Moq phoning home with/to SponsorLink? What to do about it.
Hopefully you've heard about the latest changes to a popular Open Source Software Project used by the .NET ecosystem. No? Well here is some reading material:
This issue in Moq's GitHub repo has more information as well.
https://github.com/moq/moq/issues/1372
Ok...so how do you handle this? I'm sure most of us out there in the world have other projects in flight and don't want to end up accidently pulling in this problematic NuGet package. Most clients/project managers/projects don't respond well to having to stop active development on a dime just to refactor a bunch of test code. So what do we do? Microsoft has us covered in this scenario. In this case we only want to allow Moq v4.18.4. We will come back later on when we have time to refactor/replace Moq. Let's consult the docs shall we?
We need to go through our solution and replace each PackageReference for Moq in each project that uses it. So we're going from this:
<PackageReference Include="Moq" Version="4.18.4" />to this:
<PackageReference Include="Moq" Version="[4.18.4]" />
Is this foolproof? No, you can still update the Moq package. By removing the option in the Updates tab, you will have removed the temptation to update it.