From 3960beebddb71918f0a4f03bd3ba09330a348dcf Mon Sep 17 00:00:00 2001
From: Matthias Adorjan <adorjan@rmdatagroup.com>
Date: Thu, 15 Oct 2026 11:04:25 +0200
Subject: [PATCH] updated System.Security.Cryptography dependencies to
 non-vulnerable versions

---
 Directory.Packages.props | 9 ++++++---
 build/_build.csproj      | 2 +-
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index 680a195d2..683fc5865 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -67,7 +67,8 @@
     <PackageVersion Include="Microsoft.Extensions.DependencyModel" Version="10.0.0" />
     <PackageVersion Include="Microsoft.Build.Locator" Version="1.7.8" />
     <!-- Security-advisory pin; reaches us through Microsoft.Build. Per-framework versions below. -->
-    <PackageVersion Include="System.Security.Cryptography.Xml" Version="10.0.10" />
+    <PackageVersion Include="System.Security.Cryptography.Xml" Version="10.0.13" />
+	<PackageVersion Include="System.Security.Cryptography.Pkcs" Version="10.0.13" />
     <!-- Only reach netstandard2.0 consumers; part of the net10.0 framework -->
     <PackageVersion Include="System.Text.Json" Version="10.0.8" />
     <PackageVersion Include="System.Net.Http" Version="4.3.4" />
@@ -120,13 +121,15 @@
     <PackageVersion Update="Microsoft.Build.Framework" Version="17.14.28" />
     <PackageVersion Update="Microsoft.Build.Tasks.Core" Version="17.14.28" />
     <PackageVersion Update="Microsoft.Build.Utilities.Core" Version="17.14.28" />
-    <PackageVersion Update="System.Security.Cryptography.Xml" Version="9.0.18" />
+    <PackageVersion Update="System.Security.Cryptography.Xml" Version="9.0.21" />
+	<PackageVersion Update="System.Security.Cryptography.Pkcs" Version="9.0.21" />
   </ItemGroup>
   <ItemGroup Condition="'$(TargetFramework)' == 'net8.0'">
     <PackageVersion Update="Microsoft.Build" Version="17.11.48" />
     <PackageVersion Update="Microsoft.Build.Framework" Version="17.11.48" />
     <PackageVersion Update="Microsoft.Build.Tasks.Core" Version="17.11.48" />
     <PackageVersion Update="Microsoft.Build.Utilities.Core" Version="17.11.48" />
-    <PackageVersion Update="System.Security.Cryptography.Xml" Version="8.0.4" />
+    <PackageVersion Update="System.Security.Cryptography.Xml" Version="8.0.5" />
+	<PackageVersion Update="System.Security.Cryptography.Pkcs" Version="8.0.2" />
   </ItemGroup>
 </Project>
diff --git a/build/_build.csproj b/build/_build.csproj
index 223b2a052..20503d75d 100644
--- a/build/_build.csproj
+++ b/build/_build.csproj
@@ -53,7 +53,7 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.10" />
+    <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.13" />
     <!-- Nerdbank.GitVersioning lets us read ThisAssembly.AssemblyInformationalVersion in
          Build.cs as the canonical version source. Replaces GitVersion.Tool (#81). Direct
          dependency because _build.csproj turns off central package management. -->