[s360-breeze-toolkit: SFI-ES5.2] Fix System.Security.Cryptography.Xml CVE-2026-47304

[Brad Flood (brflood)]

Summary

• Update System.Security.Cryptography.Xml from vulnerable 8.0.3 to patched 8.0.4.
• Cover both direct package declarations found in the repository.
• Address CVE-2026-47304 / Component Governance alert 15327091.

Validation

• XML manifest parsing passed for both projects.
• Semantic verification passed with 2/2 affected locations covered and no unrelated files changed.
• Local restore/build/test could not complete because NuGet.org access failed TLS and the enabled package proxy did not serve this package.
• Component Detection was unavailable in the local environment.

🔗 S360 action items

• SFI-ES5.2
  • Action Item Title(s):
    • CVE-2026-47304

---

🛠️ s360-breeze-toolkit · SFI-ES5.2 · run ac924d7c

KPI_Id	Skill Name	Skill Contact(s)
SFI-ES5.2	environment-probe-skill	Unknown — contact 1es-ai-native-eng@microsoft.com
SFI-ES5.2	alert-triage-skill	Unknown — contact 1es-ai-native-eng@microsoft.com
SFI-ES5.2	repo-analysis-skill	Unknown — contact 1es-ai-native-eng@microsoft.com
SFI-ES5.2	nuget-skill	Unknown — contact 1es-ai-native-eng@microsoft.com
SFI-ES5.2	verification-skill	Unknown — contact 1es-ai-native-eng@microsoft.com
SFI-ES5.2	component-detection-skill	Unknown — contact 1es-ai-native-eng@microsoft.com
SFI-ES5.2	traceline	alisonm
SFI-ES5.2	signal-sidecar-dispatch	jmprieur
SFI-ES5.2	remediation-review	jeferrie
SFI-ES5.2	generic-pr-quality-evaluator-github-skill	derekharris

[Brad Flood (brflood)]

[AI-Native] PR Code Quality Assessment

Quality: 🟠B
Effort to Merge: 🟢 Low
Skill/Agent: dependency-update-orchestrator | KPI: ES5.2 (Component Governance)

Code Quality

What's done well:

• Both direct System.Security.Cryptography.Xml declarations use the same patched 8.0.4 version, avoiding inconsistent dependency resolution.
• The two project-file-only edits are minimal, coherent, and contain no unrelated refactoring, incomplete markers, duplicate entries, or configuration placeholders.
• The feature branch and PR attribution remain scoped to the single Component Governance remediation.

Human decisions required:

• Confirm the repository CI can restore 8.0.4, build the affected projects, and pass their tests; local execution was blocked by package-feed TLS/connectivity.

Potential Issues

#	Issue	Severity	Risk
1	Restore, build, and tests have not completed in the authoring environment.	🟢 Human	A feed or compatibility problem would only surface in CI.
2	The PR body does not explicitly document the revert path.	🟡 Medium	Rollback is straightforward but should be stated for reviewer clarity.

Recommendations

1. Require green CI restore/build/test checks before merge.
2. If CI exposes a regression, revert commit �8213b1 to restore both package declarations together.

---

Assessment performed by generic-pr-quality-evaluator-github-skill | 2026-08-17T23:22:41Z