Pin System.Security.Cryptography.Pkcs to 10.0.13 (GHSA-2fmv-rv2c-59x7)

Merged
JA
6d ago
+4-0

NuGet.Packaging 7.0.3, pulled in transitively by Microsoft.CodeAnalysis.*.Testing 1.1.4, depends on System.Security.Cryptography.Pkcs 9.0.6, which has a known moderate vulnerability (GHSA-2fmv-rv2c-59x7). This fails restore of SharpDicom.Analyzers.Tests with NU1902 (warnings as errors).

Pins Pkcs to 10.0.13 in Directory.Packages.props and references it directly from the analyzer test project, matching the existing SQLite/SharpCompress pin pattern.

  • Restore clean, no NU1902
  • dotnet list package --vulnerable --include-transitive reports nothing
  • Analyzer tests: 22/22 pass

Summary by cubic

Pins System.Security.Cryptography.Pkcs to 10.0.13 so restore of the analyzer test project no longer fails with NU1902 warnings-as-errors.

The vulnerable 9.0.6 version comes in transitively from NuGet.Packaging via the Microsoft.CodeAnalysis.*.Testing packages (GHSA-2fmv-rv2c-59x7).

  • Adds the package version to Directory.Packages.props and references it directly from the test project, matching the existing SQLite/SharpCompress pin pattern.
  • Restore is clean, dotnet list package --vulnerable --include-transitive reports nothing, and all 22 analyzer tests pass.