From 95c6ccdbf8673c725e8d0b12c4a2e0b4d2e127bc Mon Sep 17 00:00:00 2001
From: Stef Heyenrath <Stef.Heyenrath@gmail.com>
Date: Sun, 15 Nov 2026 09:09:00 +0100
Subject: [PATCH] Depend on Microsoft.AspNetCore.App for .NET 8 and .NET 10
 (#1544)

---
 .../WireMock.Net.ConsoleApp.UsingNuGet.csproj          |  4 ----
 src/WireMock.Net.Shared/WireMock.Net.Shared.csproj     | 10 +++++++++-
 .../WireMock.Net.Tests.UsingNuGet.csproj               |  4 +---
 3 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/examples/WireMock.Net.ConsoleApp.UsingNuGet/WireMock.Net.ConsoleApp.UsingNuGet.csproj b/examples/WireMock.Net.ConsoleApp.UsingNuGet/WireMock.Net.ConsoleApp.UsingNuGet.csproj
index 9bb1b342..f8f8a02c 100644
--- a/examples/WireMock.Net.ConsoleApp.UsingNuGet/WireMock.Net.ConsoleApp.UsingNuGet.csproj
+++ b/examples/WireMock.Net.ConsoleApp.UsingNuGet/WireMock.Net.ConsoleApp.UsingNuGet.csproj
@@ -7,10 +7,6 @@
         <Nullable>enable</Nullable>
     </PropertyGroup>
 
-    <ItemGroup>
-        <PackageReference Update="SonarAnalyzer.CSharp" Version="10.12.0.118525" />
-    </ItemGroup>
-
     <ItemGroup>
         <PackageReference Include="WireMock.Net" Version="2.30.0" />
     </ItemGroup>
diff --git a/src/WireMock.Net.Shared/WireMock.Net.Shared.csproj b/src/WireMock.Net.Shared/WireMock.Net.Shared.csproj
index cd123d2f..9647fb77 100644
--- a/src/WireMock.Net.Shared/WireMock.Net.Shared.csproj
+++ b/src/WireMock.Net.Shared/WireMock.Net.Shared.csproj
@@ -26,11 +26,19 @@
     </PropertyGroup>
 
     <!-- CVE -->
-    <ItemGroup>
+    <ItemGroup Condition=" '$(TargetFramework)' != 'net8.0' and '$(TargetFramework)' != 'net10.0' ">
         <PackageReference Include="Microsoft.AspNetCore.Http" Version="2.3.14" />
         <PackageReference Include="Microsoft.AspNetCore.WebUtilities" Version="2.3.14" />
     </ItemGroup>
 
+    <ItemGroup Condition=" '$(TargetFramework)' == 'net8.0' or '$(TargetFramework)' == 'net10.0' ">
+        <!--
+        This project referenced the legacy Microsoft.AspNetCore.Http 2.3.x package which depends on a
+        Microsoft.AspNetCore.WebUtilities inside GHSA-6527-9fp8-r4x6, so it shipped a vulnerable dependency to every consumer.
+         -->
+        <FrameworkReference Include="Microsoft.AspNetCore.App" />
+    </ItemGroup>
+
     <ItemGroup>
         <PackageReference Include="Stef.Validation" Version="0.3.0" />
         <PackageReference Include="AnyOf" Version="0.5.0.1" />
diff --git a/test/WireMock.Net.Tests.UsingNuGet/WireMock.Net.Tests.UsingNuGet.csproj b/test/WireMock.Net.Tests.UsingNuGet/WireMock.Net.Tests.UsingNuGet.csproj
index 2f4682f0..30b77806 100644
--- a/test/WireMock.Net.Tests.UsingNuGet/WireMock.Net.Tests.UsingNuGet.csproj
+++ b/test/WireMock.Net.Tests.UsingNuGet/WireMock.Net.Tests.UsingNuGet.csproj
@@ -16,7 +16,7 @@
             <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
         </PackageReference>
         <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.11.0" />
-        <PackageReference Include="WireMock.Net" Version="2.21.0" />
+        <PackageReference Include="WireMock.Net" Version="2.31.0" />
         <PackageReference Include="xunit.v3" Version="3.2.2" />
         <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5">
             <PrivateAssets>all</PrivateAssets>
@@ -29,14 +29,12 @@
     </ItemGroup>
 
     <ItemGroup>
-        <!--<PackageReference Update="JetBrains.Annotations" Version="2025.2.4" />-->
         <PackageReference Include="OpenTelemetry" Version="1.17.0" />
         <PackageReference Include="OpenTelemetry.Api" Version="1.17.0" />
         <PackageReference Include="OpenTelemetry.Api.ProviderBuilderExtensions" Version="1.17.0" />
         <PackageReference Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.17.0" />
         <PackageReference Include="OpenTelemetry.Extensions.Hosting" Version="1.17.0" />
         <PackageReference Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.17.0" />
-        <PackageReference Update="SonarAnalyzer.CSharp" Version="10.11.0.117924" />
     </ItemGroup>
 
     <!-- CVE -->