From dced0d27942756e9dea2675a156470f98a48c306 Mon Sep 17 00:00:00 2001
From: Joseph Doherty <dohejw01@gmail.com>
Date: Tue, 21 Jul 2026 10:53:26 -0400
Subject: [PATCH] =?UTF-8?q?fix(deps):=20pin=20System.Security.Cryptography?=
 =?UTF-8?q?.Xml=2010.0.10=20=E2=80=94=20four=20new=20NU1903=20advisories?=
 =?UTF-8?q?=20on=20the=2010.0.7=20DataProtection=20transitive=20broke=20fr?=
 =?UTF-8?q?esh=20restores=20(docker=20image=20build)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Same pattern as the SQLitePCLRaw pin: direct PackageReference at the chain's entry
project (ConfigurationDatabase). Bumping the DataProtection parent instead was tried
and rejected — 10.0.10 floors Microsoft.Extensions.*/EF at 10.0.10 (NU1605 cascade).
---
 Directory.Packages.props                      | 21 +++++++++++++++++++
 ...W.ScadaBridge.ConfigurationDatabase.csproj |  4 ++++
 2 files changed, 25 insertions(+)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index d1ad6eeb..71e1ff93 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -145,6 +145,27 @@
     <PackageVersion Include="SQLitePCLRaw.lib.e_sqlite3" Version="2.1.12" />
   </ItemGroup>
 
+  <!--
+    Four NU1903 high-severity advisories (GHSA-23rf-6693-g89p, GHSA-8q5v-6pqq-x66h,
+    GHSA-cvvh-rhrc-wg4q, GHSA-g8r8-53c2-pm3f) landed in the NuGet audit data against
+    System.Security.Cryptography.Xml 10.0.7, pulled in TRANSITIVELY by
+    Microsoft.AspNetCore.DataProtection 10.0.7 (ConfigurationDatabase's DataProtection
+    key storage). With TreatWarningsAsErrors any FRESH restore — notably the docker
+    image build — went red (surfaced 2026-07-21; local builds had cached audit data).
+
+    Same pattern as SQLitePCLRaw above: pin the vulnerable transitive package to its
+    patched version (10.0.10) with an explicit <PackageReference> in the one project
+    where the chain enters (ConfigurationDatabase; every other resolver — AuditLog,
+    SiteCallAudit, Transport, PerformanceTests, tests — reaches it through that
+    ProjectReference). Bumping the DataProtection parent instead was tried and
+    rejected: 10.0.10 floors Microsoft.Extensions.* and (via the EFCore adapter)
+    Microsoft.EntityFrameworkCore at 10.0.10, forcing a family-wide servicing bump
+    (NU1605 downgrade errors) that belongs in its own reviewed commit.
+  -->
+  <ItemGroup>
+    <PackageVersion Include="System.Security.Cryptography.Xml" Version="10.0.10" />
+  </ItemGroup>
+
   <!--
     GHSA-pgww-w46g-26qg (NU1902, moderate) on AngleSharp, reached only transitively via bunit
     in ZB.MOM.WW.ScadaBridge.CentralUI.Tests. With TreatWarningsAsErrors it made the WHOLE
diff --git a/src/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.csproj b/src/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.csproj
index d6d5a4ca..5af71404 100644
--- a/src/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.csproj
+++ b/src/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.csproj
@@ -20,6 +20,10 @@
     <PackageReference Include="Microsoft.Extensions.Options" />
     <PackageReference Include="Microsoft.AspNetCore.DataProtection" />
     <PackageReference Include="Microsoft.AspNetCore.DataProtection.EntityFrameworkCore" />
+    <!-- Direct pin of a transitive dependency of Microsoft.AspNetCore.DataProtection:
+         10.0.7 carries four NU1903 high-severity advisories that break fresh restores
+         under TreatWarningsAsErrors. See Directory.Packages.props for the rationale. -->
+    <PackageReference Include="System.Security.Cryptography.Xml" />
   </ItemGroup>
 
   <ItemGroup>