Pin the vulnerable transitive packages

.github/workflows/release.yml

@@ -151,12 +151,15 @@ jobs:
           name: direct-framework-db
           path: Releases.Direct_Framework/next/db
 
+      - name: Restore the test project with the NuGet audit as a gate
+        # Warnings as errors on the restore alone: a vulnerable package (NU1902/NU1903) fails the run here.
+        run: dotnet restore Direct_Framework.Integration.Tests -p:TreatWarningsAsErrors=true
+
       - name: Run the integration tests
-        # Debug, as RunTestsSimple.ps1 does: the Release configuration treats warnings as errors, and the
-        # NuGet audit of the test project's transitive packages (SSH.NET through Testcontainers,
-        # System.Security.Cryptography.Pkcs through DacFx) raises warnings that would fail the restore.
+        # Debug, as RunTestsSimple.ps1 does: the Release build of the test project fails on the code analysis
+        # rules that Directory.Build.props enables (AnalysisMode AllEnabledByDefault with warnings as errors).
         run: >
-          dotnet run --project Direct_Framework.Integration.Tests --configuration Debug --
+          dotnet run --project Direct_Framework.Integration.Tests --configuration Debug --no-restore --
           --report-trx --report-trx-filename TestResults.trx --results-directory "${{ github.workspace }}/TestResults"
 
       - name: Upload the test results

Direct_Framework.Integration.Tests/packages.lock.json

@@ -129,8 +129,8 @@
       },
       "BouncyCastle.Cryptography": {
         "type": "Transitive",
-        "resolved": "2.4.0",
-        "contentHash": "SwXsAV3sMvAU/Nn31pbjhWurYSjJ+/giI/0n6tCrYoupEK34iIHCuk3STAd9fx8yudM85KkLSVdn951vTng/vQ=="
+        "resolved": "2.7.0",
+        "contentHash": "U+12df8UEWHgBi04YVf/Lgi2dy3SItlIYvHjjEVa/BngCQIzDCDRBk50DDByCfDvSbe5pRNFr3b7UrVK2kMcLw=="
       },
       "Docker.DotNet.Enhanced": {
         "type": "Transitive",
@@ -405,14 +405,6 @@
         "resolved": "1.4.2",
         "contentHash": "yjj+3zgz8zgXpiiC3ZdF/iyTBbz2fFvMxZFEBPUcwZjIvXOf37Ylm+K58hqMfIBt5JgU/Z2uoUS67JmTLe973A=="
       },
-      "SSH.NET": {
-        "type": "Transitive",
-        "resolved": "2024.2.0",
-        "contentHash": "9r+4UF2P51lTztpd+H7SJywk7WgmlWB//Cm2o96c6uGVZU5r58ys2/cD9pCgTk0zCdSkfflWL1WtqQ9I4IVO9Q==",
-        "dependencies": {
-          "BouncyCastle.Cryptography": "2.4.0"
-        }
-      },
       "System.ClientModel": {
         "type": "Transitive",
         "resolved": "1.7.0",
@@ -473,11 +465,6 @@
           "System.Configuration.ConfigurationManager": "8.0.1"
         }
       },
-      "System.Security.Cryptography.Pkcs": {
-        "type": "Transitive",
-        "resolved": "9.0.9",
-        "contentHash": "Y7/wY5lqrzJOu53yLFLPGaeKBcdWNw193udOFRB2joFDVpXLkmfPpfgks7dEIJYPIrW4k3onwR+4nQz6vIaaqA=="
-      },
       "System.Security.Cryptography.ProtectedData": {
         "type": "Transitive",
         "resolved": "9.0.9",
@@ -510,7 +497,7 @@
       },
       "Microsoft.NET.Test.Sdk": {
         "type": "CentralTransitive",
-        "requested": "[17.14.1, )",
+        "requested": "[18.0.1, )",
         "resolved": "18.0.1",
         "contentHash": "WNpu6vI2rA0pXY4r7NKxCN16XRWl5uHu6qjuyVLoDo6oYEggIQefrMjkRuibQHm/NslIUNCcKftvoWAN80MSAg==",
         "dependencies": {
@@ -542,6 +529,22 @@
         "requested": "[2.0.2, )",
         "resolved": "2.0.2",
         "contentHash": "43NCOTEENtdc9fmlzX9KHQR14AZEYek5r4jOJlWPhTyV1+aYAQYl4x773nYXU5TKxV6+rMuniJ7wcj9C9qrP1A=="
+      },
+      "SSH.NET": {
+        "type": "CentralTransitive",
+        "requested": "[2026.0.0, )",
+        "resolved": "2026.0.0",
+        "contentHash": "Yu9dirPq8l3oaat0+OQ7K0nUf5MmYltpia5UGqsApTG4zTPvBC1cxbNnC3NERij26dUST0A3Ef1QdHSn5ArbWQ==",
+        "dependencies": {
+          "BouncyCastle.Cryptography": "2.7.0",
+          "Microsoft.Extensions.Logging.Abstractions": "8.0.3"
+        }
+      },
+      "System.Security.Cryptography.Pkcs": {
+        "type": "CentralTransitive",
+        "requested": "[10.0.14, )",
+        "resolved": "10.0.14",
+        "contentHash": "Wz+IgL2xpg8KJ4i2VWj6uz1PmZNu4Q0Ljlwd73P9Vze5NcOBtctLii3itV0PB2MpOqwqDEGfB6RCdv94A4E5yQ=="
       }
     }
   }

Directory.Packages.props

@@ -1,6 +1,8 @@
 <Project>
   <PropertyGroup>
     <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
+    <!-- Pin transitive packages listed below as well, so vulnerable versions pulled in by dependencies can be lifted here -->
+    <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
   </PropertyGroup>
   <ItemGroup>
     <!-- SQL Server master database reference -->
@@ -10,7 +12,7 @@
     <PackageVersion Include="ErikEJ.DacFX.SqlServer.Rules" Version="3.0.0" />
     <PackageVersion Include="ErikEJ.DacFX.TSQLSmellSCA" Version="3.0.0" />
     <PackageVersion Include="Microsoft.Data.SqlClient" Version="7.0.0-preview2.25289.6" />
-    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.0.1" />
     <PackageVersion Include="Microsoft.SqlServer.DacFx" Version="170.3.26-preview" />
     <PackageVersion Include="Microsoft.Testing.Extensions.CodeCoverage" Version="18.1.0" />
     <PackageVersion Include="Microsoft.Testing.Extensions.Telemetry" Version="2.0.2" />
@@ -22,6 +24,9 @@
     <PackageVersion Include="Roslynator.CodeFixes" Version="4.14.1" />
     <PackageVersion Include="Roslynator.Formatting.Analyzers" Version="4.14.1" />
     <PackageVersion Include="Roslynator.Refactorings" Version="4.14.1" />
+    <!-- Transitive packages, pinned above the versions with known vulnerabilities (SSH.NET via Testcontainers.MsSql, Pkcs via Microsoft.SqlServer.DacFx) -->
+    <PackageVersion Include="SSH.NET" Version="2026.0.0" />
+    <PackageVersion Include="System.Security.Cryptography.Pkcs" Version="10.0.14" />
     <PackageVersion Include="Testcontainers.MsSql" Version="4.8.1" />
   </ItemGroup>
 </Project>