From 75149e83b051f786b920f8598a66963b41f7f884 Mon Sep 17 00:00:00 2001
From: Joseph Doherty <dohejw01@gmail.com>
Date: Thu, 22 Oct 2026 06:15:17 -0400
Subject: [PATCH] fix(deps): clear new NuGet audit advisories (Pkcs,
 Cryptography.Xml, SignalR.Common)

Targeted transitive pins per the house pattern, no family-wide bump, no suppression:
Cryptography.Xml 10.0.10->10.0.13; Pkcs pinned 10.0.13 in ConfigurationDatabase,
ExternalSystemGateway, NotificationService, Playwright tests; SignalR.Common 10.0.13 in CLI.
---
 Directory.Packages.props                      | 19 ++++++++++++++++++-
 .../ZB.MOM.WW.ScadaBridge.CLI.csproj          |  1 +
 ...W.ScadaBridge.ConfigurationDatabase.csproj |  1 +
 ...W.ScadaBridge.ExternalSystemGateway.csproj |  1 +
 ....WW.ScadaBridge.NotificationService.csproj |  1 +
 ...adaBridge.CentralUI.PlaywrightTests.csproj |  1 +
 6 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index 5d2209d6..00d3b04e 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -45,6 +45,7 @@
     <PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.7" />
     <PackageVersion Include="Microsoft.AspNetCore.TestHost" Version="10.0.7" />
     <PackageVersion Include="Microsoft.AspNetCore.SignalR.Client" Version="10.0.7" />
+    <PackageVersion Include="Microsoft.AspNetCore.SignalR.Common" Version="10.0.13" />
     <PackageVersion Include="Microsoft.CodeAnalysis.CSharp.Scripting" Version="5.0.0" />
     <PackageVersion Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="5.0.0" />
     <PackageVersion Include="Microsoft.Data.SqlClient" Version="6.1.1" />
@@ -164,9 +165,25 @@
     (NU1605 downgrade errors) that belongs in its own reviewed commit.
   -->
   <ItemGroup>
-    <PackageVersion Include="System.Security.Cryptography.Xml" Version="10.0.10" />
+    <PackageVersion Include="System.Security.Cryptography.Xml" Version="10.0.13" />
+    <PackageVersion Include="System.Security.Cryptography.Pkcs" Version="10.0.13" />
   </ItemGroup>
 
