dohertj2/ScadaBridge
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(deps): clear new NuGet audit advisories (Pkcs, Cryptography.Xml, SignalR.Common)

Browse Source 
Targeted transitive pins per the house pattern, no family-wide bump, no suppression:
Cryptography.Xml 10.0.10->10.0.13; Pkcs pinned 10.0.13 in ConfigurationDatabase,
ExternalSystemGateway, NotificationService, Playwright tests; SignalR.Common 10.0.13 in CLI.
This commit is contained in:
Joseph Doherty
2026-10-22 06:15:17 -04:00
parent 2da90bf151
commit 75149e83b0
6 changed files with 23 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Directory.Packages.props
+18 -1
View File
@@ -45,6 +45,7 @@
<PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.7" />
<PackageVersion Include="Microsoft.AspNetCore.TestHost" Version="10.0.7" />
<PackageVersion Include="Microsoft.AspNetCore.SignalR.Client" Version="10.0.7" />
<PackageVersion Include="Microsoft.AspNetCore.SignalR.Common" Version="10.0.13" />
<PackageVersion Include="Microsoft.CodeAnalysis.CSharp.Scripting" Version="5.0.0" />
<PackageVersion Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="5.0.0" />
<PackageVersion Include="Microsoft.Data.SqlClient" Version="6.1.1" />
@@ -164,9 +165,25 @@
(NU1605 downgrade errors) that belongs in its own reviewed commit.
-->
<ItemGroup>
<PackageVersion Include="System.Security.Cryptography.Xml" Version="10.0.10" />
<PackageVersion Include="System.Security.Cryptography.Xml" Version="10.0.13" />
<PackageVersion Include="System.Security.Cryptography.Pkcs" Version="10.0.13" />
</ItemGroup>
<!--
2026-10-22 NuGet audit refresh (fresh restore went red under TreatWarningsAsErrors):
- System.Security.Cryptography.Xml 10.0.10 now carries GHSA-7hqp-7c5m-4vq6,
GHSA-c399-9853-6jmj, GHSA-r955-8q5j-3h83 (high): pin raised 10.0.10 -> 10.0.13.
- System.Security.Cryptography.Pkcs (GHSA-2fmv-rv2c-59x7 moderate, GHSA-846f-f764-76mx
high) reaches the graph as 9.0.4 / 10.0.0 / 10.0.10 via SqlClient 6.1.1, MimeKit and
System.Security.Cryptography.Xml: pinned to 10.0.13 with explicit PackageReferences in
ConfigurationDatabase, ExternalSystemGateway, NotificationService and the Playwright tests,
the projects where those chains enter.
- Microsoft.AspNetCore.SignalR.Common 10.0.7 (GHSA-334f-vvp4-7g6p, high) comes in
transitively through SignalR.Client in the CLI: pinned to 10.0.13 in the CLI only.
Same house pattern as above: targeted transitive pins, no family-wide servicing bump, no
NuGetAuditSuppress/NoWarn.
-->
<!--
GHSA-pgww-w46g-26qg (NU1902, moderate) on AngleSharp, reached only transitively via bunit
in ZB.MOM.WW.ScadaBridge.CentralUI.Tests. With TreatWarningsAsErrors it made the WHOLE