Directory.Packages.props

@@ -124,4 +124,21 @@
     <PackageVersion Include="SQLitePCLRaw.lib.e_sqlite3" Version="2.1.12" />
   </ItemGroup>
 
+  <!--
+    GHSA-pgww-w46g-26qg (NU1902, moderate) is on AngleSharp 1.1.1, pulled in TRANSITIVELY by
+    bunit into ZB.MOM.WW.ScadaBridge.CentralUI.Tests. With TreatWarningsAsErrors this made the
+    WHOLE SOLUTION BUILD RED — `dotnet build ZB.MOM.WW.ScadaBridge.slnx` failed on clean main,
+    so no test suite could run and every "0 warnings / suite green" gate was unverifiable.
+
+    Fixed the same way HistorianGateway fixed the identical break (historiangw @ 6bc005d):
+    an explicit test-only pin to a patched AngleSharp. TEST-ONLY — AngleSharp is a bunit
+    (HTML-parsing) dependency and reaches no production project, so this cannot affect runtime.
+
+    Do not "fix" this by bumping bunit: 2.0.33-preview is the current preview line and still
+    resolves the vulnerable AngleSharp transitively. Pinning the leaf is the fix.
+  -->
+  <ItemGroup>
+    <PackageVersion Include="AngleSharp" Version="1.5.2" />
+  </ItemGroup>
+
 </Project>

tests/ZB.MOM.WW.ScadaBridge.CentralUI.Tests/ZB.MOM.WW.ScadaBridge.CentralUI.Tests.csproj

@@ -10,6 +10,9 @@
 
   <ItemGroup>
     <PackageReference Include="bunit" />
+    <!-- Security pin: GHSA-pgww-w46g-26qg. bunit pulls the vulnerable AngleSharp
+         1.1.1 transitively; 1.5.2 patches it. Test-only, no production reach. -->
+    <PackageReference Include="AngleSharp" />
     <PackageReference Include="coverlet.collector" />
     <PackageReference Include="Microsoft.AspNetCore.TestHost" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" />