+  <!--
+    2026-10-22 NuGet audit refresh (fresh restore went red under TreatWarningsAsErrors):
+      - System.Security.Cryptography.Xml 10.0.10 now carries GHSA-7hqp-7c5m-4vq6,
+        GHSA-c399-9853-6jmj, GHSA-r955-8q5j-3h83 (high): pin raised 10.0.10 -> 10.0.13.
+      - System.Security.Cryptography.Pkcs (GHSA-2fmv-rv2c-59x7 moderate, GHSA-846f-f764-76mx
+        high) reaches the graph as 9.0.4 / 10.0.0 / 10.0.10 via SqlClient 6.1.1, MimeKit and
+        System.Security.Cryptography.Xml: pinned to 10.0.13 with explicit PackageReferences in
+        ConfigurationDatabase, ExternalSystemGateway, NotificationService and the Playwright tests,
+        the projects where those chains enter.
+      - Microsoft.AspNetCore.SignalR.Common 10.0.7 (GHSA-334f-vvp4-7g6p, high) comes in
+        transitively through SignalR.Client in the CLI: pinned to 10.0.13 in the CLI only.
+    Same house pattern as above: targeted transitive pins, no family-wide servicing bump, no
+    NuGetAuditSuppress/NoWarn.
+  -->
+
   <!--
     GHSA-pgww-w46g-26qg (NU1902, moderate) on AngleSharp, reached only transitively via bunit
     in ZB.MOM.WW.ScadaBridge.CentralUI.Tests. With TreatWarningsAsErrors it made the WHOLE
diff --git a/src/ZB.MOM.WW.ScadaBridge.CLI/ZB.MOM.WW.ScadaBridge.CLI.csproj b/src/ZB.MOM.WW.ScadaBridge.CLI/ZB.MOM.WW.ScadaBridge.CLI.csproj
index 1f259c8f..03e5a8db 100644
--- a/src/ZB.MOM.WW.ScadaBridge.CLI/ZB.MOM.WW.ScadaBridge.CLI.csproj
+++ b/src/ZB.MOM.WW.ScadaBridge.CLI/ZB.MOM.WW.ScadaBridge.CLI.csproj
@@ -12,6 +12,7 @@
   </ItemGroup>
   <ItemGroup>
     <PackageReference Include="Microsoft.AspNetCore.SignalR.Client" />
+    <PackageReference Include="Microsoft.AspNetCore.SignalR.Common" />
     <PackageReference Include="System.CommandLine" />
   </ItemGroup>
   <ItemGroup>
diff --git a/src/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.csproj b/src/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.csproj
index 5af71404..d81a1537 100644
--- a/src/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.csproj
+++ b/src/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.csproj
@@ -24,6 +24,7 @@
          10.0.7 carries four NU1903 high-severity advisories that break fresh restores
          under TreatWarningsAsErrors. See Directory.Packages.props for the rationale. -->
     <PackageReference Include="System.Security.Cryptography.Xml" />
+    <PackageReference Include="System.Security.Cryptography.Pkcs" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/src/ZB.MOM.WW.ScadaBridge.ExternalSystemGateway/ZB.MOM.WW.ScadaBridge.ExternalSystemGateway.csproj b/src/ZB.MOM.WW.ScadaBridge.ExternalSystemGateway/ZB.MOM.WW.ScadaBridge.ExternalSystemGateway.csproj
index 58505b63..edfe3010 100644
--- a/src/ZB.MOM.WW.ScadaBridge.ExternalSystemGateway/ZB.MOM.WW.ScadaBridge.ExternalSystemGateway.csproj
+++ b/src/ZB.MOM.WW.ScadaBridge.ExternalSystemGateway/ZB.MOM.WW.ScadaBridge.ExternalSystemGateway.csproj
@@ -8,6 +8,7 @@
   </PropertyGroup>
 
   <ItemGroup>
+    <PackageReference Include="System.Security.Cryptography.Pkcs" />
     <PackageReference Include="Microsoft.Data.SqlClient" />
     <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" />
     <PackageReference Include="Microsoft.Extensions.Http" />
diff --git a/src/ZB.MOM.WW.ScadaBridge.NotificationService/ZB.MOM.WW.ScadaBridge.NotificationService.csproj b/src/ZB.MOM.WW.ScadaBridge.NotificationService/ZB.MOM.WW.ScadaBridge.NotificationService.csproj
index 3a3979cc..39adb681 100644
--- a/src/ZB.MOM.WW.ScadaBridge.NotificationService/ZB.MOM.WW.ScadaBridge.NotificationService.csproj
+++ b/src/ZB.MOM.WW.ScadaBridge.NotificationService/ZB.MOM.WW.ScadaBridge.NotificationService.csproj
@@ -8,6 +8,7 @@
   </PropertyGroup>
 
   <ItemGroup>
+    <PackageReference Include="System.Security.Cryptography.Pkcs" />
     <PackageReference Include="MailKit" />
     <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" />
     <PackageReference Include="Microsoft.Extensions.Http" />
diff --git a/tests/ZB.MOM.WW.ScadaBridge.CentralUI.PlaywrightTests/ZB.MOM.WW.ScadaBridge.CentralUI.PlaywrightTests.csproj b/tests/ZB.MOM.WW.ScadaBridge.CentralUI.PlaywrightTests/ZB.MOM.WW.ScadaBridge.CentralUI.PlaywrightTests.csproj
index 213994f2..e8657283 100644
--- a/tests/ZB.MOM.WW.ScadaBridge.CentralUI.PlaywrightTests/ZB.MOM.WW.ScadaBridge.CentralUI.PlaywrightTests.csproj
+++ b/tests/ZB.MOM.WW.ScadaBridge.CentralUI.PlaywrightTests/ZB.MOM.WW.ScadaBridge.CentralUI.PlaywrightTests.csproj
@@ -9,6 +9,7 @@
   </PropertyGroup>
 
   <ItemGroup>
+    <PackageReference Include="System.Security.Cryptography.Pkcs" />
     <PackageReference Include="coverlet.collector" />
     <PackageReference Include="Microsoft.Data.SqlClient" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" />