Dependencies: Pin System.Security.Cryptography.Xml to resolve vulnerability warning

[AndyButland]

Description

Resolves NU1903 build warnings about a high-severity vulnerability in System.Security.Cryptography.Xml 8.0.0 (GHSA-w3x6-4m5h-cxqf and GHSA-37gx-xxp4-5rgx — denial of service via uncontrolled resource consumption / infinite loop in EncryptedXml, CVSS 7.5).

The vulnerable package is pulled in transitively via:

Examine (3.7.1)
  └── Microsoft.AspNetCore.DataProtection (8.0.4)
      └── System.Security.Cryptography.Xml (8.0.0)

Examine 3.7.1 is the latest stable release, and there is no updated direct dependency we can bump to clear the warning upstream. Following the existing pattern in Directory.Packages.props for transitive pins (e.g. System.Net.Http, System.Private.Uri, System.Text.RegularExpressions), this adds a pinned version of System.Security.Cryptography.Xml at 10.0.6 — the patched version for the 10.x line per the advisories, and matching the 10.0.6 version used for other Microsoft.Extensions.* packages already in the file.

A TODO is included to remove the pin when Examine updates its Microsoft.AspNetCore.DataProtection reference to a non-vulnerable version.

[claude]

Claude finished @AndyButland's task in 1m 1s —— View job

---

PR Review

Target: origin/main · Based on commit: 55883efa · Classified as: Config-only

Pins System.Security.Cryptography.Xml to 10.0.6 in the centralized package version file to silence NU1903 vulnerability warnings caused by the Examine → Microsoft.AspNetCore.DataProtection 8.0.4 transitive dependency chain.

• No breaking changes detected.

---

No Critical, Important, or Suggestion findings. The change:

• Follows the established transitive-pin pattern in Directory.Packages.props exactly (grouped ItemGroup, explanatory XML comment, TODO for future cleanup)
• Pins to 10.0.6, consistent with the rest of the Microsoft.* packages targeting .NET 10 in this file
• The TODO deliberately omits a (V{N}) version marker (unlike the Dazinator/Markdown pins), which is correct — removal depends on an upstream Examine release, not an internal Umbraco version milestone

---

Approved

This looks good to be merged as-is, but please do a manual sanity check and testing before merging.

[Copilot]

Pull request overview

Pins a vulnerable transitive dependency to eliminate NU1903 vulnerability warnings during restore/build, following the repo’s established “transitive pinned versions” pattern.

Changes:

• Add a central transitive pin for System.Security.Cryptography.Xml to 10.0.6.
• Document why the pin exists and add a TODO to remove it when upstream dependencies are updated.

[NillasKA]

LGTM.

Unsure when you want this in the build so i will leave you to do the labels.

[AndyButland]

Thanks @NillasKA, I'll do that. This can go in 17.4.