From b6ba87f0722b670216d8587011faa3501023670c Mon Sep 17 00:00:00 2001 From: Oliver Kieselbach Date: Wed, 22 Jul 2026 01:44:44 +0200 Subject: [PATCH] fix(deps): pin patched DataProtection + Cryptography.Xml to clear NuGet advisories MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Microsoft.Identity.Web 4.3.0 pulls Microsoft.AspNetCore.DataProtection and System.Security.Cryptography.Xml transitively at 10.0.0, which carry known advisories (GHSA-9mv3-2cwr-p262 critical on DataProtection; GHSA-37gx-xxp4-5rgx and siblings, high, on Cryptography.Xml). Add explicit references pinning both to the patched 10.0.10 servicing build (matching the existing JwtBearer pin) — the NuGet equivalent of the npm overrides used for the web/MCP alerts. Pinned in the production Functions project so the fix flows to the deployed artifact and to Functions.Tests via project reference. `dotnet list package --vulnerable` now reports 0 across every project; build clean; 3110 tests pass. Co-Authored-By: Claude Opus 4.8 (1M context) --- .../AutopilotMonitor.Functions.csproj | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/Backend/AutopilotMonitor.Functions/AutopilotMonitor.Functions.csproj b/src/Backend/AutopilotMonitor.Functions/AutopilotMonitor.Functions.csproj index 6a135f5c..61a07e8f 100644 --- a/src/Backend/AutopilotMonitor.Functions/AutopilotMonitor.Functions.csproj +++ b/src/Backend/AutopilotMonitor.Functions/AutopilotMonitor.Functions.csproj @@ -47,6 +47,12 @@ + + +