Merge branch 'fix/pkcs-cve-pin' into main

Claude-Session: https://claude.ai/code/session_016J6isfcgqy4SB2RK3ZvFvT
fix: pin System.Security.Cryptography.Pkcs 10.0.13 (NU1903)
2026-10-20 07:24:10 -04:00 · 2026-10-20 07:07:59 -04:00
1 changed files with 3 additions and 0 deletions
@@ -32,6 +32,9 @@
         native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not clear it. -->
    <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" Version="2.1.12" />
    <PackageReference Include="Microsoft.Data.SqlClient" Version="6.0.2" />
+    <!-- Security pin: GHSA-846f-f764-76mx / GHSA-2fmv-rv2c-59x7. Microsoft.Data.SqlClient 6.0.2
+         pulls the vulnerable System.Security.Cryptography.Pkcs 9.0.4; 10.0.13 patches it. -->
+    <PackageReference Include="System.Security.Cryptography.Pkcs" Version="10.0.13" />
    <PackageReference Include="Polly.Core" Version="8.6.6" />
  </ItemGroup>
Author	SHA1	Message	Date
Joseph Doherty	fb20997dc9	Merge branch 'fix/pkcs-cve-pin' into main ci / nightly-windev (push) Has been skipped Details ci / windows-x86 (push) Successful in 1m47s Details ci / java (push) Successful in 2m6s Details ci / portable (push) Successful in 8m57s Details Claude-Session: https://claude.ai/code/session_016J6isfcgqy4SB2RK3ZvFvT	2026-10-20 07:24:10 -04:00
Joseph Doherty	a09fa0a4d6	fix: pin System.Security.Cryptography.Pkcs 10.0.13 (NU1903) ci / nightly-windev (push) Has been skipped Details ci / windows-x86 (push) Successful in 1m23s Details ci / java (push) Successful in 2m19s Details ci / portable (push) Successful in 10m44s Details Microsoft.Data.SqlClient 6.0.2 pulls System.Security.Cryptography.Pkcs 9.0.4, which carries GHSA-846f-f764-76mx (high) and GHSA-2fmv-rv2c-59x7 (moderate). With TreatWarningsAsErrors the NU1902/NU1903 audit warnings failed restore. 10.0.13 patches both. Claude-Session: https://claude.ai/code/session_016J6isfcgqy4SB2RK3ZvFvT	2026-10-20 07:07:59 -04:00