build: pin patched System.Security.Cryptography.* / SignalR to clear fresh-restore NuGet audit

Claude-Session: https://claude.ai/code/session_01Ub9hGmYLQvn9XETzw7CMsT
2026-10-22 10:38:07 -04:00
parent 7513ce5144
commit a01f5e6705
4 changed files with 46 additions and 1 deletions
@@ -26,6 +26,10 @@
         provider's DbProviderFactory (NpgsqlFactory / OracleClientFactory); both packages are fully
         managed ADO.NET drivers, so adding them costs no native client install anywhere. -->
    <PackageReference Include="Microsoft.Data.SqlClient" />
+    <!-- Surgical transitive pin — see the System.Security.Cryptography.Pkcs block in
+         Directory.Packages.props. SqlClient 6.1.1 pulls a vulnerable Pkcs 9.0.4; this is the
+         second place the SqlClient chain enters the repo (Core.Configuration is the first). -->
+    <PackageReference Include="System.Security.Cryptography.Pkcs" />
    <PackageReference Include="Npgsql" />
    <PackageReference Include="Oracle.ManagedDataAccess.Core" />
  </ItemGroup>