From a05ce8c86d31d5f44631942fb14ffabe1fbc7403 Mon Sep 17 00:00:00 2001
From: Joseph Doherty <dohejw01@gmail.com>
Date: Mon, 9 Nov 2026 12:37:33 -0500
Subject: [PATCH] fix(secrets): pin transitive AngleSharp 1.5.0 to clear NU1902
 from bunit 1.40.0 (scadaproj#24)

bUnit 2.x drops RenderComponent/AddTestAuthorization, so pin the parser
instead of migrating the Ui tests.

Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV
---
 ZB.MOM.WW.Secrets/Directory.Packages.props | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/ZB.MOM.WW.Secrets/Directory.Packages.props b/ZB.MOM.WW.Secrets/Directory.Packages.props
index 1ecde1e..8b9bdd1 100644
--- a/ZB.MOM.WW.Secrets/Directory.Packages.props
+++ b/ZB.MOM.WW.Secrets/Directory.Packages.props
@@ -90,6 +90,10 @@
     <PackageVersion Include="Microsoft.AspNetCore.TestHost" Version="10.0.7" />
     <PackageVersion Include="coverlet.collector" Version="6.0.4" />
     <PackageVersion Include="bunit" Version="1.40.0" />
+    <!-- Transitive security pin (scadaproj#24): bunit 1.40.0 pulls AngleSharp 1.2.0 (NU1902,
+         GHSA-pgww-w46g-26qg). bUnit 2.x removes RenderComponent/AddTestAuthorization, so pin the
+         parser instead (same version Theme resolves via bUnit 2.7.2). -->
+    <PackageVersion Include="AngleSharp" Version="1.5.0" />
   </ItemGroup>
 
 </Project>