Skip to content

Bump System.Security.Cryptography.Pkcs and System.Security.Cryptography.Xml - #218

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/nuget/src/Equinox.Infra.Data/multi-731f27cd06
Open

Bump System.Security.Cryptography.Pkcs and System.Security.Cryptography.Xml#218
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/nuget/src/Equinox.Infra.Data/multi-731f27cd06

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 14, 2026

Copy link
Copy Markdown

Updated System.Security.Cryptography.Pkcs from 9.0.3 to 9.0.15.

Release notes

Sourced from System.Security.Cryptography.Pkcs's releases.

9.0.15

Release

9.0.14

Release

9.0.13

Release

What's Changed

Full Changelog: dotnet/runtime@v9.0.12...v9.0.13

9.0.12

Release

9.0.11

Release

What's Changed

Full Changelog: dotnet/runtime@v9.0.10...v9.0.11

9.0.10

Release

What's Changed

Full Changelog: dotnet/runtime@v9.0.9...v9.0.10

9.0.9

Release

What's Changed

Full Changelog: dotnet/runtime@v9.0.8...v9.0.9

9.0.8

Release

What's Changed

Full Changelog: dotnet/runtime@v9.0.7...v9.0.8

9.0.7

Release

What's Changed

Full Changelog: dotnet/runtime@v9.0.6...v9.0.7

9.0.6

Bug Fixes

  • Read messages from binlog if process output is missing build finished message (#​114676)
    Improves reliability of the WebAssembly build process by reading messages from the binlog when the process output does not contain the expected build finished message, preventing build failures in certain scenarios.

  • Fix debugger app hangs related to thread exit (#​114917)
    Resolves an issue where applications could hang during debugging when threads exit, ensuring smoother debugging experiences and preventing deadlocks.

  • [Mono] Workaround MSVC miscompiling sgen_clz (#​114903)
    Addresses a compiler miscompilation issue in MSVC affecting the Mono garbage collector, improving runtime stability and correctness on affected platforms.

  • Do not set the salt or info if they are NULL for OpenSSL HKDF (#​114877)
    Fixes a cryptographic issue by ensuring that the salt or info parameters are not set when they are NULL in OpenSSL HKDF, preventing potential errors or unexpected behavior in key derivation.

  • [Test Only] Fix Idn tests (#​115032)
    Corrects issues in Internationalized Domain Name (Idn) tests, ensuring accurate and reliable test results for domain name handling.

  • JIT: revised fix for fp division issue in profile synthesis (#​115026)
    Provides a more robust fix for floating-point division issues in JIT profile synthesis, improving numerical accuracy and preventing incorrect calculations.

  • Handle OSSL 3.4 change to SAN:othername formatting (#​115361)
    Updates certificate handling to accommodate changes in Subject Alternative Name (SAN) formatting introduced in OpenSSL 3.4, ensuring compatibility and correct parsing of certificates.

  • [Mono] Fix c11 ARM64 atomics to issue full memory barrier (#​115635)
    Fixes atomic operations on ARM64 in Mono to issue a full memory barrier, ensuring correct synchronization and preventing subtle concurrency bugs.

Performance Improvements

  • [WinHTTP] Certificate caching on WinHttpHandler to eliminate extra call to Custom Certificate Validation (#​114678)
    Improves HTTP performance by caching certificates in WinHttpHandler, reducing redundant calls to custom certificate validation and speeding up secure connections.

  • Improve distribute_free_regions (#​115167)
    Optimizes memory management by enhancing the algorithm for distributing free memory regions, leading to better memory utilization and potentially improved application performance.

Technical Improvements

  • Strip trailing slash from source dir for cmake4 (#​114905)
    Refines build scripts by removing trailing slashes from source directories when using CMake 4, preventing potential build path issues and improving build reliability.

  • Don't expose TrustedCertificatesDirectory() and StartNewTlsSessionContext() to NetFx (#​114995)
    Restricts certain internal APIs from being exposed to .NET Framework, reducing surface area and preventing unintended usage.

  • Add support for more libicu versions (#​115376)
    Expands compatibility by supporting additional versions of the International Components for Unicode (ICU) library, enhancing globalization features across more environments.

Infrastructure

  • Run outerloop pipeline only for release branches, not staging/preview (#​115011)
    Optimizes CI/CD resources by limiting the outerloop pipeline to run only on release branches, reducing unnecessary test runs and speeding up development workflows.

... (truncated)

9.0.5

Release

What's Changed

9.0.4

Release

What's Changed

Full Changelog: dotnet/runtime@v9.0.3...v9.0.4

Commits viewable in compare view.

