From 9f16f84f76672511848303abcea20b8e322c5b54 Mon Sep 17 00:00:00 2001
From: Colin Haven <10933733+virtitnerd@users.noreply.github.com>
Date: Sat, 24 Oct 2026 21:31:28 -0400
Subject: [PATCH] fix: pin System.Security.Cryptography.Pkcs to the patched
 10.0.13

Two denial-of-service advisories (GHSA-846f-f764-76mx, high, and
GHSA-2fmv-rv2c-59x7, moderate) affect System.Security.Cryptography.Pkcs
9.0.11 and 10.0.10, which restore picked up transitively through
Microsoft.Data.SqlClient (via EF Core SqlServer) and
Microsoft.Identity.Web.TokenCache. Both are fixed in 10.0.13.

A direct reference in the Data project overrides the transitive versions for
every project that depends on it (Functions, Web and the Data tests). The
build previously reported eight NU1902/NU1903 warnings and now reports none.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 src/IdentityFlow.Data/IdentityFlow.Data.csproj | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/IdentityFlow.Data/IdentityFlow.Data.csproj b/src/IdentityFlow.Data/IdentityFlow.Data.csproj
index 4cd5923..a46a964 100644
--- a/src/IdentityFlow.Data/IdentityFlow.Data.csproj
+++ b/src/IdentityFlow.Data/IdentityFlow.Data.csproj
@@ -12,6 +12,8 @@
     </PackageReference>
     <PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.11" />
     <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.11" />
+    <!-- Patched DoS fixes (GHSA-846f-f764-76mx, GHSA-2fmv-rv2c-59x7); SqlClient and Identity.Web pull in older ones. -->
+    <PackageReference Include="System.Security.Cryptography.Pkcs" Version="10.0.13" />
   </ItemGroup>
 
   <PropertyGroup>