From 3ab1072518f5608c8a2c0767af0cfcc9958c8481 Mon Sep 17 00:00:00 2001
From: James A Sutherland <j@sutherland.pw>
Date: Tue, 20 Oct 2026 10:49:26 -0500
Subject: [PATCH] Pin System.Security.Cryptography.Pkcs to 10.0.13
 (GHSA-2fmv-rv2c-59x7)

NuGet.Packaging 7.0.3, pulled in transitively by the analyzer testing
packages, depends on the vulnerable Pkcs 9.0.6, failing restore with NU1902.
---
 Directory.Packages.props                                        | 2 ++
 .../SharpDicom.Analyzers.Tests.csproj                           | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index 73da463c..dd74b353 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -36,6 +36,8 @@
     <!-- Analyzer Testing (pinned to match Microsoft.CodeAnalysis.CSharp 5.0.0) -->
     <PackageVersion Include="Microsoft.CodeAnalysis.CSharp.Analyzer.Testing" Version="1.1.4" />
     <PackageVersion Include="Microsoft.CodeAnalysis.CSharp.CodeFix.Testing" Version="1.1.4" />
+    <!-- Pin vulnerable transitive dep of NuGet.Packaging via analyzer testing packages (GHSA-2fmv-rv2c-59x7) -->
+    <PackageVersion Include="System.Security.Cryptography.Pkcs" Version="10.0.13" />
     <!-- MongoDB Integration (v3.x targets netstandard2.1/net6.0+, NOT netstandard2.0) -->
     <PackageVersion Include="MongoDB.Driver" Version="3.12.0" />
     <!-- Pin vulnerable transitive deps of MongoDB.Driver (GHSA-6c8g-7p36-r338, GHSA-pggp-6c3x-2xmx) -->
diff --git a/tests/SharpDicom.Analyzers.Tests/SharpDicom.Analyzers.Tests.csproj b/tests/SharpDicom.Analyzers.Tests/SharpDicom.Analyzers.Tests.csproj
index 98130eb5..1b01a328 100644
--- a/tests/SharpDicom.Analyzers.Tests/SharpDicom.Analyzers.Tests.csproj
+++ b/tests/SharpDicom.Analyzers.Tests/SharpDicom.Analyzers.Tests.csproj
@@ -31,6 +31,8 @@
     -->
     <PackageReference Include="Microsoft.CodeAnalysis.CSharp" />
     <PackageReference Include="Microsoft.CodeAnalysis.CSharp.Workspaces" />
+    <!-- Override vulnerable System.Security.Cryptography.Pkcs 9.0.6 from NuGet.Packaging (GHSA-2fmv-rv2c-59x7) -->
+    <PackageReference Include="System.Security.Cryptography.Pkcs" />
   </ItemGroup>
 
   <ItemGroup>