From 5cff7cce4d99f5610a4b39fb013487c4c0b18a73 Mon Sep 17 00:00:00 2001 From: Marko Lahma Date: Thu, 23 Jul 2026 11:42:10 +0300 Subject: [PATCH] Bump System.Security.Cryptography.Xml to the advisory-patched versions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 10.0.6, 9.0.15 and 8.0.3 are all inside the affected ranges of five high-severity advisories (GHSA-23rf-6693-g89p, GHSA-8q5v-6pqq-x66h, GHSA-cvvh-rhrc-wg4q, GHSA-g8r8-53c2-pm3f, GHSA-mmjf-rqrv-855v) — uncontrolled resource consumption in XML decryption. Move each line to its first patched release: 10.0.10, 9.0.18, 8.0.4. Fallout.Common carries the package as a direct dependency, so every consumer inherits the vulnerable version transitively and has to pin around it locally. Both the central version list and build/_build.csproj are bumped; the build project turns off central package management, so its inline pin is separate. Co-Authored-By: Claude Opus 4.8 (1M context) --- Directory.Packages.props | 6 +++--- build/_build.csproj | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/Directory.Packages.props b/Directory.Packages.props index fb7c9e066..6f67c023b 100644 --- a/Directory.Packages.props +++ b/Directory.Packages.props @@ -28,7 +28,7 @@ - + @@ -81,13 +81,13 @@ - + - + \ No newline at end of file diff --git a/build/_build.csproj b/build/_build.csproj index 0491b6ce2..e9748ca41 100644 --- a/build/_build.csproj +++ b/build/_build.csproj @@ -54,7 +54,7 @@ - +