From ccd24f9f0a5036b166bd81099b541ac093fcf0d3 Mon Sep 17 00:00:00 2001
From: Aaron Burtle <aaronburtle@microsoft.com>
Date: Tue, 20 Oct 2026 08:03:15 -0700
Subject: [PATCH] Fix NuGet audit failures blocking CI restore

New advisories make the implicit restore in the Unit Tests pipeline's
"Check formatting" step fail (NuGet audit warnings are errors):

- System.Security.Cryptography.Pkcs 9.0.11 (via Microsoft.Data.SqlClient
  6.1.5) and 9.0.4 (via Aspire.Hosting.SqlServer -> Microsoft.Data.SqlClient
  6.1.1): GHSA-2fmv-rv2c-59x7, GHSA-846f-f764-76mx. Pin 9.0.21.
- MessagePack 2.5.301 (Aspire.AppHost): GHSA-qhrr-8q5h-9q3h. Bump to 2.5.307.
- Microsoft.OpenApi.Readers 1.6.14 (Service.Tests): GHSA-7pxr-59rr-hqj2.
  Bump Microsoft.OpenApi and Microsoft.OpenApi.Readers to 1.6.31 together.

Pkcs is only a transitive dependency and central package management does
not pin transitive versions without a reference, so reference it from
Config and Core (where SqlClient enters the product graph; Core also so the
packed library declares it) and from Aspire.AppHost, whose restore graph
does not include its project references. No audit warnings are suppressed.
---
 src/Aspire.AppHost/Aspire.AppHost.csproj      |  2 ++
 src/Config/Azure.DataApiBuilder.Config.csproj |  2 ++
 src/Core/Azure.DataApiBuilder.Core.csproj     |  2 ++
 src/Directory.Packages.props                  | 13 +++++++++----
 4 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/src/Aspire.AppHost/Aspire.AppHost.csproj b/src/Aspire.AppHost/Aspire.AppHost.csproj
index 4fbe70cdcf..a74aa18a23 100644
--- a/src/Aspire.AppHost/Aspire.AppHost.csproj
+++ b/src/Aspire.AppHost/Aspire.AppHost.csproj
@@ -18,6 +18,8 @@
     <!-- Force the transitive MessagePack (via Aspire.Hosting/KubernetesClient) up to a
          patched version to resolve NU1903 (GHSA-hv8m-jj95-wg3x). -->
     <PackageReference Include="MessagePack" />
+    <!-- Aspire.Hosting.SqlServer brings its own Microsoft.Data.SqlClient; force its transitive Pkcs to the patched version. -->
+    <PackageReference Include="System.Security.Cryptography.Pkcs" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/src/Config/Azure.DataApiBuilder.Config.csproj b/src/Config/Azure.DataApiBuilder.Config.csproj
index 0d1655df76..64c554dba5 100644
--- a/src/Config/Azure.DataApiBuilder.Config.csproj
+++ b/src/Config/Azure.DataApiBuilder.Config.csproj
@@ -23,6 +23,8 @@
       <PackageReference Include="System.IO.Abstractions" />
       <PackageReference Include="System.Drawing.Common" />
       <PackageReference Include="Microsoft.Data.SqlClient" />
+      <!-- Override the vulnerable Pkcs pulled in by Microsoft.Data.SqlClient (see Directory.Packages.props). -->
+      <PackageReference Include="System.Security.Cryptography.Pkcs" />
       <PackageReference Include="Microsoft.IdentityModel.JsonWebTokens" />
       <PackageReference Include="System.IdentityModel.Tokens.Jwt" />
       <PackageReference Include="Humanizer" />
diff --git a/src/Core/Azure.DataApiBuilder.Core.csproj b/src/Core/Azure.DataApiBuilder.Core.csproj
index 0082d2e9b2..2542fed777 100644
--- a/src/Core/Azure.DataApiBuilder.Core.csproj
+++ b/src/Core/Azure.DataApiBuilder.Core.csproj
@@ -41,6 +41,8 @@
     <PackageReference Include="Microsoft.IdentityModel.Protocols.OpenIdConnect" />
