chore(deps): patch vulnerable transitives (CVE-2026-33116, Scriban)#4
Merged
Conversation
Enable CPM transitive pinning and pin System.Security.Cryptography.Xml to 10.0.6 / 9.0.15 / 8.0.3 per TFM; bump Scriban 6.2.1 -> 7.1.0 to clear NU1901-NU1904 audit warnings. Add direct reference in _build.csproj since it opts out of central package management.
3 tasks
4 tasks
This was referenced May 21, 2026
ChrisonSimtian
added a commit
that referenced
this pull request
May 28, 2026
…uth (#260) Removes the 4-line `// Copyright ... Maintainers of Fallout. // Originally based on NUKE ...` block from 614 first-party .cs files under src/, tests/, build/, and the repo root. MIT compliance is already satisfied at the top level: - LICENSE preserves "Maintainers of NUKE 2017-2025" (matkoch's attribution) alongside "Maintainers of Fallout 2026". - README acknowledges the NUKE origin and links upstream. - Every NuGet package declares MIT via PackageLicenseExpression in Directory.Build.props. Vendored third-party code keeps its own copyright headers untouched - files under src/Persistence/Fallout.Persistence.Solution/ retain Microsoft's MIT notice as required, and the .Generated.cs tool wrappers + Verify snapshots keep their auto-generated headers. Rationale: - One source of truth is easier to maintain than 614 copies. - The header URL "github.com/ChrisonSimtian/Fallout/blob/main/LICENSE" would have rotted across hundreds of files the moment the repo transfers to the Fallout-build org (#11). - Cleaner source files; things live where they belong. - Housekeeping aligned with the rebrand cleanup. Convention docs updated to match: - AGENTS.md rule #4 replaced with explicit no-headers rule - docs/agents/conventions.md license-header bullet rewritten - docs/architecture.md mandate replaced with "no per-file headers" - CONTRIBUTING.md "license headers are mechanical" aside dropped Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Mirrors upstream PR nuke-build/nuke#1592 by @artnim. Credit and design belong to them — we're cherry-picking the head commit verbatim so we don't have to wait on upstream.
Closes #1.
System.Security.Cryptography.Xmltransitive pin per TFM (10.0.6/9.0.15/8.0.3) — clears CVE-2026-33116 (DoS inEncryptedXml) and CVE-2026-26171.Scriban6.2.1 → 7.1.0 — clears 1 critical + 5 high + 3 moderate advisories (critical = GHSA-5wr9-m6jw-xx44). Major version bump; still supportsnetstandard2.0.NuGet.Packaging6.12.1 → 6.14.3 (incidental).CentralPackageTransitivePinningEnabledinDirectory.Packages.props.PackageReferenceinbuild/_build.csproj(opts out of CPM).Test plan
dotnet restore nuke-common.slnx— 26/26 projectsdotnet build nuke-common.slnx— 0 errors, 10 pre-existing warningsdotnet test nuke-common.slnx— 391 passed, 0 failed, 7 skipped (CI-only)Nuke.SourceGenerators.Tests(Scriban 6→7 risk surface) — 3/3, no Verify snapshot drift🤖 Generated with Claude Code