From 423fcca723067e530e6d55c2b91d2623cccd7a83 Mon Sep 17 00:00:00 2001 From: mgravell Date: Wed, 9 Sep 2026 11:50:04 +0100 Subject: [PATCH] Bump SourceLink past CVE-2026-62900, and System.IO.Hashing with it NuGet audit started failing every build yesterday: error NU1902: Package 'Microsoft.Build.Tasks.Git' 10.0.201 has a known moderate severity vulnerability GHSA-23fw-v26w-5fgq was published on 2026-09-08. We pull Build.Tasks.Git transitively via Microsoft.SourceLink.GitHub, which was pinned at 10.0.201 - and the advisory lists the whole 10.0.200-10.0.204 band as affected with no patched version in that band, so there is nothing to move to inside it. Going to 10.0.401 takes us past every affected range. That in turn wants System.IO.Hashing 10.0.12, where we pinned 10.0.5, so without bumping that too the restore trades NU1902 for NU1605. Note this is consumer-visible: System.IO.Hashing is a real dependency of the library, so the floor it declares moves from 10.0.5 to 10.0.12 on every target framework. SourceLink itself is build-time only and stays out of the package's dependency groups. SourceLink 10.0.112 would have fixed the advisory without touching System.IO.Hashing at all - it has no dependency on it - but that means moving back a servicing band, so it is only the answer if the floor bump is unwelcome. --- Directory.Packages.props | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Directory.Packages.props b/Directory.Packages.props index 234266bb1..9c8577465 100644 --- a/Directory.Packages.props +++ b/Directory.Packages.props @@ -9,7 +9,7 @@ - + @@ -40,7 +40,7 @@ - +