cesnimda/Inboxintel
1
0
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

fix(security): patch vulnerable NuGet dependencies flagged by CI gate
CI / backend (pull_request) Successful in 1m13s
Details
CI / frontend (pull_request) Successful in 29s
Details
Security / secrets (pull_request) Successful in 6s
Details
Security / dependencies (pull_request) Successful in 1m13s
Details

Browse Source 
The new dependency scan correctly failed on real advisories. Bump MailKit
4.13.0->4.17.0 (clears MailKit+MimeKit moderates) and add transitive security
pins for the .NET 8.0.0 High-severity advisories: System.Text.Json 8.0.6,
Microsoft.Extensions.Caching.Memory 8.0.1 (with DependencyInjection.Abstractions
8.0.2), System.Security.Cryptography.Xml 8.0.3. Verified locally: clean vuln
scan, Release build OK, all 39 tests pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
cesnimda
2026-07-01 11:38:08 +02:00
parent 98e94a8163
commit e981c63a4d
3 changed files with 17 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+6
View File
@@ -5,6 +5,12 @@ All notable changes to InboxIntel are documented here. Format follows
[Semantic Versioning](https://semver.org/). See [docs/WORKFLOW.md](docs/WORKFLOW.md).
## [Unreleased]
### Security
- Patched all High/Moderate NuGet advisories the new dependency gate surfaced:
`System.Text.Json` 8.0.0→8.0.6, `Microsoft.Extensions.Caching.Memory` 8.0.0→8.0.1
(+ `DependencyInjection.Abstractions`→8.0.2), `System.Security.Cryptography.Xml`
8.0.1→8.0.3 (transitive pins), and `MailKit`/`MimeKit` 4.13.0→4.17.0.
### Added
- CI/CD pipeline (`.gitea/workflows/`): `security` (gitleaks secret scan + NuGet/npm
vulnerability gate), `deploy-staging` (auto-redeploy local staging on `develop`),
src/InboxIntel.Application/InboxIntel.Application.csproj
+4 -1
View File
@@ -6,10 +6,13 @@
<ItemGroup>
<PackageReference Include="FluentValidation" Version="11.9.2" />
<PackageReference Include="FluentValidation.DependencyInjectionExtensions" Version="11.9.2" />
<PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="8.0.1" />
<PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="8.0.2" />
<!-- DbSet<> is exposed on IAppDbContext so the Application layer can query.
Pinned to 8.0.4 to match the Npgsql provider's Relational dependency. -->
<PackageReference Include="Microsoft.EntityFrameworkCore" Version="8.0.4" />
<!-- Transitive security pins: patch known .NET 8.0.0 advisories pulled in by EF Core. -->
<PackageReference Include="System.Text.Json" Version="8.0.6" />
<PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="8.0.1" />
</ItemGroup>
<ItemGroup>
<ProjectReference Include="..\InboxIntel.Domain\InboxIntel.Domain.csproj" />
src/InboxIntel.Infrastructure/InboxIntel.Infrastructure.csproj
+7 -1
View File
@@ -19,7 +19,13 @@
<PackageReference Include="QuestPDF" Version="2024.7.0" />
<PackageReference Include="CsvHelper" Version="33.0.1" />
<PackageReference Include="Serilog.Extensions.Hosting" Version="8.0.0" />
<PackageReference Include="MailKit" Version="4.13.0" />
<PackageReference Include="MailKit" Version="4.17.0" />
<!-- Transitive security pins: patch known .NET 8.0.0 advisories pulled in by
EF Core / ASP.NET / DataProtection. Remove once the parent packages ship
these versions transitively. -->
<PackageReference Include="System.Text.Json" Version="8.0.6" />
<PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="8.0.1" />
<PackageReference Include="System.Security.Cryptography.Xml" Version="8.0.3" />
</ItemGroup>
<ItemGroup>
<ProjectReference Include="..\InboxIntel.Application\InboxIntel.Application.csproj" />