From ecf6b628500de0513306b5e80bc25f0efcec6b06 Mon Sep 17 00:00:00 2001
From: Joseph Doherty <dohejw01@gmail.com>
Date: Sun, 19 Jul 2026 02:37:50 -0400
Subject: [PATCH] fix(build): pin AngleSharp 1.5.2 to unbreak the solution
 build

GHSA-pgww-w46g-26qg (NU1902, moderate) on AngleSharp 1.1.1, pulled in
transitively by bunit into CentralUI.Tests. Under TreatWarningsAsErrors this
made `dotnet build ZB.MOM.WW.ScadaBridge.slnx` fail on a CLEAN main - the whole
suite was unbuildable and every "0 warnings / suite green" gate unverifiable.

Pre-existing, not introduced here; surfaced while starting LocalDb Phase 1,
whose per-task verification depends on a green baseline.

Same fix as the identical break in HistorianGateway (historiangw @ 6bc005d):
pin the leaf, test-only. AngleSharp is a bunit HTML-parsing dependency and
reaches no production project. Bumping bunit does not help - 2.0.33-preview is
the current preview line and still resolves the vulnerable AngleSharp.

Verified: dotnet build ZB.MOM.WW.ScadaBridge.slnx -> 0 Error(s), 0 Warning(s)
(was 1 Error before this commit).

Claude-Session: https://claude.ai/code/session_01BL2Vu1ESDQ9SCN4gVKkdts
---
 Directory.Packages.props                        | 17 +++++++++++++++++
 ...ZB.MOM.WW.ScadaBridge.CentralUI.Tests.csproj |  3 +++
 2 files changed, 20 insertions(+)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index f3469127..7da10e4f 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -124,4 +124,21 @@
     <PackageVersion Include="SQLitePCLRaw.lib.e_sqlite3" Version="2.1.12" />
   </ItemGroup>
 
+  <!--
+    GHSA-pgww-w46g-26qg (NU1902, moderate) is on AngleSharp 1.1.1, pulled in TRANSITIVELY by
+    bunit into ZB.MOM.WW.ScadaBridge.CentralUI.Tests. With TreatWarningsAsErrors this made the
+    WHOLE SOLUTION BUILD RED — `dotnet build ZB.MOM.WW.ScadaBridge.slnx` failed on clean main,
+    so no test suite could run and every "0 warnings / suite green" gate was unverifiable.
+
+    Fixed the same way HistorianGateway fixed the identical break (historiangw @ 6bc005d):
+    an explicit test-only pin to a patched AngleSharp. TEST-ONLY — AngleSharp is a bunit
+    (HTML-parsing) dependency and reaches no production project, so this cannot affect runtime.
+
+    Do not "fix" this by bumping bunit: 2.0.33-preview is the current preview line and still
+    resolves the vulnerable AngleSharp transitively. Pinning the leaf is the fix.
+  -->
+  <ItemGroup>
+    <PackageVersion Include="AngleSharp" Version="1.5.2" />
+  </ItemGroup>
+
 </Project>
diff --git a/tests/ZB.MOM.WW.ScadaBridge.CentralUI.Tests/ZB.MOM.WW.ScadaBridge.CentralUI.Tests.csproj b/tests/ZB.MOM.WW.ScadaBridge.CentralUI.Tests/ZB.MOM.WW.ScadaBridge.CentralUI.Tests.csproj
index 15dc7075..faedc98c 100644
--- a/tests/ZB.MOM.WW.ScadaBridge.CentralUI.Tests/ZB.MOM.WW.ScadaBridge.CentralUI.Tests.csproj
+++ b/tests/ZB.MOM.WW.ScadaBridge.CentralUI.Tests/ZB.MOM.WW.ScadaBridge.CentralUI.Tests.csproj
@@ -10,6 +10,9 @@
 
   <ItemGroup>
     <PackageReference Include="bunit" />
+    <!-- Security pin: GHSA-pgww-w46g-26qg. bunit pulls the vulnerable AngleSharp
+         1.1.1 transitively; 1.5.2 patches it. Test-only, no production reach. -->
+    <PackageReference Include="AngleSharp" />
     <PackageReference Include="coverlet.collector" />
     <PackageReference Include="Microsoft.AspNetCore.TestHost" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" />