From 039ed9e9eea6e0ff7b173e9dc859333efa6598ab Mon Sep 17 00:00:00 2001
From: Artur Koniec <artur.koniec@risklogix-solutions.com>
Date: Wed, 22 Jul 2026 13:03:00 +0200
Subject: [PATCH] fix: pin System.Security.Cryptography.Xml to 10.0.10 to clear
 CVE-2026-50648

Fresh advisories (GHSA-23rf-6693-g89p and four siblings) flag the transitive
System.Security.Cryptography.Xml 10.0.7 pulled by OpenIddict.*.DataProtection.
With NuGetAudit=all and warnings-as-errors this fails restore of both AuthSystem
test projects on every branch, blocking all merges and CD.

Same recipe as the AngleSharp (#514) and Microsoft.OpenApi pins: central version
override + direct references in the affected test projects. The APIs are not
affected - they get the assembly from the shared framework.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TJCyYxiD8nLn1cjSbrcv16
---
 Directory.Packages.props                                     | 5 +++++
 .../LotroKoniecDev.AuthSystem.API.Tests.Integration.csproj   | 3 +++
 .../LotroKoniecDev.AuthSystem.API.Tests.Unit.csproj          | 3 +++
 3 files changed, 11 insertions(+)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index 8adbea68..9167adaa 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -15,6 +15,11 @@
          GHSA-pgww-w46g-26qg. Pin the first patched 1.x release; Frontend.Tests.Unit references it
          directly to force the fixed version into the graph. -->
     <PackageVersion Include="AngleSharp" Version="1.5.2" />
+    <!-- Security override: OpenIddict.*.DataProtection 7.5.0 transitively pulls System.Security.Cryptography.Xml
+         10.0.7, which carries CVE-2026-50648 (GHSA-23rf-6693-g89p and four sibling advisories, all fixed in
+         10.0.10). Pin the patched release; the AuthSystem test projects reference it directly to force the fixed
+         version into the graph (the APIs get it from the shared framework, so only test graphs carry the package). -->
+    <PackageVersion Include="System.Security.Cryptography.Xml" Version="10.0.10" />
     <PackageVersion Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" Version="10.0.9" />
     <PackageVersion Include="Microsoft.Extensions.Caching.Hybrid" Version="10.7.0" />
     <PackageVersion Include="Microsoft.Extensions.Http.Resilience" Version="10.7.0" />
diff --git a/tests/LotroKoniecDev.AuthSystem.API.Tests.Integration/LotroKoniecDev.AuthSystem.API.Tests.Integration.csproj b/tests/LotroKoniecDev.AuthSystem.API.Tests.Integration/LotroKoniecDev.AuthSystem.API.Tests.Integration.csproj
index bfe3394d..d5141b82 100644
--- a/tests/LotroKoniecDev.AuthSystem.API.Tests.Integration/LotroKoniecDev.AuthSystem.API.Tests.Integration.csproj
+++ b/tests/LotroKoniecDev.AuthSystem.API.Tests.Integration/LotroKoniecDev.AuthSystem.API.Tests.Integration.csproj
@@ -17,6 +17,9 @@
         <PackageReference Include="Microsoft.NET.Test.Sdk" />
         <PackageReference Include="NSubstitute" />
         <PackageReference Include="Shouldly" />
+        <!-- Direct pin forces the patched System.Security.Cryptography.Xml (CVE-2026-50648) over the vulnerable
+             10.0.7 pulled transitively by OpenIddict.*.DataProtection; version lives in Directory.Packages.props. -->
+        <PackageReference Include="System.Security.Cryptography.Xml" />
         <PackageReference Include="Testcontainers" />
         <PackageReference Include="Testcontainers.PostgreSql"/>
         <PackageReference Include="xunit" />
diff --git a/tests/LotroKoniecDev.AuthSystem.API.Tests.Unit/LotroKoniecDev.AuthSystem.API.Tests.Unit.csproj b/tests/LotroKoniecDev.AuthSystem.API.Tests.Unit/LotroKoniecDev.AuthSystem.API.Tests.Unit.csproj
index 4f1111e7..8c7947f2 100644
--- a/tests/LotroKoniecDev.AuthSystem.API.Tests.Unit/LotroKoniecDev.AuthSystem.API.Tests.Unit.csproj
+++ b/tests/LotroKoniecDev.AuthSystem.API.Tests.Unit/LotroKoniecDev.AuthSystem.API.Tests.Unit.csproj
@@ -15,6 +15,9 @@
         <PackageReference Include="Microsoft.NET.Test.Sdk" />
         <PackageReference Include="NSubstitute" />
         <PackageReference Include="Shouldly" />
+        <!-- Direct pin forces the patched System.Security.Cryptography.Xml (CVE-2026-50648) over the vulnerable
+             10.0.7 pulled transitively by OpenIddict.*.DataProtection; version lives in Directory.Packages.props. -->
+        <PackageReference Include="System.Security.Cryptography.Xml" />
         <PackageReference Include="xunit" />
         <PackageReference Include="xunit.runner.visualstudio">
             <PrivateAssets>all</PrivateAssets>