Hi,

During a recent application security assessment using Checkmarx, we identified vulnerabilities associated with third-party libraries included in platform-provided components that are outside the direct control of the application development team. 

One of the findings references Microsoft.OpenApi.Kiota 1.32.3, which appears to be introduced through platform/runtime dependencies. 

As an example, the vulnerable library was detected through the dependency chain shown below: bin/Microsoft.Extensions.Diagnostics.dll We would appreciate clarification from the product team regarding: 

 -> Whether this dependency is a known issue. 

 -> The remediation plan and expected availability of updated components. 

 -> Any recommended mitigation actions that can be applied in the meantime. 

 -> Whether updated versions of the affected platform components are already available. 

Any guidance would be greatly appreciated.