From d4d5e7c4c7a4ced98f1264dd28d2237a6f21318e Mon Sep 17 00:00:00 2001
From: tobias-tengler <45513122+tobias-tengler@users.noreply.github.com>
Date: Wed, 14 Oct 2026 13:57:21 +0000
Subject: [PATCH] Bump System.Security.Cryptography.Pkcs to the patched
versions
Addresses GHSA-846f-f764-76mx (CVE-2026-84008, high) and
GHSA-2fmv-rv2c-59x7 (CVE-2026-70162, moderate), both published on
2026-10-13. Each band moves to the first patched version only:
- net8.0: 8.0.1 -> 8.0.2
- net9.0: 9.0.8 -> 9.0.21
- net10.0: 10.0.0 -> 10.0.13
- net11.0: 11.0.0-rc.1.26425.128 -> 11.0.0-rc.2.26504.105
HotChocolate.Fusion.Packaging references the package directly and
flows the floor into every Fusion, Adapters and Nitro package. The
patched packages have no dependencies on their own band's framework,
so consumers get nothing beyond the raised floor.
---
src/Directory.Packages.props | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/src/Directory.Packages.props b/src/Directory.Packages.props
index 2cafb4d197d..85f1a953837 100644
--- a/src/Directory.Packages.props
+++ b/src/Directory.Packages.props
@@ -125,7 +125,7 @@
-
+
@@ -156,7 +156,7 @@
-
+
@@ -187,7 +187,7 @@
-
+
@@ -218,7 +218,7 @@
-
+