[maxiar]

The solution no longer restores on main. New advisories were published against the 10.0.12 crypto packages. With NuGet audit plus TreatWarningsAsErrors, they surface as NU1902/NU1903 and fail every project:

error NU1903: Warning As Error: Package 'System.Security.Cryptography.Xml' 10.0.12 has a known high severity vulnerability, https://github.com/advisories/GHSA-7hqp-7c5m-4vq6
error NU1903: Warning As Error: Package 'System.Security.Cryptography.Pkcs' 10.0.12 has a known high severity vulnerability, https://github.com/advisories/GHSA-846f-f764-76mx
error NU1902: Warning As Error: Package 'System.Security.Cryptography.Pkcs' 10.0.0 has a known moderate severity vulnerability, https://github.com/advisories/GHSA-2fmv-rv2c-59x7

Also flagged: GHSA-c399-9853-6jmj and GHSA-r955-8q5j-3h83 (Xml).

Two changes:

• Every 10.0.12 pin moves to 10.0.13: EF Core, ASP.NET Core, Microsoft.Extensions.*, and the existing System.Security.Cryptography.Xml pin. This follows the existing "bump in lockstep with the .NET 10 patch line" note.
• System.Security.Cryptography.Pkcs gets a transitive pin, next to Cryptography.Xml. Bumping the direct references doesn't clear it on its own. It still floats in at 9.0.x / 10.0.0 via MailKit and the Aspire hosting stack, so it needs a pin like Cryptography.Xml already has.

No source edits were needed.

Verification

dotnet build src/FSH.Starter.slnx                                  -> 0 errors
dotnet list src/FSH.Starter.slnx package --vulnerable --include-transitive
                                                                   -> no vulnerable packages (51/51 projects)
dotnet test src/Tests/Architecture.Tests                           -> 55/55 pass
dotnet test src/Tests/Framework.Tests                              -> 346/346 pass

🤖 Generated with Claude Code