Bump CrispyWaffle from 10.2.6 to 10.2.9

[dependabot]

Updated CrispyWaffle from 10.2.6 to 10.2.9.

Release notes

Sourced from CrispyWaffle's releases.

10.2.9

What's Changed

• Bump the dependencies group with 10 updates by @​dependabot[bot] in Bump the dependencies group with 10 updates CrispyWaffle#962

Full Changelog: guibranco/CrispyWaffle@v10.2.8...v10.2.9

10.2.8

What's Changed

• Bump the microsoft group with 1 update by @​dependabot[bot] in Bump the microsoft group with 1 update CrispyWaffle#961

Full Changelog: guibranco/CrispyWaffle@v10.2.7...v10.2.8

10.2.7

What's Changed

• chore(deps): bump the github-actions group with 7 updates by @​dependabot[bot] in chore(deps): bump the github-actions group with 7 updates CrispyWaffle#960

Full Changelog: guibranco/CrispyWaffle@v10.2.6...v10.2.7

Commits viewable in compare view.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	nuget/​crispywaffle@​10.2.6 ⏵ 10.2.9

View full report

[socket-security]

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Block		Network access: nuget system.security.permissions Location: Package overview From: Src/VTEX.API/VTEX.API.csproj → nuget/crispywaffle@10.2.9 → nuget/system.security.permissions@10.0.9 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/system.security.permissions@10.0.9. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		System shell access: nuget system.security.permissions Location: Package overview From: Src/VTEX.API/VTEX.API.csproj → nuget/crispywaffle@10.2.9 → nuget/system.security.permissions@10.0.9 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/system.security.permissions@10.0.9. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Dynamic code execution: nuget system.security.permissions Location: Package overview From: Src/VTEX.API/VTEX.API.csproj → nuget/crispywaffle@10.2.9 → nuget/system.security.permissions@10.0.9 ℹ Read more on: This package | This alert | What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/system.security.permissions@10.0.9. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Network access: nuget system.windows.extensions Location: Package overview From: Src/VTEX.API/VTEX.API.csproj → nuget/crispywaffle@10.2.9 → nuget/system.windows.extensions@10.0.9 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/system.windows.extensions@10.0.9. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		System shell access: nuget system.windows.extensions Location: Package overview From: Src/VTEX.API/VTEX.API.csproj → nuget/crispywaffle@10.2.9 → nuget/system.windows.extensions@10.0.9 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/system.windows.extensions@10.0.9. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Dynamic code execution: nuget system.windows.extensions Location: Package overview From: Src/VTEX.API/VTEX.API.csproj → nuget/crispywaffle@10.2.9 → nuget/system.windows.extensions@10.0.9 ℹ Read more on: This package | This alert | What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/system.windows.extensions@10.0.9. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential code anomaly (AI signal): nuget crispywaffle is 62.0% likely to have a medium risk anomaly Notes: No definitive malware/backdoor is visible in the provided fragment. However, there are notable security risks: the library performs an outbound request to https://api.ipify.org to determine external IP (privacy/exfil signal), and it executes XSLT compiled from a provided string in XmlTemplateRender (potential server-side template/XSLT abuse, depending on runtime protections). It also performs object deserialization and writes to file paths provided by the caller. These are strong reasons to review usage patterns and add hardening (secure XML settings/resolvers, output encoding in hosts, restrict filesystem/network permissions, and avoid unsafe deserialization contexts). Confidence: 0.62 Severity: 0.62 From: Src/VTEX.API/VTEX.API.csproj → nuget/crispywaffle@10.2.9 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/crispywaffle@10.2.9. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Filesystem access: nuget system.windows.extensions Location: Package overview From: Src/VTEX.API/VTEX.API.csproj → nuget/crispywaffle@10.2.9 → nuget/system.windows.extensions@10.0.9 ℹ Read more on: This package | This alert | What is filesystem access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: If a package must read the file system, clarify what it will read and ensure it reads only what it claims to. If appropriate, packages can leave file system access to consumers and operate on data passed to it instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/system.windows.extensions@10.0.9. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Coverage ∅ diff coverage · +0.00% coverage variation

Metric	Results
Coverage variation	✅ +0.00% coverage variation (-1.00%)
Diff coverage	✅ ∅ diff coverage

View coverage diff in Codacy

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (ccbee39)	1793	4	0.22%
Head commit (1b30e58)	1793 (+0)	4 (+0)	0.22% (+0.00%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#643)	0	0	∅ (not applicable)

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[AppVeyorBot]

✅ Build VTEX-SDK-dotnet 3.0.1009 completed (commit a92574098c by @dependabot[bot])

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 0.22%. Comparing base (ccbee39) to head (1b30e58).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@          Coverage Diff          @@
##            main    #643   +/-   ##
=====================================
  Coverage   0.22%   0.22%           
=====================================
  Files        117     117           
  Lines       1793    1793           
  Branches      75      75           
=====================================
  Hits           4       4           
+ Misses      1789    1787    -2     
- Partials       0       2    +2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[guibranco]

Automatically approved by gstraccini[bot]

[AppVeyorBot]

✅ Build VTEX-SDK-dotnet 3.0.1018 completed (commit 30e5dd7fb6 by @dependabot[bot])

[github-actions]

Infisical secrets check: ✅ No secrets leaked!

💻 Scan logs

2026-07-18T17:24:39Z INF scanning for exposed secrets...
5:24PM INF 580 commits scanned.
2026-07-18T17:24:41Z INF scan completed in 1.74s
2026-07-18T17:24:41Z INF no leaks found

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[AppVeyorBot]

✅ Build VTEX-SDK-dotnet 3.0.1024 completed (commit 209ff68585 by @gstraccini[bot])