Package 'Newtonsoft.Json' 9.0.1 has a known moderate severity (coverlet.core)

[Bertk]

Project coverlet.core uses vulnerable Package 'Newtonsoft.Json 9.0.1'. This assembly is also added coverlet Nuget packages.

The version is defined in Directory.Build.targets with comment "Do not upgrade".

    <!-- Do not upgrade this version or we won't support old SDK -->
    <PackageReference Update="Newtonsoft.Json" Version="9.0.1" />
    <PackageReference Update="NuGet.Packaging" Version="5.4.0" />
    <PackageReference Update="ReportGenerator.Core" Version="4.6.0" />

When will the Newtonsoft.Json package version be upgraded to V13.0.3?

[SeijiSuenaga]

@Bertk do you know when a version of Coverlet with this security patch might be published? I see the PR was merged 5 months ago, but the latest published version 6.0.0 was 8 months ago. Sorry for the ping if the plan is already documented somewhere, but I couldn't find it.

[Bertk]

coverlet nuget packages will be released soon. By,the way the Newtonsoft.Json package will be replaced (#1513).