Hi,
OK, I've done some digging around, and I think I've worked it out.
If I clone the jsreport.Client repo and look at it's packages, there's a dependency on jsreport.Types 3.8.1, which in turn has a dependency on NetStandard.Library 2.0.3 and no vulnerabilities.
However in the application where I'm using jsreport.Client, it's showing jsReport.Types 3.8.1 as using NetStandard.Library 1.6.1 as it's dependency.
I've removed the cached copy of NetStandard.Library 1.6.1, removed jsreport.Client from my app and then re-added it and it's picking up NetStandard.Library 2.0.3.
Having a look at jsreport.Types, I can see it lists NetStandard.Library >= 1.6.1 as it's dependency, so it's just the unique situation where I had that version cached locally, so Visual Studio was using that, rather than the latest 2.0.3.
Thanks,
Neil.