `Planfact.Infrastructure.Locker.Tests.Unit` has no vulnerable packages given the current sources. The given project `Planfact.Infrastructure.Pool` has no vulnerable packages given the current sources. Project `Planfact.Infrastructure.Repositories` has the following vulnerable packages [net6.0]: Top-level Package Requested Resolved Severity Advisory URL > System.Data.SqlClient 4.8.3 4.8.3 Moderate https://github.com/advisories/GHSA-8g2p-5pqh-5jmc High https://github.com/advisories/GHSA-98g6-xh36-x2p7 The given project `Planfact.Infrastructure.Rules` has no vulnerable packages given the current sources. ...

I don't think that works. That would alert you about the security alerts on the Security tab of the dotnet/announcements repo, which are empty, not about issues that contain information about .Net security issues.

.NET Core 2.0 Cryptography uses Apple Security Framework on macOS · Issue #21 · dotnet/announcements (github.com)

Yeah, it's a fun meme, but there have been a few nasty RCE vulnerabilities patched on .NET Core in the last couple years. Like this one: https://github.com/dotnet/announcements/issues/178

If you started receiving errors when pulling old versions of dotnet docker images (like the .NET 2.1), it's because Microsoft deleted them from Docker Hub on August 21st, 2021. That date is not a coincidence, the .NET Core 2.1 reached end of support in the same date. For more details take a look at the official dotnet announcement or also the dotnet blog. In my case, the error bellow was thrown in the stdout when pulling the microsoft/dotnet:2.2-aspnetcore-runtime image:

I'm not entirely sure what that means. We're done porting .NET Framework APIs to .NET Core / .NET 5. .NET Framework is what it is now, and .NET is moving forward with .NET 6+. If it is worth porting your code to .NET 6, it is. If not, then it isn't. Both can be good choices. .NET Core on Linux, however, is absolutely not preview.