add comment

Azure · May 30, 2024 · d5f99d1 · d5f99d1
1 parent 17b50bc
commit d5f99d1
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/src/WebJobs.Extensions.DurableTask/WebJobs.Extensions.DurableTask.csproj b/src/WebJobs.Extensions.DurableTask/WebJobs.Extensions.DurableTask.csproj
@@ -99,6 +99,8 @@
     <PackageReference Include="Azure.Identity" Version="1.11.0" />
     <PackageReference Include="Microsoft.Azure.WebJobs" Version="3.0.37" />
     <PackageReference Include="Microsoft.AspNetCore.Mvc.WebApiCompatShim" Version="2.2.0" />
+	<!-- To access Kestrel, use metapackage and leverage framework dependency on AspNetCore.
+	This allows us to avoid dependency on outdated Kestrel packages from NuGet, which may have CVEs-->
 	<PackageReference Include="Microsoft.AspNetCore.App" />
 	<PackageReference Include="Microsoft.Extensions.Azure" Version="1.1.1" />
     <PackageReference Include="Microsoft.Extensions.Http" Version="2.2.0" />