From 9407c0e381562e511b04a41351938f44607013f3 Mon Sep 17 00:00:00 2001
From: "Jeremy D. Miller" <jeremydmiller@yahoo.com>
Date: Wed, 29 Jul 2026 06:44:35 -0500
Subject: [PATCH] chore: pin NuGet transitives in build/ to clear 8 advisories

build/Build.csproj pulled 7 high-severity advisories (NU1903) on
System.Security.Cryptography.Xml 9.0.0 and 1 low (NU1901) on
NuGet.Packaging 6.12.1, both transitively through Nuke.Common 10.1.0.

Nuke.Common 10.1.0 is already the latest release, so bumping it isn't an
option - pin both transitives up directly instead. 9.0.18 is the patched
floor covering all seven crypto advisories (9.0.15 clears only four);
NuGet.Packaging 6.12.5 is the patched release on the same 6.12.x line
Nuke builds against.

These never showed up in a local solution restore because Build.csproj is
marked <Build Project="false" /> in jasperfx.slnx, so
`dotnet restore jasperfx.slnx` skips it entirely - they were only visible
in CI logs.

`dotnet restore build/Build.csproj` is now fully clean, and `./build.sh`
still bootstraps and runs.

Closes #584

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 build/Build.csproj | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/build/Build.csproj b/build/Build.csproj
index 99fb31ca..9b9bf143 100644
--- a/build/Build.csproj
+++ b/build/Build.csproj
@@ -13,6 +13,23 @@
 
   <ItemGroup>
     <PackageReference Include="Nuke.Common" Version="10.1.0" />
+
+    <!--
+      Nuke.Common 10.1.0 (the latest release) pulls NuGet.Packaging 6.12.1, which in turn pulls
+      System.Security.Cryptography.Xml 9.0.0 - seven high-severity advisories (NU1903). Nuke can't
+      be bumped past this, so pin the transitive up to the patched floor directly. 9.0.15 clears
+      only four of the seven; 9.0.18 covers all of them.
+
+      Nothing is shipped from build/, so this has no consumer impact. Drop the pin once Nuke ships
+      against a NuGet.Packaging that doesn't drag in a vulnerable version.
+    -->
+    <PackageReference Include="System.Security.Cryptography.Xml" Version="9.0.18" />
+
+    <!--
+      Same story one level up: NuGet.Packaging 6.12.1 carries the low-severity GHSA-g4vj-cjjj-v7hg
+      (NU1901). 6.12.5 is the patched release on the same 6.12.x line Nuke already builds against.
+    -->
+    <PackageReference Include="NuGet.Packaging" Version="6.12.5" />
   </ItemGroup>
 
 </Project>