From 61dab76374f3279f11b6dc855bd6e853a11789bd Mon Sep 17 00:00:00 2001
From: Chad Bentz <1760475+felickz@users.noreply.github.com>
Date: Tue, 11 Nov 2025 16:00:46 -0500
Subject: [PATCH 1/2] Add Newtonsoft.Json and RestSharp dependencies

Added Newtonsoft.Json and RestSharp package references.
---
 VulnerableLibrary/VulnerableLibrary.csproj | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/VulnerableLibrary/VulnerableLibrary.csproj b/VulnerableLibrary/VulnerableLibrary.csproj
index b2817c3..52125a1 100644
--- a/VulnerableLibrary/VulnerableLibrary.csproj
+++ b/VulnerableLibrary/VulnerableLibrary.csproj
@@ -1,4 +1,4 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
     <TargetFramework>net9.0</TargetFramework>
@@ -10,7 +10,10 @@
     <PackageReference Include="Microsoft.AspNet.WebApi.Client" />
     <PackageReference Include="Microsoft.Data.OData" />
     <PackageReference Include="Microsoft.Extensions.Logging" />
+    <PackageReference Include="Newtonsoft.Json" />
+    <PackageReference Include="RestSharp" />
     <PackageReference Include="SharpZipLib" />
+    <PackageReference Include="System.Text.Json" />
     <PackageReference Include="System.Text.RegularExpressions" />
   </ItemGroup>
 

From a83200316b164bb7eb6cd8d2d5b213c47d8c63b9 Mon Sep 17 00:00:00 2001
From: Chad Bentz <1760475+felickz@users.noreply.github.com>
Date: Tue, 11 Nov 2025 16:01:36 -0500
Subject: [PATCH 2/2] Update package versions and add new dependencies

(introduces a dependency on a vulnerable version of RestSharp)
---
 Directory.Packages.props | 37 ++++++++++++++++++++++---------------
 1 file changed, 22 insertions(+), 15 deletions(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index 434d2f7..efc27f3 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -3,30 +3,37 @@
     <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
     <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
   </PropertyGroup>
-  
   <ItemGroup>
     <!-- Common packages -->
     <PackageVersion Include="Microsoft.Extensions.Logging" Version="9.0.0" />
     <PackageVersion Include="Microsoft.Extensions.Logging.Console" Version="9.0.0" />
     <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="9.0.0" />
-    
     <!-- Vulnerable direct dependencies -->
-    <PackageVersion Include="Newtonsoft.Json" Version="12.0.3" />  <!-- Has known vulnerabilities -->
-    <PackageVersion Include="System.Text.RegularExpressions" Version="4.3.0" /> <!-- Known regex vulnerability -->
-    <PackageVersion Include="System.Net.Http" Version="4.3.0" /> <!-- Contains security vulnerabilities -->
-    
+    <PackageVersion Include="Newtonsoft.Json" Version="12.0.3" />
+    <!-- Has known vulnerabilities -->
+    <PackageVersion Include="RestSharp" Version="111.4.1" />
+    <PackageVersion Include="System.Text.Json" Version="8.0.0" />
+    <PackageVersion Include="System.Text.RegularExpressions" Version="4.3.0" />
+    <!-- Known regex vulnerability -->
+    <PackageVersion Include="System.Net.Http" Version="4.3.3" />
+    <!-- Contains security vulnerabilities -->
     <!-- API dependencies -->
-    <PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="8.0.0" /> <!-- Intentionally older version -->
-    <PackageVersion Include="Microsoft.AspNetCore.Mvc.NewtonsoftJson" Version="7.0.0" /> <!-- Older version -->
+    <PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="8.0.0" />
+    <!-- Intentionally older version -->
+    <PackageVersion Include="Microsoft.AspNetCore.Mvc.NewtonsoftJson" Version="7.0.0" />
+    <!-- Older version -->
     <PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="9.0.8" />
-    <PackageVersion Include="Swashbuckle.AspNetCore" Version="6.2.3" /> <!-- Outdated version -->
-    
+    <PackageVersion Include="Swashbuckle.AspNetCore" Version="6.2.3" />
+    <!-- Outdated version -->
     <!-- Library dependencies with transitive vulnerabilities -->
-    <PackageVersion Include="Microsoft.AspNet.WebApi.Client" Version="5.2.7" /> <!-- Has vulnerable dependencies -->
-    <PackageVersion Include="Microsoft.Data.OData" Version="5.8.4" /> <!-- Contains vulnerable dependency chain -->
-    
+    <PackageVersion Include="Microsoft.AspNet.WebApi.Client" Version="5.2.7" />
+    <!-- Has vulnerable dependencies -->
+    <PackageVersion Include="Microsoft.Data.OData" Version="5.8.4" />
+    <!-- Contains vulnerable dependency chain -->
     <!-- Utility dependencies -->
-    <PackageVersion Include="log4net" Version="2.0.12" /> <!-- Has known vulnerabilities -->
-    <PackageVersion Include="SharpZipLib" Version="1.3.1" /> <!-- Contains security issues -->
+    <PackageVersion Include="log4net" Version="2.0.12" />
+    <!-- Has known vulnerabilities -->
+    <PackageVersion Include="SharpZipLib" Version="1.3.1" />
+    <!-- Contains security issues -->
   </ItemGroup>
 </Project>