Nuget dependency on specific Bouncy Castle version
Opened this issue · 0 comments
The latest patch version 3.6.1 took a dependency on Bouncy Castle 2.4.0 as the minimum supported version resulting in build failures upstream in dependent apps, which is unusual for a patch version. This was most likely done to address the recent vulnerabilities flagged in BC 2.3.0.
Some consumers will have their own dependency on BouncyCastle and may not be ready to jump to 2.4 (or whichever version is referenced at the time of any future update). In our case we have a custom build of BC which has been reduced in size, so we're a little slower to migrate.
If there is no strict requirement to use BC 2.4 could the package reference instead use a version range or a lower minimum:
https://learn.microsoft.com/en-us/nuget/concepts/package-versioning?tabs=semver20sort#version-ranges