Updated System.Security.Cryptography.Xml from 9.0.13 to 9.0.15.

Release notes

Sourced from System.Security.Cryptography.Xml's releases.

9.0.15

Release

9.0.14

Release

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump System.Security.Cryptography.Pkcs and System.Security.Cryptograp…
48777a1 
…hy.Xml

Bumps System.Security.Cryptography.Pkcs from 9.0.3 to 9.0.15
Bumps System.Security.Cryptography.Xml from 9.0.13 to 9.0.15

---
updated-dependencies:
- dependency-name: System.Security.Cryptography.Pkcs
  dependency-version: 9.0.15
  dependency-type: direct:production
- dependency-name: System.Security.Cryptography.Xml
  dependency-version: 9.0.15
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code labels Apr 14, 2026
jloor added a commit to jloor/equinox-jsxcore that referenced this pull request Aug 6, 2026
@jloor
Draft two upstream contributions to EquinoxProject
a3d3483 
Both verified against pristine upstream (fde9a95), not just this fork.

1. Comment on stalled Dependabot PR EduardoPires#218: it bumps the crypto packages
   to 9.0.15, which still carries 5 of the 8 high-severity advisories.
   9.0.18 clears all of them. Measured by restoring and collecting
   distinct NU1903 advisory ids at each version.

2. Issue for unconditional Facebook/Google registration: options are
   validated lazily, so an app with no social credentials starts
   cleanly and then 500s on every request, including inside the error
   handler. appsettings.json has no Authentication section at all.

Repro for EduardoPires#2 deliberately isolates social auth from the database -
running master in a non-Development environment crashes earlier on the
SQL Server/SQLite provider mismatch, which would obscure the bug.

Neither posted yet.
@jloor

jloor commented Aug 6, 2026

Copy link
Copy Markdown

Heads up that this bump doesn't fully clear the advisories — 9.0.15 is the first patched
version for one of them, but five others apply to that release too.

Measured against master (fde9a95) by restoring Equinox.Infra.Data and collecting the
distinct NU1903 advisory IDs:

System.Security.Cryptography.Xml Distinct high-severity advisories
9.0.3 (current master) 8
9.0.15 (this PR) 5
9.0.18 0

Still present at 9.0.15:

GHSA-23rf-6693-g89p
GHSA-8q5v-6pqq-x66h
GHSA-cvvh-rhrc-wg4q
GHSA-g8r8-53c2-pm3f
GHSA-mmjf-rqrv-855v

Bumping the same two packages to 9.0.18 restores cleanly and reports zero advisories.
System.Formats.Asn1 does not need to change — I checked, since Xml and Pkcs have
a version constraint between them:

-<PackageReference Include="System.Security.Cryptography.Pkcs" Version="9.0.3" />
-<PackageReference Include="System.Security.Cryptography.Xml" Version="9.0.3" />
+<PackageReference Include="System.Security.Cryptography.Pkcs" Version="9.0.18" />
+<PackageReference Include="System.Security.Cryptography.Xml" Version="9.0.18" />

One caveat worth knowing: bumping Xml alone fails the restore rather than warning,
because the project treats NU1605 as an error:

error NU1605: Detected package downgrade: System.Security.Cryptography.Pkcs from 9.0.18 to 9.0.3
  Equinox.Infra.Data -> System.Security.Cryptography.Xml 9.0.18 -> Pkcs (>= 9.0.18)
  Equinox.Infra.Data -> System.Security.Cryptography.Pkcs (>= 9.0.3)

Both have to move together, which this PR already does — it just needs the higher version.

To reproduce:

git clone --depth 1 https://github.com/EduardoPires/EquinoxProject.git
cd EquinoxProject
sed -i 's|Cryptography.Pkcs" Version="9.0.3"|Cryptography.Pkcs" Version="9.0.18"|; \
        s|Cryptography.Xml" Version="9.0.3"|Cryptography.Xml" Version="9.0.18"|' \
    src/Equinox.Infra.Data/Equinox.Infra.Data.csproj
dotnet restore src/Equinox.Infra.Data/Equinox.Infra.Data.csproj 2>&1 | grep -oP 'advisories/\K\S+' | sort -u
# no output at 9.0.18; five GHSA ids at 9.0.15

Separately — and probably why this went unnoticed — CI on master currently can't run:
.github/workflows/dotnet-core.yml uses actions/checkout@v2 and actions/setup-dotnet@v1,
both of which now fail on GitHub-hosted runners. Happy to open a separate PR bumping those
to @v4 if that's useful.

Thanks for the project — I've been using it as the base for a view-engine migration
experiment and it's been a genuinely good reference codebase to work in.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jloor