Skip to content

Fix vulnerable build and test dependencies - #568

Merged
runceel merged 1 commit into
mainfrom
security/fix-vulnerable-build-and-test-dependencies
Oct 29, 2026
Merged

runceel merged 1 commit into
mainfrom
security/fix-vulnerable-build-and-test-dependencies

Conversation

@runceel

@runceel runceel commented Oct 29, 2026

Copy link
Copy Markdown
Owner

Summary

  • Update Microsoft.SourceLink.GitHub to 10.0.403, resolving Microsoft.Build.Tasks.Git to patched version 10.0.403 (GHSA-23fw-v26w-5fgq).
  • Pin AngleSharp 1.5.0 directly in the Blazor test project to address GHSA-pgww-w46g-26qg in the transitive bunit dependency.

Validation

  • dotnet restore ReactiveProperty.slnx
  • Release build and full solution tests passed.
  • Blazor test project: 4 tests passed.
  • Vulnerability scans show no affected package in the scanned supported projects.

Note: the UWP project could not be scanned because MSBuild.Sdk.Extras is unavailable in the environment.

Update SourceLink to resolve the patched Microsoft.Build.Tasks.Git dependency and pin AngleSharp to a fixed version for Blazor tests.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@runceel
runceel merged commit aad565a into main Oct 29, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants