From 8bb2679e43af8cfd38ca89e5e0a993e96dfc1210 Mon Sep 17 00:00:00 2001
From: Joseph Doherty <dohejw01@gmail.com>
Date: Mon, 9 Nov 2026 12:28:42 -0500
Subject: [PATCH] fix(secrets,auth): pin patched
 System.Security.Cryptography.Pkcs 9.0.21 so restore passes NuGetAudit
 (scadaproj#22)

Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV
---
 ZB.MOM.WW.Auth/Directory.Packages.props    | 5 +++++
 ZB.MOM.WW.Secrets/Directory.Packages.props | 5 +++++
 2 files changed, 10 insertions(+)

diff --git a/ZB.MOM.WW.Auth/Directory.Packages.props b/ZB.MOM.WW.Auth/Directory.Packages.props
index 3b06c64..63d7500 100644
--- a/ZB.MOM.WW.Auth/Directory.Packages.props
+++ b/ZB.MOM.WW.Auth/Directory.Packages.props
@@ -23,6 +23,11 @@
          9.0.4, which requires ProtectedData >= 9.0.4. With transitive pinning on, the lower central
          version is a hard NU1109 downgrade error rather than a silent resolve. -->
     <PackageVersion Include="System.Security.Cryptography.ProtectedData" Version="9.0.4" />
+    <!-- Transitive security pin (scadaproj#22): Microsoft.Data.SqlClient 6.0.2 pulls
+         System.Security.Cryptography.Pkcs 9.0.4, which carries GHSA-846f-f764-76mx (high) and
+         GHSA-2fmv-rv2c-59x7 (moderate) and fails restore under warnings-as-errors (NU1902/NU1903).
+         Pin the patched 9.0.21 (first fixed in the 9.0 line; 9.0.0-9.0.20 and 10.0.0-10.0.12 are all affected). -->
+    <PackageVersion Include="System.Security.Cryptography.Pkcs" Version="9.0.21" />
 
     <!-- Extensions -->
     <PackageVersion Include="Microsoft.Extensions.Options" Version="10.0.7" />
diff --git a/ZB.MOM.WW.Secrets/Directory.Packages.props b/ZB.MOM.WW.Secrets/Directory.Packages.props
index f8c5814..1ecde1e 100644
--- a/ZB.MOM.WW.Secrets/Directory.Packages.props
+++ b/ZB.MOM.WW.Secrets/Directory.Packages.props
@@ -46,6 +46,11 @@
          9.0.4, which requires ProtectedData >= 9.0.4. With transitive pinning on, the lower central
          version is a hard NU1109 downgrade error rather than a silent resolve. -->
     <PackageVersion Include="System.Security.Cryptography.ProtectedData" Version="9.0.4" />
+    <!-- Transitive security pin (scadaproj#22): Microsoft.Data.SqlClient 6.0.2 pulls
+         System.Security.Cryptography.Pkcs 9.0.4, which carries GHSA-846f-f764-76mx (high) and
+         GHSA-2fmv-rv2c-59x7 (moderate) and fails restore under warnings-as-errors (NU1902/NU1903).
+         Pin the patched 9.0.21 (first fixed in the 9.0 line; 9.0.0-9.0.20 and 10.0.0-10.0.12 are all affected). -->
+    <PackageVersion Include="System.Security.Cryptography.Pkcs" Version="9.0.21" />
 
     <!-- Extensions -->
     <PackageVersion Include="Microsoft.Extensions.Options" Version="10.0.7" />