     <PackageReference Include="Microsoft.Azure.Cosmos" />
     <PackageReference Include="Microsoft.Data.SqlClient" />
+    <!-- Repeated from Config so the packed Core library still depends on the patched Pkcs when project references are privatized. -->
+    <PackageReference Include="System.Security.Cryptography.Pkcs" />
     <PackageReference Include="Microsoft.Extensions.Configuration.Binder" />
     <PackageReference Include="Microsoft.Extensions.Configuration.Json" />
     <PackageReference Include="Microsoft.OData.Core" />
diff --git a/src/Directory.Packages.props b/src/Directory.Packages.props
index afa9d3e276..6ad266c9ec 100644
--- a/src/Directory.Packages.props
+++ b/src/Directory.Packages.props
@@ -33,8 +33,9 @@
     <PackageVersion Include="Microsoft.Azure.Cosmos" Version="3.38.1" />
     <PackageVersion Include="Microsoft.Azure.StackExchangeRedis" Version="3.3.1" />
     <!-- Pinned to override the vulnerable MessagePack 2.5.192 pulled in transitively
-         by Aspire.Hosting (KubernetesClient). 2.5.301 patches GHSA-hv8m-jj95-wg3x / CVE-2026-48109. -->
-    <PackageVersion Include="MessagePack" Version="2.5.301" />
+         by Aspire.Hosting (KubernetesClient). 2.5.307 patches GHSA-hv8m-jj95-wg3x / CVE-2026-48109
+         and GHSA-qhrr-8q5h-9q3h / CVE-2026-92707. -->
+    <PackageVersion Include="MessagePack" Version="2.5.307" />
     <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="10.0.0" />
     <PackageVersion Include="Microsoft.Extensions.Caching.Abstractions" Version="10.0.0" />
     <PackageVersion Include="Microsoft.Extensions.Primitives" Version="10.0.0" />
@@ -58,8 +59,9 @@
     <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.9.0" />
     <PackageVersion Include="Microsoft.OData.Edm" Version="7.20.0" />
     <PackageVersion Include="Microsoft.OData.Core" Version="7.20.0" />
-    <PackageVersion Include="Microsoft.OpenApi" Version="1.6.14" />
-    <PackageVersion Include="Microsoft.OpenApi.Readers" Version="1.6.14" />
+    <!-- Readers < 1.6.30 is vulnerable (GHSA-7pxr-59rr-hqj2); keep both packages on the same version. -->
+    <PackageVersion Include="Microsoft.OpenApi" Version="1.6.31" />
+    <PackageVersion Include="Microsoft.OpenApi.Readers" Version="1.6.31" />
     <PackageVersion Include="Moq" Version="4.18.2" />
     <PackageVersion Include="MSTest.TestAdapter" Version="3.3.1" />
     <PackageVersion Include="MSTest.TestFramework" Version="3.3.1" />
@@ -80,6 +82,9 @@
         <PackageVersion Include="System.IdentityModel.Tokens.Jwt" Version="8.1.2" />
         <PackageVersion Include="System.IO.Abstractions" Version="21.0.2" />
         <PackageVersion Include="System.IO.Abstractions.TestingHelpers" Version="21.0.2" />
+        <!-- Pinned to override the vulnerable Pkcs 9.0.11/9.0.4 pulled in transitively by Microsoft.Data.SqlClient
+             (including Aspire.Hosting.SqlServer). 9.0.21 patches GHSA-2fmv-rv2c-59x7 and GHSA-846f-f764-76mx. -->
+        <PackageVersion Include="System.Security.Cryptography.Pkcs" Version="9.0.21" />
         <PackageVersion Include="Verify.MsTest" Version="23.6.0" />
         <PackageVersion Include="Verify.DiffPlex" Version="2.3.0" />
         <PackageVersion Include="ZiggyCreatures.FusionCache" Version="2.1.0" />