René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Transient Dependency on System.Drawing.Common v5.0.0 with Critical Vulnerability in nHapi 3.2.2","articleBody":"## Description\n\nWe are using **nHapi version 3.2.2** in a .NET application and have identified that it has a **transitive dependency on `System.Drawing.Common` version 5.0.0**, which currently has a **critical security vulnerability** marked against it (as reported by various security scanning tools such as GitHub Dependabot and others).\n\n## Issue\n\n- `System.Drawing.Common v5.0.0` is not compatible with non-Windows platforms unless proper native dependencies are installed.\n- It also has a **critical security vulnerability**.\n- nHapi indirectly depends on this package — we’re not sure if it’s essential to the core functionality of the library.\n\n## Questions\n\n1. Is this dependency on `System.Drawing.Common` actually required by nHapi?\n2. If so, can it be updated to a more recent and secure version (e.g., 7.x or removed altogether if not used)?\n3. If it is used for legacy functionality (e.g., barcode/image rendering), can it be moved to an optional package or excluded from the core library?\n\nWe’d appreciate your advice or any planned mitigation steps.  \nThanks for maintaining nHapi!\n\n## Environment\n\n- **nHapi version:** 3.2.2  \n- **Target framework:** .NET 8 (cross-platform)  \n- **OS:** Windows / Linux\n","author":{"url":"https://github.com/aarondglover","@type":"Person","name":"aarondglover"},"datePublished":"2025-04-03T01:13:40.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":4},"url":"https://github.com/678/nHapi/issues/678"}