From e981c63a4d9bb8e064d4b8f86d392fdc09256223 Mon Sep 17 00:00:00 2001 From: cesnimda Date: Wed, 1 Jul 2026 11:38:08 +0200 Subject: [PATCH] fix(security): patch vulnerable NuGet dependencies flagged by CI gate The new dependency scan correctly failed on real advisories. Bump MailKit 4.13.0->4.17.0 (clears MailKit+MimeKit moderates) and add transitive security pins for the .NET 8.0.0 High-severity advisories: System.Text.Json 8.0.6, Microsoft.Extensions.Caching.Memory 8.0.1 (with DependencyInjection.Abstractions 8.0.2), System.Security.Cryptography.Xml 8.0.3. Verified locally: clean vuln scan, Release build OK, all 39 tests pass. Co-Authored-By: Claude Opus 4.8 --- CHANGELOG.md | 6 ++++++ src/InboxIntel.Application/InboxIntel.Application.csproj | 5 ++++- .../InboxIntel.Infrastructure.csproj | 8 +++++++- 3 files changed, 17 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 441e486..55eacfa 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,12 @@ All notable changes to InboxIntel are documented here. Format follows [Semantic Versioning](https://semver.org/). See [docs/WORKFLOW.md](docs/WORKFLOW.md). ## [Unreleased] +### Security +- Patched all High/Moderate NuGet advisories the new dependency gate surfaced: + `System.Text.Json` 8.0.0→8.0.6, `Microsoft.Extensions.Caching.Memory` 8.0.0→8.0.1 + (+ `DependencyInjection.Abstractions`→8.0.2), `System.Security.Cryptography.Xml` + 8.0.1→8.0.3 (transitive pins), and `MailKit`/`MimeKit` 4.13.0→4.17.0. + ### Added - CI/CD pipeline (`.gitea/workflows/`): `security` (gitleaks secret scan + NuGet/npm vulnerability gate), `deploy-staging` (auto-redeploy local staging on `develop`), diff --git a/src/InboxIntel.Application/InboxIntel.Application.csproj b/src/InboxIntel.Application/InboxIntel.Application.csproj index cf93528..ed04e5a 100644 --- a/src/InboxIntel.Application/InboxIntel.Application.csproj +++ b/src/InboxIntel.Application/InboxIntel.Application.csproj @@ -6,10 +6,13 @@ - + + + + diff --git a/src/InboxIntel.Infrastructure/InboxIntel.Infrastructure.csproj b/src/InboxIntel.Infrastructure/InboxIntel.Infrastructure.csproj index 01875f8..37f6a69 100644 --- a/src/InboxIntel.Infrastructure/InboxIntel.Infrastructure.csproj +++ b/src/InboxIntel.Infrastructure/InboxIntel.Infrastructure.csproj @@ -19,7 +19,13 @@ - + + + + +