Pin System.Security.Cryptography.Xml to clear the dependency audit#26
Merged
Conversation
Four high-severity advisories were published against System.Security.Cryptography.Xml 10.0.8, failing the Dependency Audit workflow on every branch: GHSA-cvvh-rhrc-wg4q GHSA-g8r8-53c2-pm3f GHSA-23rf-6693-g89p GHSA-8q5v-6pqq-x66h The package arrives transitively via Microsoft.AspNetCore.DataProtection 10.0.8. Only AccountSalesPaymentWorkbookRestyler is affected: ShopInventory and ShopInventory.Web use the Web SDK and take this assembly from the ASP.NET Core shared framework, where it is not a NuGet asset and is patched by runtime updates. The Restyler is a plain console Exe without that shared framework, so the same dependency resolves as a real package and is audited. Pinning to 10.0.10 clears the audit on all three projects. The deployed API and Web app were never carrying a vulnerable NuGet package. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Four high-severity advisories were published against
System.Security.Cryptography.Xml10.0.8, breaking theDependency Auditworkflow:The audit resolves against the live GitHub advisory database, so no code change caused this — main passed on 20 Jul at 11:43 and the same tree fails today. It surfaced on #25, but it is unrelated to that PR and blocks every branch until fixed.
Why only this project
The package arrives transitively via
Microsoft.AspNetCore.DataProtection10.0.8.ShopInventoryandShopInventory.Webreport no vulnerable packages, despite sitting on the same dependency. They use the Web SDK and take this assembly from the ASP.NET Core shared framework, so it is not a NuGet asset there and is patched by runtime updates rather than a package bump.AccountSalesPaymentWorkbookRestyleris a plain consoleExewithout that shared framework, so the dependency resolves as a real package and gets audited.Note
The deployed API and Web app were never carrying a vulnerable NuGet package. The exposure was limited to a developer utility script. This unblocks CI; it is not a production incident.
Change
One
PackageReferencepinning the transitive dependency to 10.0.10, with a comment recording why only this project needs it and when it can be removed.Verification
Restyler builds clean, 0 warnings.
The pin can be removed once
Microsoft.AspNetCore.DataProtectionreferences a patched version directly.🤖 Generated with Claude Code