I have a similar issue now with the System.Text.Json package version, the newer vulnerability CVE-2024-43485, requiring package version 8.0.5 to fix.

Should this package version not be solely determined by the dotnet runtime?

When I search the \bin directories of an app or unit test project (not just library), no System.Text.Json.dll shows up, although many other System./Microsoft. DLLs are there.

I have SDK 8.0.403, runtime versions 8.0.10, where the issue shall be fixed, but the dotnet list command still shows vulnerable package version 8.0.4, instead of fixed 8.0.5.

Yes, I can update the existing "guard version" in Directory.Packages.props, but it shouldn't have any effect, especially in "final" code, which only goes into app/service/unit test. Or will it block execution on an older runtime?

Even where Microsoft itself uses those libraries, any version setting should be irrelevant, as long as runtime libraries are used and no specific package/DLL is delivered with them, to override the runtime version.

BTW: I found DLLs of System.Text.Json in NET 6 builds, although it has been part of the runtime since some 3.x version.