> For the complete documentation index, see [llms.txt](https://docs.sealsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sealsecurity.io/legacy-documentation/artifact-server/editing-your-dependencies/nuget.md).

# Nuget

### How to replace a Nuget package

1\. Open your project's `.csproj` file.

2\. If the vulnerability is in a direct dependency, replace the existing version in the `<PackageReference>` element (the following example is `Newtonsoft.Json@12.02`):

```xml
  <ItemGroup>
    <PackageReference Include="Newtonsoft.Json" Version="12.0.2-sp1" />
  </ItemGroup>
```

3\. If the vulnerability is in a transitive dependency, add an explicit `<PackageReference>` to pin it to the sealed version:

```xml
  <ItemGroup>
    <PackageReference Include="Newtonsoft.Json" Version="12.0.2-sp1" />
  </ItemGroup>
```

{% hint style="warning" %}
The dotnet tool might generate a false warning that the sealed version is vulnerable.

It is safe to ignore this warning.

```
warning NU1903: Package 'Newtonsoft.Json' 12.0.2-sp1 has a known high severity vulnerability, https://github.com/advisories/GHSA-5crp-9r3c-p9vr
```

{% endhint %}