[thomasluizon]

Closes thomasluizon/orbit-tickets#1488

Solution builds resolved vulnerable System.Security.Cryptography.Pkcs 9.0.6 through the analyzer test framework. The analyzer test project now centrally pins the transitive dependency to 9.0.21, the first patched 9.x version for both reported advisories. NuGet auditing remains enabled.

tests/Orbit.Analyzers.Tests/Directory.Packages.props enables Central Package Management and transitive pinning for this project. Its existing direct-package versions moved unchanged from tests/Orbit.Analyzers.Tests/Orbit.Analyzers.Tests.csproj into that file. Keeping the central version file in the test project confines this dependency policy to the affected project.

Dependency evidence

dotnet list tests/Orbit.Analyzers.Tests package --include-transitive reproduced Pkcs 9.0.6. dotnet nuget why tests/Orbit.Analyzers.Tests/Orbit.Analyzers.Tests.csproj System.Security.Cryptography.Pkcs confirmed the chain:

Microsoft.CodeAnalysis.CSharp.Analyzer.Testing 1.1.4
  Microsoft.CodeAnalysis.Analyzer.Testing 1.1.4
    NuGet.Packaging 7.0.3
      System.Security.Cryptography.Pkcs 9.0.6

The same owner is also reached through the code-fix test framework and NuGet.Protocol/Resolver. The real NuGet.Packaging 7.0.3 manifest declares Pkcs 9.0.6 for net8.0. The published version index lists newer stable releases 7.3.0, 7.3.1, 7.6.0 and 7.9.0; inspecting each release's manifest showed Pkcs 8.0.1, which is also affected. Re-derive with curl -fsSL https://api.nuget.org/v3-flatcontainer/nuget.packaging/7.9.0/nuget.packaging.nuspec, substituting each listed version.

Both GHSA-846f-f764-76mx and GHSA-2fmv-rv2c-59x7 list 9.0.21 as patched. Its published manifest confirms the package version.

dotnet list Orbit.slnx package --include-transitive checked all 11 solution projects before and after the change. Only analyzer tests resolve Pkcs. The package tables differ only in Pkcs changing from 9.0.6 to 9.0.21.

Test evidence

• Before the fix, the unchanged dotnet test tests/Orbit.Analyzers.Tests passed all 32 tests while emitting both Pkcs audit warnings. These unit tests do not detect a vulnerable dependency version.
• Before editing dependency configuration, dotnet restore tests/Orbit.Analyzers.Tests/Orbit.Analyzers.Tests.csproj -warnaserror:NU1902,NU1903 exited 1 with errors for both Pkcs advisories. This strengthens the real NuGet audit check without adding a synthetic unit test or fixture.
• After the fix, that exact audit command exited 0 with neither Pkcs warning, and dotnet test tests/Orbit.Analyzers.Tests passed all 32 tests.
• dotnet build Orbit.slnx exited 0 with zero errors and no NU1902 or NU1903 warnings. Other dependency-constraint and obsolete-API warnings remain outside this dependency fix.
• dotnet test exited 0: 7,150 passed, zero failed and zero skipped across analyzer (32), domain (645), application (3,821) and infrastructure (2,652) tests.
• Pre-commit hooks and git diff --check passed.

Assumptions

• Use a central version file scoped to analyzer tests rather than migrate every solution project to Central Package Management, because the solution-wide package inventory found no other Pkcs consumer.

The carry to redesign/main remains part of thomasluizon/orbit-tickets#746.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[pullfrog]

✅ No new issues found.

Reviewed changes: Reviewed the complete analyzer-test dependency configuration change and verified the resolved package version against both linked advisories.

• Scoped dependency policy: Enables Central Package Management and transitive pinning only in tests/Orbit.Analyzers.Tests/Directory.Packages.props, leaving production projects unaffected.
• Patched Pkcs dependency: Pins System.Security.Cryptography.Pkcs to 9.0.21, which both advisories list as patched, while preserving all seven existing direct-package versions.

Independent verification passed: restore with NU1902/NU1903 treated as errors, package inventory confirming Pkcs 9.0.21, and all 32 analyzer tests. Existing NU1608 framework-version warnings remain unchanged; the full solution suite was not rerun during this review.

  ^{｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}