peter.durrant asked a question.
Flexera.FlxLicensingClient.core 2025.9.0 publishes a .NETCoreApp1.1 dependency group (nuspec) that includes Microsoft.NETCore.App 1.1.2 as a transitive dependency. On net5+ consumers, NuGet's family-precedence rules pick this group over the (cleaner) .NETStandard2.0 group, dragging in a runtime package that (a) has multiple published GHSA advisories (NU1903), and (b) is architecturally redundant because net5+ consumers get Microsoft.NETCore.App via <FrameworkReference>, not <PackageReference>.
Please either drop the .NETCoreApp1.1 group (legacy .NET Core 1.x is out of support since 2019) or add a net5.0/net6.0 group without the Microsoft.NETCore.App dependency, so modern consumers get the clean dependency graph.
