[jas88]

NuGet.Packaging 7.0.3, pulled in transitively by Microsoft.CodeAnalysis.*.Testing 1.1.4, depends on System.Security.Cryptography.Pkcs 9.0.6, which has a known moderate vulnerability (GHSA-2fmv-rv2c-59x7). This fails restore of SharpDicom.Analyzers.Tests with NU1902 (warnings as errors).

Pins Pkcs to 10.0.13 in Directory.Packages.props and references it directly from the analyzer test project, matching the existing SQLite/SharpCompress pin pattern.

• Restore clean, no NU1902
• dotnet list package --vulnerable --include-transitive reports nothing
• Analyzer tests: 22/22 pass

---

Summary by cubic

Pins System.Security.Cryptography.Pkcs to 10.0.13 so restore of the analyzer test project no longer fails with NU1902 warnings-as-errors.

The vulnerable 9.0.6 version comes in transitively from NuGet.Packaging via the Microsoft.CodeAnalysis.*.Testing packages (GHSA-2fmv-rv2c-59x7).

• Adds the package version to Directory.Packages.props and references it directly from the test project, matching the existing SQLite/SharpCompress pin pattern.
• Restore is clean, dotnet list package --vulnerable --include-transitive reports nothing, and all 22 analyzer tests pass.

^{Written for commit 3ab1072. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 2 files

_{View guided diff | Turn on auto-fix | Re-trigger cubic}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 65.62%. Comparing base (d23d2da) to head (3ab1072).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #156      +/-   ##
==========================================
- Coverage   65.63%   65.62%   -0.01%     
==========================================
  Files         337      337              
  Lines       30420    30420              
  Branches     5710     5710              
==========================================
- Hits        19966    19964       -2     
  Misses       9035     9035              
- Partials     1419     1421       +2     

Flag	Coverage Δ
unittests	65.62% <ø> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.