build: pin patched System.Security.Cryptography.* / SignalR to clear fresh-restore NuGet audit

Claude-Session: https://claude.ai/code/session_01Ub9hGmYLQvn9XETzw7CMsT
2026-10-22 10:38:07 -04:00
parent 7513ce5144
commit a01f5e6705
4 changed files with 46 additions and 1 deletions
@@ -9,6 +9,12 @@
    <ItemGroup>
        <FrameworkReference Include="Microsoft.AspNetCore.App"/>
        <PackageReference Include="Microsoft.AspNetCore.SignalR.Client"/>
+        <!-- Surgical transitive pin — see the Microsoft.AspNetCore.SignalR.Common block in
+             Directory.Packages.props (GHSA-334f-vvp4-7g6p on SignalR.Common 10.0.0). Inside AdminUI
+             the shared framework already supplies it (hence NU1510), but the PackageReference flows
+             to the non-Web consumers (Host.Tests, AdminUI.Tests, OpcUaServer.IntegrationTests) where
+             SignalR.Client 10.0.0 would otherwise resolve the vulnerable 10.0.0. -->
+        <PackageReference Include="Microsoft.AspNetCore.SignalR.Common" NoWarn="NU1510"/>
        <PackageReference Include="ZB.MOM.WW.Theme"/>
        <PackageReference Include="ZB.MOM.WW.Secrets.Ui"/>
    </ItemGroup>