fix(security): patch vulnerable NuGet dependencies flagged by CI gate

The new dependency scan correctly failed on real advisories. Bump MailKit
4.13.0->4.17.0 (clears MailKit+MimeKit moderates) and add transitive security
pins for the .NET 8.0.0 High-severity advisories: System.Text.Json 8.0.6,
Microsoft.Extensions.Caching.Memory 8.0.1 (with DependencyInjection.Abstractions
8.0.2), System.Security.Cryptography.Xml 8.0.3. Verified locally: clean vuln
scan, Release build OK, all 39 tests pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CHANGELOG.md

@@ -5,6 +5,12 @@ All notable changes to InboxIntel are documented here. Format follows
 [Semantic Versioning](https://semver.org/). See [docs/WORKFLOW.md](docs/WORKFLOW.md).
 
 ## [Unreleased]
+### Security
+- Patched all High/Moderate NuGet advisories the new dependency gate surfaced:
+  `System.Text.Json` 8.0.0→8.0.6, `Microsoft.Extensions.Caching.Memory` 8.0.0→8.0.1
+  (+ `DependencyInjection.Abstractions`→8.0.2), `System.Security.Cryptography.Xml`
+  8.0.1→8.0.3 (transitive pins), and `MailKit`/`MimeKit` 4.13.0→4.17.0.
+
 ### Added
 - CI/CD pipeline (`.gitea/workflows/`): `security` (gitleaks secret scan + NuGet/npm
   vulnerability gate), `deploy-staging` (auto-redeploy local staging on `develop`),

src/InboxIntel.Application/InboxIntel.Application.csproj

@@ -6,10 +6,13 @@
   <ItemGroup>
     <PackageReference Include="FluentValidation" Version="11.9.2" />
     <PackageReference Include="FluentValidation.DependencyInjectionExtensions" Version="11.9.2" />
-    <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="8.0.1" />
+    <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="8.0.2" />
     <!-- DbSet<> is exposed on IAppDbContext so the Application layer can query.
          Pinned to 8.0.4 to match the Npgsql provider's Relational dependency. -->
     <PackageReference Include="Microsoft.EntityFrameworkCore" Version="8.0.4" />
+    <!-- Transitive security pins: patch known .NET 8.0.0 advisories pulled in by EF Core. -->
+    <PackageReference Include="System.Text.Json" Version="8.0.6" />
+    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="8.0.1" />
   </ItemGroup>
   <ItemGroup>
     <ProjectReference Include="..\InboxIntel.Domain\InboxIntel.Domain.csproj" />

src/InboxIntel.Infrastructure/InboxIntel.Infrastructure.csproj

@@ -19,7 +19,13 @@
     <PackageReference Include="QuestPDF" Version="2024.7.0" />
     <PackageReference Include="CsvHelper" Version="33.0.1" />
     <PackageReference Include="Serilog.Extensions.Hosting" Version="8.0.0" />
-    <PackageReference Include="MailKit" Version="4.13.0" />
+    <PackageReference Include="MailKit" Version="4.17.0" />
+    <!-- Transitive security pins: patch known .NET 8.0.0 advisories pulled in by
+         EF Core / ASP.NET / DataProtection. Remove once the parent packages ship
+         these versions transitively. -->
+    <PackageReference Include="System.Text.Json" Version="8.0.6" />
+    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="8.0.1" />
+    <PackageReference Include="System.Security.Cryptography.Xml" Version="8.0.3" />
   </ItemGroup>
   <ItemGroup>
     <ProjectReference Include="..\InboxIntel.Application\InboxIntel.Application.csproj" />