v1.37.7 and net8 depends on STJ 9.0.0

[jnyrup]

With #1582 and https://github.com/bUnit-dev/bUnit/pull/1620/files#diff-5baf5f9e448ad54ab25a091adee0da05d4d228481c9200518fcb1b53a65d4156R31 all targets of bUnit depends on STJ 9.0.z.

• 1.32.7
  • ns2.1, net5 & net6 depend on STJ 6.0.9
  • net7, net8 & net9 depend on STJ 8.0.4
• 1.33.3
  • All targets depend on STJ 8.0.5
• 1.37.7
  • All targets depend on STJ 9.0.0

When testing a .NET 8 application using bUnit 1.37.7+, the tested version of STJ is now 9.0.z, while the deployed application won't have STJ 9.0.z.

My question is now to consider reverting #1582 such that bUnit doesn't bump the STJ to 9.0.z for all targets.
I tried cloning the repo and do the revert, and all unit tests passed.

[linkdotnet]

Hey @jnyrup

Is there any problem using 9.0.x for STJ? It doesn't have any special dependencies for net8.0/ net9.0: https://www.nuget.org/packages/System.Text.Json/9.0.4#dependencies-body-tab

For us, it keeps the maintenance cost low.

[jnyrup]

I could probably explicitly include and update STJ in my applications to 9.0.z, but I find it somewhat odd that I would need that to satisfy a dependency of a test library.

[linkdotnet]

Okay it is fair, that we didn't update the version. The reason is that we are currently working on v2 and it just takes resources (maybe not many, but we always have to make a release).

We did this in the first place, because we have a transient dependency to STJ. As it did have a CVE, we took the liberty to "override" the version so that users don't suffer as well.
While MS itself would recommend the opposite, we found this not to be "nice".

We might be able to drop the dependency entirely ourselves (latest with v2).

[linkdotnet]

@jnyrup the latest 1.40.0 should have fixed that issue.

[jnyrup]

Yeah, I just noticed the other day with the new release.
Thanks!