Merge branch 'main' into logging-improvements

Author: cijothomas

src/OpenTelemetry.Instrumentation.AspNetCore/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 ## Unreleased
 
+* Added direct reference to `System.Text.Encodings.Web` with minimum version of
+`4.7.2` due to [CVE-2021-26701](https://github.com/dotnet/runtime/issues/49377).
+This impacts target frameworks `netstandard2.0` and `netstandard2.1` which has a
+reference to `Microsoft.AspNetCore.Http.Abstractions` that depends on
+`System.Text.Encodings.Web` >= 4.5.0.
+([#4399](https://github.com/open-telemetry/opentelemetry-dotnet/pull/4399))
+
 * Improve perf by avoiding boxing of common status codes values.
   ([#4360](https://github.com/open-telemetry/opentelemetry-dotnet/pull/4360),
   [#4363](https://github.com/open-telemetry/opentelemetry-dotnet/pull/4363))

src/OpenTelemetry.Instrumentation.AspNetCore/OpenTelemetry.Instrumentation.AspNetCore.csproj

@@ -21,11 +21,13 @@
   </ItemGroup>
 
   <ItemGroup Condition="'$(TargetFramework)' == 'netstandard2.0'">
+    <PackageReference Include="System.Text.Encodings.Web" Version="$(SystemTextEncodingsWebPkgVer)" />
     <PackageReference Include="Microsoft.AspNetCore.Http.Abstractions" Version="$(MicrosoftAspNetCoreHttpAbstractionsPkgVer)" />
     <PackageReference Include="Microsoft.AspNetCore.Http.Features" Version="$(MicrosoftAspNetCoreHttpFeaturesPkgVer)" />
   </ItemGroup>
 
   <ItemGroup Condition="'$(TargetFramework)' == 'netstandard2.1'">
+    <PackageReference Include="System.Text.Encodings.Web" Version="$(SystemTextEncodingsWebPkgVer)" />
     <PackageReference Include="Microsoft.AspNetCore.Http.Abstractions" Version="$(MicrosoftAspNetCoreHttpAbstractionsPkgVer)" />
     <PackageReference Include="Microsoft.AspNetCore.Http.Features" Version="$(MicrosoftAspNetCoreHttpFeaturesPkgVer)" />
   </ItemGroup>