From 6a2fe3ef11e811b2405722caf0ea471596198382 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20G=C3=B6pel?= <andre@andregoepel.de>
Date: Sat, 18 Jul 2026 10:24:03 +0800
Subject: [PATCH 1/2] fix(deps): pin AngleSharp to 1.5.2 to clear mXSS advisory

bUnit -> AngleSharp.Diffing pulls AngleSharp 1.4.0 transitively, which
has a moderate mXSS advisory (GHSA-pgww-w46g-26qg / CVE-2026-54570)
patched in 1.5.0. The CI vulnerability gate fails on any severity, so
this blocks the build.

Enable central transitive pinning and pin AngleSharp to the patched
1.5.2 (latest stable). Verified: vuln scan clean across all projects,
Blazor bUnit suite 102/102 green.
---
 Directory.Packages.props                              | 11 +++++++++++
 .../packages.lock.json                                | 11 ++++++-----
 2 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index 1bc93c6..df105a4 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -1,8 +1,19 @@
 <Project>
   <PropertyGroup>
     <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
+    <!-- Let a central PackageVersion override a transitive dependency's resolved
+         version without a direct PackageReference (see AngleSharp pin below). -->
+    <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
   </PropertyGroup>
 
+  <ItemGroup Label="Transitive security pins">
+    <!-- bUnit -> AngleSharp.Diffing pulls AngleSharp 1.4.0, which has a moderate
+         mXSS advisory (GHSA-pgww-w46g-26qg / CVE-2026-54570). Pin to the patched
+         1.5.x line to clear the CI vulnerability gate. Remove once bUnit ships a
+         transitive chain that resolves to >= 1.5.0 on its own. -->
+    <PackageVersion Include="AngleSharp" Version="1.5.2" />
+  </ItemGroup>
+
   <ItemGroup Label="Marten">
     <PackageVersion Include="Marten" Version="9.15.4" />
     <PackageVersion Include="Marten.AspNetCore" Version="9.15.4" />
diff --git a/tests/AndreGoepel.Marten.Identity.Blazor.Tests/packages.lock.json b/tests/AndreGoepel.Marten.Identity.Blazor.Tests/packages.lock.json
index 72735c5..910a7d2 100644
--- a/tests/AndreGoepel.Marten.Identity.Blazor.Tests/packages.lock.json
+++ b/tests/AndreGoepel.Marten.Identity.Blazor.Tests/packages.lock.json
@@ -55,11 +55,6 @@
           "xunit.v3.mtp-v1": "[3.2.2]"
         }
       },
-      "AngleSharp": {
-        "type": "Transitive",
-        "resolved": "1.4.0",
-        "contentHash": "6ph8mpaQx0KL0COYRt0kI8MB9gSp1PtKijKMhJU//+aVFgKAJLKDesG/+26JSaVCOrHNgPf12wpfoyRcMYOeXg=="
-      },
       "AngleSharp.Css": {
         "type": "Transitive",
         "resolved": "1.0.0-beta.157",
@@ -402,6 +397,12 @@
           "Radzen.Blazor": "11.1.3"
         }
       },
+      "AngleSharp": {
+        "type": "CentralTransitive",
+        "requested": "[1.5.2, )",
+        "resolved": "1.5.2",
+        "contentHash": "LVZ7rrr6GHbhERhTgVDarVygl1e6KwE96pronA90LBOMacDhxR4lB+xYLjn/vlnUu+xbOB2RM9fuCPEx5bdyWA=="
+      },
       "Marten": {
         "type": "CentralTransitive",
         "requested": "[9.15.4, )",

From 9b81a8b9a36fb7a926811d042f92b05aaa0036ea Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20G=C3=B6pel?= <andre@andregoepel.de>
Date: Sat, 18 Jul 2026 10:26:39 +0800
Subject: [PATCH 2/2] docs(deps): reference tracking issue #107 in AngleSharp
 pin comment

---
 Directory.Packages.props | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index df105a4..18be693 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -10,7 +10,7 @@
     <!-- bUnit -> AngleSharp.Diffing pulls AngleSharp 1.4.0, which has a moderate
          mXSS advisory (GHSA-pgww-w46g-26qg / CVE-2026-54570). Pin to the patched
          1.5.x line to clear the CI vulnerability gate. Remove once bUnit ships a
-         transitive chain that resolves to >= 1.5.0 on its own. -->
+         transitive chain that resolves to >= 1.5.0 on its own (tracked in #107). -->
     <PackageVersion Include="AngleSharp" Version="1.5.2" />
   </ItemGroup>