From 224f0dfd08b71c4bf06155be10b29ed8d97e687f Mon Sep 17 00:00:00 2001
From: Igor Timarac <igor.timarac@codaxy.com>
Date: Tue, 20 Oct 2026 09:50:32 +0200
Subject: [PATCH] build(deps): pin System.Security.Cryptography.Pkcs

MimeKit pulls in 10.0.0, which has a high and a moderate
denial-of-service advisory (GHSA-846f-f764-76mx,
GHSA-2fmv-rv2c-59x7). Pin 10.0.13 in Web until MimeKit asks for a
fixed version; drop the reference then.
---
 server/Codaxy.Inventory.Web/Codaxy.Inventory.Web.csproj | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/server/Codaxy.Inventory.Web/Codaxy.Inventory.Web.csproj b/server/Codaxy.Inventory.Web/Codaxy.Inventory.Web.csproj
index 7b257bb..3e3a17c 100644
--- a/server/Codaxy.Inventory.Web/Codaxy.Inventory.Web.csproj
+++ b/server/Codaxy.Inventory.Web/Codaxy.Inventory.Web.csproj
@@ -34,6 +34,8 @@
     <PackageReference Include="Serilog.Extensions.Logging" Version="10.0.0" />
     <PackageReference Include="Serilog.Formatting.Compact" Version="3.0.0" />
     <PackageReference Include="Serilog.Sinks.File" Version="7.0.0" />
+    <!-- MimeKit asks for 10.0.0, which has denial-of-service advisories; drop once it asks for more. -->
+    <PackageReference Include="System.Security.Cryptography.Pkcs" Version="10.0.13" />
   </ItemGroup>
 
   <!-- Installs the pre-commit hook after restore, so a clone that builds the server has it. Runs again