Repository navigation
test: pin System.Security.Cryptography.Pkcs in DiagnosticSource integration tests - #5771
Merged
Merged
Conversation
…ration tests Microsoft.Data.SqlClient 6.1.x pulls in Pkcs 9.0.4 on net10.0, which is affected by GHSA-846f-f764-76mx and GHSA-2fmv-rv2c-59x7. No SqlClient release floors Pkcs high enough to clear them yet. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #5771 +/- ##
=======================================
Coverage 76.12% 76.12%
=======================================
Files 528 528
Lines 19579 19579
Branches 3829 3829
=======================================
+ Hits 14904 14905 +1
Misses 3792 3792
+ Partials 883 882 -1 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
ric-oliv
approved these changes
Oct 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The nightly List vulnerable packages scan has failed since Oct 15 on two .NET DoS advisories against
System.Security.Cryptography.Pkcs9.0.4: GHSA-846f-f764-76mx (high) and GHSA-2fmv-rv2c-59x7 (moderate).Only
Sentry.DiagnosticSource.IntegrationTestson net10.0 is affected. It gets Pkcs transitively throughMicrosoft.EntityFrameworkCore.SqlServerandLocalDb, both viaMicrosoft.Data.SqlClient6.1.1. None of our shipped packages reference it.Upgrading EF Core wouldn't clear this. The latest SqlClient (6.1.7) still only requires Pkcs 9.0.11 or later on net9.0+, which is in the vulnerable range (≤ 9.0.20). So this PR pins Pkcs 10.0.13 in the net10.0 group, the same way
Azure.Identityis already pinned for net9.0. This is a test project with no consumers, so pinning costs nothing, and it's better than an allowlist entry that would outlive the problem.The SQL tests in this project only run on Windows (LocalDb), so the Windows job is the meaningful check.
#skip-changelog
🤖 Generated with Claude Code