Joseph Doherty
ecf6b62850
GHSA-pgww-w46g-26qg (NU1902, moderate) on AngleSharp 1.1.1, pulled in transitively by bunit into CentralUI.Tests. Under TreatWarningsAsErrors this made `dotnet build ZB.MOM.WW.ScadaBridge.slnx` fail on a CLEAN main - the whole suite was unbuildable and every "0 warnings / suite green" gate unverifiable. Pre-existing, not introduced here; surfaced while starting LocalDb Phase 1, whose per-task verification depends on a green baseline. Same fix as the identical break in HistorianGateway (historiangw @ 6bc005d): pin the leaf, test-only. AngleSharp is a bunit HTML-parsing dependency and reaches no production project. Bumping bunit does not help - 2.0.33-preview is the current preview line and still resolves the vulnerable AngleSharp. Verified: dotnet build ZB.MOM.WW.ScadaBridge.slnx -> 0 Error(s), 0 Warning(s) (was 1 Error before this commit). Claude-Session: https://claude.ai/code/session_01BL2Vu1ESDQ9SCN4gVKkdts
46 lines
1.9 KiB
XML
46 lines
1.9 KiB
XML
<Project Sdk="Microsoft.NET.Sdk">
|
|
|
|
<PropertyGroup>
|
|
<TargetFramework>net10.0</TargetFramework>
|
|
<ImplicitUsings>enable</ImplicitUsings>
|
|
<Nullable>enable</Nullable>
|
|
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
|
|
<IsPackable>false</IsPackable>
|
|
</PropertyGroup>
|
|
|
|
<ItemGroup>
|
|
<PackageReference Include="bunit" />
|
|
<!-- Security pin: GHSA-pgww-w46g-26qg. bunit pulls the vulnerable AngleSharp
|
|
1.1.1 transitively; 1.5.2 patches it. Test-only, no production reach. -->
|
|
<PackageReference Include="AngleSharp" />
|
|
<PackageReference Include="coverlet.collector" />
|
|
<PackageReference Include="Microsoft.AspNetCore.TestHost" />
|
|
<PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" />
|
|
<!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
|
|
vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
|
|
<PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
|
|
<PackageReference Include="Microsoft.NET.Test.Sdk" />
|
|
<PackageReference Include="NSubstitute" />
|
|
<PackageReference Include="xunit" />
|
|
<PackageReference Include="xunit.runner.visualstudio" />
|
|
</ItemGroup>
|
|
|
|
<ItemGroup>
|
|
<Using Include="Xunit" />
|
|
</ItemGroup>
|
|
|
|
<ItemGroup>
|
|
<FrameworkReference Include="Microsoft.AspNetCore.App" />
|
|
</ItemGroup>
|
|
|
|
<ItemGroup>
|
|
<ProjectReference Include="../../src/ZB.MOM.WW.ScadaBridge.CentralUI/ZB.MOM.WW.ScadaBridge.CentralUI.csproj" />
|
|
<!--
|
|
The DbContext-race regression test (AuditLogQueryServiceTests) exercises a
|
|
real ScadaBridgeDbContext + AuditLogRepository over SQLite in-memory to prove
|
|
scope-per-query isolation. Pulls in the ConfigurationDatabase project.
|
|
-->
|
|
<ProjectReference Include="../../src/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.csproj" />
|
|
</ItemGroup>
|
|
|
|
</Project> |