From 9703ed46e4674f57ed16e409419613f4895160af Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 26 Oct 2026 17:51:48 +0000 Subject: [PATCH 1/3] build: pin the vulnerable transitive packages Pin SSH.NET (pulled in by Testcontainers.MsSql) and System.Security.Cryptography.Pkcs (pulled in by Microsoft.SqlServer.DacFx) through central package management with transitive pinning, so the Release restore of the test project passes the NuGet audit (NU1902/NU1903). The integration tests in the workflow run in Release again, which makes the audit part of the gate. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01P8xKsmMZRuuoGUZqqpAmVK --- .github/workflows/release.yml | 6 ++---- Directory.Packages.props | 5 +++++ 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f54b8f9..bd3fa46 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -152,11 +152,9 @@ jobs: path: Releases.Direct_Framework/next/db - name: Run the integration tests - # Debug, as RunTestsSimple.ps1 does: the Release configuration treats warnings as errors, and the - # NuGet audit of the test project's transitive packages (SSH.NET through Testcontainers, - # System.Security.Cryptography.Pkcs through DacFx) raises warnings that would fail the restore. + # Release treats warnings as errors, so the NuGet audit of the test project's packages gates the run too. run: > - dotnet run --project Direct_Framework.Integration.Tests --configuration Debug -- + dotnet run --project Direct_Framework.Integration.Tests --configuration Release -- --report-trx --report-trx-filename TestResults.trx --results-directory "${{ github.workspace }}/TestResults" - name: Upload the test results diff --git a/Directory.Packages.props b/Directory.Packages.props index 737226f..f6889ee 100644 --- a/Directory.Packages.props +++ b/Directory.Packages.props @@ -1,6 +1,8 @@ true + + true @@ -22,6 +24,9 @@ + + + From 38033e69ea04517b74b5166b8d55548fce37625d Mon Sep 17 00:00:00 2001 From: Roelant Vos Date: Mon, 26 Oct 2026 19:13:29 +0100 Subject: [PATCH 2/3] build: regenerate the test project's lock file for the pinned packages With CentralPackageTransitivePinningEnabled, the central Microsoft.NET.Test.Sdk 17.14.1 also pinned the transitive one that MSTest 4.0.2 depends on, which the restore rejected as a downgrade (NU1109). Raise it to 18.0.1, the version MSTest asks for, and regenerate packages.lock.json for the pinned package set. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01P8xKsmMZRuuoGUZqqpAmVK --- .../packages.lock.json | 35 ++++++++++--------- Directory.Packages.props | 2 +- 2 files changed, 20 insertions(+), 17 deletions(-) diff --git a/Direct_Framework.Integration.Tests/packages.lock.json b/Direct_Framework.Integration.Tests/packages.lock.json index 7fed53e..8d8fbdd 100644 --- a/Direct_Framework.Integration.Tests/packages.lock.json +++ b/Direct_Framework.Integration.Tests/packages.lock.json @@ -129,8 +129,8 @@ }, "BouncyCastle.Cryptography": { "type": "Transitive", - "resolved": "2.4.0", - "contentHash": "SwXsAV3sMvAU/Nn31pbjhWurYSjJ+/giI/0n6tCrYoupEK34iIHCuk3STAd9fx8yudM85KkLSVdn951vTng/vQ==" + "resolved": "2.7.0", + "contentHash": "U+12df8UEWHgBi04YVf/Lgi2dy3SItlIYvHjjEVa/BngCQIzDCDRBk50DDByCfDvSbe5pRNFr3b7UrVK2kMcLw==" }, "Docker.DotNet.Enhanced": { "type": "Transitive", @@ -405,14 +405,6 @@ "resolved": "1.4.2", "contentHash": "yjj+3zgz8zgXpiiC3ZdF/iyTBbz2fFvMxZFEBPUcwZjIvXOf37Ylm+K58hqMfIBt5JgU/Z2uoUS67JmTLe973A==" }, - "SSH.NET": { - "type": "Transitive", - "resolved": "2024.2.0", - "contentHash": "9r+4UF2P51lTztpd+H7SJywk7WgmlWB//Cm2o96c6uGVZU5r58ys2/cD9pCgTk0zCdSkfflWL1WtqQ9I4IVO9Q==", - "dependencies": { - "BouncyCastle.Cryptography": "2.4.0" - } - }, "System.ClientModel": { "type": "Transitive", "resolved": "1.7.0", @@ -473,11 +465,6 @@ "System.Configuration.ConfigurationManager": "8.0.1" } }, - "System.Security.Cryptography.Pkcs": { - "type": "Transitive", - "resolved": "9.0.9", - "contentHash": "Y7/wY5lqrzJOu53yLFLPGaeKBcdWNw193udOFRB2joFDVpXLkmfPpfgks7dEIJYPIrW4k3onwR+4nQz6vIaaqA==" - }, "System.Security.Cryptography.ProtectedData": { "type": "Transitive", "resolved": "9.0.9", @@ -510,7 +497,7 @@ }, "Microsoft.NET.Test.Sdk": { "type": "CentralTransitive", - "requested": "[17.14.1, )", + "requested": "[18.0.1, )", "resolved": "18.0.1", "contentHash": "WNpu6vI2rA0pXY4r7NKxCN16XRWl5uHu6qjuyVLoDo6oYEggIQefrMjkRuibQHm/NslIUNCcKftvoWAN80MSAg==", "dependencies": { @@ -542,6 +529,22 @@ "requested": "[2.0.2, )", "resolved": "2.0.2", "contentHash": "43NCOTEENtdc9fmlzX9KHQR14AZEYek5r4jOJlWPhTyV1+aYAQYl4x773nYXU5TKxV6+rMuniJ7wcj9C9qrP1A==" + }, + "SSH.NET": { + "type": "CentralTransitive", + "requested": "[2026.0.0, )", + "resolved": "2026.0.0", + "contentHash": "Yu9dirPq8l3oaat0+OQ7K0nUf5MmYltpia5UGqsApTG4zTPvBC1cxbNnC3NERij26dUST0A3Ef1QdHSn5ArbWQ==", + "dependencies": { + "BouncyCastle.Cryptography": "2.7.0", + "Microsoft.Extensions.Logging.Abstractions": "8.0.3" + } + }, + "System.Security.Cryptography.Pkcs": { + "type": "CentralTransitive", + "requested": "[10.0.14, )", + "resolved": "10.0.14", + "contentHash": "Wz+IgL2xpg8KJ4i2VWj6uz1PmZNu4Q0Ljlwd73P9Vze5NcOBtctLii3itV0PB2MpOqwqDEGfB6RCdv94A4E5yQ==" } } } diff --git a/Directory.Packages.props b/Directory.Packages.props index f6889ee..ab266ad 100644 --- a/Directory.Packages.props +++ b/Directory.Packages.props @@ -12,7 +12,7 @@ - + From 7f193fd2ba6ec46e6eb6d1e8179eab9113492c7e Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 26 Oct 2026 18:14:38 +0000 Subject: [PATCH 3/3] ci: gate on the NuGet audit at restore and keep the tests in Debug The Release build of the test project fails on the code analysis rules that Directory.Build.props enables for every project (AnalysisMode AllEnabledByDefault with warnings as errors), which predates the package pins. The tests therefore run in Debug again, and a separate restore with warnings as errors makes the NuGet audit the gate it was meant to be. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01P8xKsmMZRuuoGUZqqpAmVK --- .github/workflows/release.yml | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index bd3fa46..53b578a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -151,10 +151,15 @@ jobs: name: direct-framework-db path: Releases.Direct_Framework/next/db + - name: Restore the test project with the NuGet audit as a gate + # Warnings as errors on the restore alone: a vulnerable package (NU1902/NU1903) fails the run here. + run: dotnet restore Direct_Framework.Integration.Tests -p:TreatWarningsAsErrors=true + - name: Run the integration tests - # Release treats warnings as errors, so the NuGet audit of the test project's packages gates the run too. + # Debug, as RunTestsSimple.ps1 does: the Release build of the test project fails on the code analysis + # rules that Directory.Build.props enables (AnalysisMode AllEnabledByDefault with warnings as errors). run: > - dotnet run --project Direct_Framework.Integration.Tests --configuration Release -- + dotnet run --project Direct_Framework.Integration.Tests --configuration Debug --no-restore -- --report-trx --report-trx-filename TestResults.trx --results-directory "${{ github.workspace }}/TestResults" - name: Upload the test results