Repository navigation
fix: bump bunit to 2.8.6, drop transitive AngleSharp pin - #171
Merged
Merged
Conversation
This was referenced Aug 13, 2026
andregoepel
added a commit
that referenced
this pull request
Aug 13, 2026
AndreGoepel.Marten.Testing -> Testcontainers 4.13.0 resolves SSH.NET 2025.1.0, which carries a high severity arbitrary-file-write advisory (GHSA-q939-rpr3-3284). Since NU1903 is a hard error here, every restore failed - on main, on dependabot #174 and on any other PR. Testcontainers 4.13.0 is the latest release and still pulls the vulnerable version, so there is nothing to bump upstream. Re-introduce CentralPackageTransitivePinningEnabled with a single pin, the same pattern used for the AngleSharp pin dropped in #171. Also picks up a stale lock file entry: the Tests project still recorded Marten 9.18.0 while central versions say 9.19.0. Closes #177
This was referenced Aug 13, 2026
andregoepel
added a commit
that referenced
this pull request
Aug 13, 2026
* Bump the nuget-minor-patch group with 10 updates Bumps AndreGoepel.Core from 1.0.0 to 1.0.1 Bumps AndreGoepel.Marten.Identity.Blazor from 1.8.0 to 1.9.1 Bumps bunit from 2.8.6 to 2.9.0 Bumps Marten from 9.19.0 to 9.22.5 Bumps Npgsql from 9.0.4 to 9.0.5 Bumps Quartz.Extensions.Hosting from 3.18.2 to 3.19.1 Bumps Quartz.Serialization.SystemTextJson from 3.18.2 to 3.19.1 Bumps Radzen.Blazor from 11.1.7 to 11.2.2 Bumps WolverineFx.Marten from 6.22.0 to 6.25.0 Bumps WolverineFx.RuntimeCompilation from 6.22.0 to 6.25.0 --- updated-dependencies: - dependency-name: AndreGoepel.Core dependency-version: 1.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: AndreGoepel.Marten.Identity.Blazor dependency-version: 1.9.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: bunit dependency-version: 2.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: Marten dependency-version: 9.22.5 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: Npgsql dependency-version: 9.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Quartz.Extensions.Hosting dependency-version: 3.19.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: Quartz.Serialization.SystemTextJson dependency-version: 3.19.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: Radzen.Blazor dependency-version: 11.2.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: WolverineFx.Marten dependency-version: 6.25.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: WolverineFx.RuntimeCompilation dependency-version: 6.25.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): regenerate packages.lock.json * fix: pin SSH.NET to patched 2026.0.0 via transitive security pin (#178) AndreGoepel.Marten.Testing -> Testcontainers 4.13.0 resolves SSH.NET 2025.1.0, which carries a high severity arbitrary-file-write advisory (GHSA-q939-rpr3-3284). Since NU1903 is a hard error here, every restore failed - on main, on dependabot #174 and on any other PR. Testcontainers 4.13.0 is the latest release and still pulls the vulnerable version, so there is nothing to bump upstream. Re-introduce CentralPackageTransitivePinningEnabled with a single pin, the same pattern used for the AngleSharp pin dropped in #171. Also picks up a stale lock file entry: the Tests project still recorded Marten 9.18.0 while central versions say 9.19.0. Closes #177 * docs: reference removal-tracking issue in the SSH.NET pin comment (#180) --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: André Göpel <22834588+andregoepel@users.noreply.github.com> Co-authored-by: André Göpel <andre@andregoepel.de>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
bUnit 2.8.6 declares AngleSharp >= 1.5.2 as a direct dependency, so the transitive security pin for GHSA-pgww-w46g-26qg / CVE-2026-54570 (and the
CentralPackageTransitivePinningEnabledproperty that existed only for it) is no longer needed.CentralPackageTransitivePinningEnabledVerified: build clean,
dotnet list package --vulnerable --include-transitivereports no vulnerable packages, unit/bUnit tests green (122 passed). Testcontainers integration tests were not run locally (Docker unavailable); CI covers them.Closes #97
🤖 Generated with Claude Code