From 9d1aa51a52eb810ef40e3fb180c25088e667d201 Mon Sep 17 00:00:00 2001
From: EHotwagner <ehotwagner@gmail.com>
Date: Sat, 24 Oct 2026 21:28:46 +0200
Subject: [PATCH] Bump System.Security.Cryptography.Xml to 10.0.13 to clear the
 NuGet audit advisories (Refs FS-GG/.github#4753)

10.0.12 of System.Security.Cryptography.Xml and its transitive Pkcs dependency are affected by
GHSA-7hqp-7c5m-4vq6, GHSA-c399-9853-6jmj, GHSA-r955-8q5j-3h83 (Xml) and GHSA-2fmv-rv2c-59x7,
GHSA-846f-f764-76mx (Pkcs), reported as NU1902/NU1903 and treated as errors by the locked-restore
gate. 10.0.13 is the first patched version of both; Pkcs follows through Xml's dependency. Central
package management pin and the two affected sample lock files regenerated; no audit suppression.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 Directory.Packages.props                           |  4 ++--
 .../GrpcService.Client/packages.lock.json          | 14 +++++++-------
 .../GrpcService.Contracts/packages.lock.json       | 12 ++++++------
 3 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index 1f49bb4..7b5644e 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -47,8 +47,8 @@
     <!-- Server hosting for the samples/GrpcService code-first service. -->
     <PackageVersion Include="protobuf-net.Grpc.AspNetCore" Version="1.3.14" />
     <PackageVersion Include="System.ServiceModel.Primitives" Version="10.0.652802" />
-    <!-- Overrides the vulnerable 8.0.2 that System.ServiceModel.Primitives pulls transitively (NU1903). -->
-    <PackageVersion Include="System.Security.Cryptography.Xml" Version="10.0.12" />
+    <!-- Overrides the vulnerable 8.0.2 that System.ServiceModel.Primitives pulls transitively (NU1903). 10.0.13 patches the 10.0.x advisories GHSA-7hqp-7c5m-4vq6, GHSA-c399-9853-6jmj, GHSA-r955-8q5j-3h83 (NU1903); its System.Security.Cryptography.Pkcs dependency follows at 10.0.13 (GHSA-2fmv-rv2c-59x7, GHSA-846f-f764-76mx). -->
+    <PackageVersion Include="System.Security.Cryptography.Xml" Version="10.0.13" />
 
     <!-- Elmish Cmd/Sub authoring surface: FS.GG.Net.Elmish. The standard Elmish library (never
          FS.GG.UI — the transport component stays render-independent, like FS.GG.Audio.Elmish). -->
diff --git a/samples/GrpcService/GrpcService.Client/packages.lock.json b/samples/GrpcService/GrpcService.Client/packages.lock.json
index 41c5dd0..a48c32a 100644
--- a/samples/GrpcService/GrpcService.Client/packages.lock.json
+++ b/samples/GrpcService/GrpcService.Client/packages.lock.json
@@ -66,8 +66,8 @@
       },
       "System.Security.Cryptography.Pkcs": {
         "type": "Transitive",
-        "resolved": "10.0.12",
-        "contentHash": "W6BsawU2tB2qy6u4+3cBOSOmiTUgYWW365b5WMVA1bDxQwZZeNWD+qufKJkDQNKzAKq4b6Q04DDKhmr2SNJ1eg=="
+        "resolved": "10.0.13",
+        "contentHash": "a+EovgC1fBnwdlQ6cn3j4JFBfKqiFaFvoAhjisOoSvazLAcIznaBzPQP0oYnvccmeXfqUH1KebVZOxSeH6rMaw=="
       },
       "fs.gg.net.core": {
         "type": "Project",
@@ -98,7 +98,7 @@
         "type": "Project",
         "dependencies": {
           "FSharp.Core": "[10.1.401, )",
-          "System.Security.Cryptography.Xml": "[10.0.12, )",
+          "System.Security.Cryptography.Xml": "[10.0.13, )",
           "System.ServiceModel.Primitives": "[10.0.652802, )",
           "protobuf-net": "[3.4.30, )",
           "protobuf-net.Grpc": "[1.3.14, )"
@@ -131,11 +131,11 @@
       },
       "System.Security.Cryptography.Xml": {
         "type": "CentralTransitive",
-        "requested": "[10.0.12, )",
-        "resolved": "10.0.12",
-        "contentHash": "T3snzcc04R1JDj2XmzrLyk5fHT0YroBz5o2P+YdyJKYePSMqp8JsrxEJQPvUnK6oozQBvKLki9vnI7uMuWepKQ==",
+        "requested": "[10.0.13, )",
+        "resolved": "10.0.13",
+        "contentHash": "v6/GHhLaHkuN/ISgbKzBeyC7TP7S6Qm/dVyKA+p0ay9nlJyLif+spozjAGclY/FRIv2TC+KNQCo7dSNmupvWtQ==",
         "dependencies": {
-          "System.Security.Cryptography.Pkcs": "10.0.12"
+          "System.Security.Cryptography.Pkcs": "10.0.13"
         }
       },
       "System.ServiceModel.Primitives": {
diff --git a/samples/GrpcService/GrpcService.Contracts/packages.lock.json b/samples/GrpcService/GrpcService.Contracts/packages.lock.json
index 05bb4fb..9649789 100644
--- a/samples/GrpcService/GrpcService.Contracts/packages.lock.json
+++ b/samples/GrpcService/GrpcService.Contracts/packages.lock.json
@@ -29,11 +29,11 @@
       },
       "System.Security.Cryptography.Xml": {
         "type": "Direct",
-        "requested": "[10.0.12, )",
-        "resolved": "10.0.12",
-        "contentHash": "T3snzcc04R1JDj2XmzrLyk5fHT0YroBz5o2P+YdyJKYePSMqp8JsrxEJQPvUnK6oozQBvKLki9vnI7uMuWepKQ==",
+        "requested": "[10.0.13, )",
+        "resolved": "10.0.13",
+        "contentHash": "v6/GHhLaHkuN/ISgbKzBeyC7TP7S6Qm/dVyKA+p0ay9nlJyLif+spozjAGclY/FRIv2TC+KNQCo7dSNmupvWtQ==",
         "dependencies": {
-          "System.Security.Cryptography.Pkcs": "10.0.12"
+          "System.Security.Cryptography.Pkcs": "10.0.13"
         }
       },
       "System.ServiceModel.Primitives": {
@@ -63,8 +63,8 @@
       },
       "System.Security.Cryptography.Pkcs": {
         "type": "Transitive",
-        "resolved": "10.0.12",
-        "contentHash": "W6BsawU2tB2qy6u4+3cBOSOmiTUgYWW365b5WMVA1bDxQwZZeNWD+qufKJkDQNKzAKq4b6Q04DDKhmr2SNJ1eg=="
+        "resolved": "10.0.13",
+        "contentHash": "a+EovgC1fBnwdlQ6cn3j4JFBfKqiFaFvoAhjisOoSvazLAcIznaBzPQP0oYnvccmeXfqUH1KebVZOxSeH6rMaw=="
       }
     }
   }