I am working on upgrading a project from .NET 5 to .NET 8. I had Entity framework Nuget packages which I also updated to the compatible version of .NET 8.

I am getting a warning message in the Transitive Package section. It’s showing that Azure.identity package is vulnerable.

Now my question is, this Azure.Identity package is not installed in my project and its vulnerable warning shows because I have installed Microsoft.EntityFrameworkCore.SqlServer into my project.

So should I install this Azure.Identity and upgrade it to the latest version though I don’t need this package in my project.