TraceUpload.zip includes an old version of Microsoft.AspNetCore.Http.Features.dll, which has security vulnerabilities about applicationinsights-dotnet HOT 2 CLOSED

Duplicate of #2779.

Hi @scott-moxham, thanks for reporting the issue.
There is a transitive dependency where our SDK pulls in v2.1.1 of Microsoft.AspNetCore.Http.Features.

I took a look at this a few months ago and determined that this is not a problem for our SDK.
Please take a look at the previous issue where I have a detailed description, screenshots, and some related links.

In summary, the resolution is to update your .NET runtime and the runtime will pull in a higher version of this dependency.
This can be seen by debugging your application and inspecting the loaded Modules.

from applicationinsights-dotnet.

Thanks for your reply @TimothyMothra
When I run my app, it does show the version of Microsoft.AspNetCore.Http.Features loaded as being 7.00.523.17410, but this does beg the question, why is the old version of the dll being included in the zip file if it just loads the latest version from the runtime anyway?

from applicationinsights-dotnet.