dependabot

Author: narasimhakudva

src/ShippingRules.API/ShippingRules.API.csproj

@@ -10,9 +10,30 @@
     <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="9.0.9" />
     <PackageReference Include="Serilog.AspNetCore" Version="10.0.0" />
     <PackageReference Include="Swashbuckle.AspNetCore" Version="7.2.0" />
-    <!-- VULNERABLE DEPENDENCY FOR TESTING PURPOSES ONLY -->
-    <!-- This package has known security vulnerabilities - DO NOT USE IN PRODUCTION -->
+    
+    <!-- ============================================ -->
+    <!-- VULNERABLE DEPENDENCIES FOR GHAS TESTING ONLY -->
+    <!-- These packages have known CVEs - DO NOT USE IN PRODUCTION -->
+    <!-- Remove after GHAS/Dependabot testing is complete -->
+    <!-- ============================================ -->
+    
+    <!-- CVE-2024-21907: Denial of Service vulnerability -->
     <PackageReference Include="Newtonsoft.Json" Version="9.0.1" />
+    
+    <!-- CVE-2018-8292: Information Disclosure vulnerability -->
+    <PackageReference Include="System.Net.Http" Version="4.3.0" />
+    
+    <!-- CVE-2019-0820: Denial of Service vulnerability -->
+    <PackageReference Include="System.Text.RegularExpressions" Version="4.3.0" />
+    
+    <!-- CVE-2019-0980, CVE-2019-0981: Remote Code Execution vulnerabilities -->
+    <PackageReference Include="System.Private.Uri" Version="4.3.0" />
+    
+    <!-- Multiple CVEs: Security vulnerabilities in older version -->
+    <PackageReference Include="Microsoft.Data.OData" Version="5.6.0" />
+    
+    <!-- CVE-2021-26701: Remote Code Execution vulnerability -->
+    <PackageReference Include="System.Net.Http.WinHttpHandler" Version="4.3.0" />
   </ItemGroup>
 
   <ItemGroup>