From 9ca8281a01195289494ec9cbe86ab551c7e3cc0d Mon Sep 17 00:00:00 2001
From: Aaron Stannard <aaron@petabridge.com>
Date: Wed, 28 Oct 2026 22:13:51 +0000
Subject: [PATCH] chore: patch vulnerable transitive packages

Resolves every known-vulnerable package reported by
'dotnet list package --vulnerable --include-transitive'.

Enables CentralPackageTransitivePinningEnabled so transitive-only
packages can be pinned from Directory.Packages.props, then pins:

- System.Security.Cryptography.Pkcs 10.0.7 -> 10.0.14
  (GHSA-846f-f764-76mx high, GHSA-2fmv-rv2c-59x7 moderate)
- MessagePack 2.5.192 -> 2.5.307
  (GHSA-hv8m-jj95-wg3x, GHSA-vh6j-jc39-fggf high, +10 moderate)
- OpenTelemetry.Api 1.9.0/1.10.0 -> 1.15.3
  (GHSA-g94r-2vxg-569j, GHSA-8785-wc3w-h8q6 moderate)
- Newtonsoft.Json 12.0.3 -> 13.0.4
  (GHSA-5crp-9r3c-p9vr high, via FluentEmail.Mailgun)

Also bumps two direct pins to patched versions:
- OpenTelemetry.Exporter.OpenTelemetryProtocol 1.15.0 -> 1.15.3
  (GHSA-q834-8qmm-v933 moderate)
- Grpc.Tools 2.72.0 -> 2.78.0, the floor Aspire.Hosting.AppHost
  requires. Enabling transitive pinning surfaced this pre-existing
  downgrade as a hard NU1109 error.

All 8 projects now report zero vulnerable packages. Build: 0 errors,
15 warnings (down from 47). Unit tests: 8/8.
---
 Directory.Packages.props | 24 ++++++++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index a5ac4c0..f749b36 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -1,6 +1,8 @@
 <Project>
   <PropertyGroup Label="SharedVersions">
     <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
+    <!-- Required so the transitive-only security pins below actually take effect. -->
+    <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
     <AkkaVersion>1.5.70</AkkaVersion>
     <AkkaHostingVersion>1.5.70</AkkaHostingVersion>
     <AkkaManagementVersion>1.5.70</AkkaManagementVersion>
@@ -22,7 +24,9 @@
     <PackageVersion Include="Akka.Streams.TestKit" Version="$(AkkaVersion)" />
     <PackageVersion Include="Aspire.Hosting.Docker" Version="13.1.1-preview.1.26105.8" />
     <PackageVersion Include="Aspire.Hosting.Kubernetes" Version="13.1.1-preview.1.26105.8" />
-    <PackageVersion Include="Grpc.Tools" Version="2.72.0">
+    <!-- 2.78.0+ is required by Aspire.Hosting.AppHost / Aspire.Hosting.Testing; enabling
+         transitive pinning turned this long-standing downgrade into a NU1109 error. -->
+    <PackageVersion Include="Grpc.Tools" Version="2.78.0">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageVersion>
@@ -66,13 +70,29 @@
     <PackageVersion Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.15.0" />
     <PackageVersion Include="OpenTelemetry.Instrumentation.Http" Version="1.15.0" />
     <PackageVersion Include="OpenTelemetry.Instrumentation.Runtime" Version="1.15.0" />
-    <PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.15.0" />
+    <PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.15.3" />
     <PackageVersion Include="OpenTelemetry.Extensions.Hosting" Version="1.15.3" />
   </ItemGroup>
   <!-- Utility Package Versions -->
   <ItemGroup>
     <PackageVersion Include="Microsoft.SourceLink.GitHub" Version="10.0.102" />
   </ItemGroup>
+  <!-- Security pins: these three packages only arrive transitively, so they need
+       CentralPackageTransitivePinningEnabled above to take effect. Remove them
+       once the direct dependencies ship patched versions on their own. -->
+  <ItemGroup Label="Security pins">
+    <!-- MsftVersion 10.0.7 -> EFCore/SqlClient pulls Pkcs 10.0.7 (GHSA-846f-f764-76mx, high) -->
+    <PackageVersion Include="System.Security.Cryptography.Pkcs" Version="10.0.14" />
+    <!-- Aspire.Hosting -> StreamJsonRpc 2.22.23 pulls MessagePack 2.5.192
+         (GHSA-hv8m-jj95-wg3x, GHSA-vh6j-jc39-fggf, high) -->
+    <PackageVersion Include="MessagePack" Version="2.5.307" />
+    <!-- DrawTogether.Actors and the E2E tests resolve OTel.Api below 1.15.3
+         (GHSA-g94r-2vxg-569j, GHSA-8785-wc3w-h8q6, moderate) -->
+    <PackageVersion Include="OpenTelemetry.Api" Version="1.15.3" />
+    <!-- FluentEmail.Mailgun 3.0.2 pulls Newtonsoft.Json 12.0.3
+         (GHSA-5crp-9r3c-p9vr, high) -->
+    <PackageVersion Include="Newtonsoft.Json" Version="13.0.4" />
+  </ItemGroup>
   <!-- Test Package Versions -->
   <ItemGroup>
     <PackageVersion Include="Aspire.Hosting.Testing" Version="$(AspireVersion)" />