From a808e3ab463a9eb1c082b9e4595daea347bb29c5 Mon Sep 17 00:00:00 2001
From: Andy Butland <abutland73@gmail.com>
Date: Mon, 20 Oct 2025 11:54:26 +0200
Subject: [PATCH] Added direct dependency to secure version of
 Microsoft.Build.Tasks.Core in Umbraco.Web.UI (#20546)

Added direct dependency to secure version of Microsoft.Build.Tasks.Core in Umbraco.Web.UI.
---
 src/Umbraco.Web.UI/Umbraco.Web.UI.csproj | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/Umbraco.Web.UI/Umbraco.Web.UI.csproj b/src/Umbraco.Web.UI/Umbraco.Web.UI.csproj
index 051ecc5cfd..2ade2ca396 100644
--- a/src/Umbraco.Web.UI/Umbraco.Web.UI.csproj
+++ b/src/Umbraco.Web.UI/Umbraco.Web.UI.csproj
@@ -26,6 +26,11 @@
   <ItemGroup>
     <!-- Add design/build time support for EF Core migrations -->
     <PackageReference Include="Microsoft.EntityFrameworkCore.Design" PrivateAssets="all" Version="10.0.0-rc.2.25502.107" />
+    <!--
+    Added the following direct dependency due to Microsoft.EntityFrameworkCore.Design having a dependency on an insecure version.
+    Review for removal when Microsoft.EntityFrameworkCore.Design is updated to a newer version.
+    -->
+    <PackageReference Include="Microsoft.Build.Tasks.Core" PrivateAssets="all" Version="17.14.28" />
   </ItemGroup>
 
   <ItemGroup>