From 0b1c96d450ae569c8aff04da0340a82e55b13d3c Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 13 Aug 2026 06:48:36 +0000 Subject: [PATCH] fix(deps): pin SSH.NET to 2026.0.0 to clear the transitive advisory MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Every backend build failed at restore: Proxytrace.Messaging.Tests.csproj : error NU1903: Warning As Error: Package 'SSH.NET' 2025.1.0 has a known high severity vulnerability NuGet's audit flags CVE-2026-48798 (GHSA-q939-rpr3-3284, high, CVSS 7.1) against every SSH.NET at or below 2025.1.0: ScpClient.Download() does not validate server-supplied filenames on a recursive download, so a malicious server can traverse out of the target directory. TreatWarningsAsErrors promotes the warning to an error, so one test project's transitive dependency failed the whole solution build — and with it every open pull request. The package is not referenced by any code here. It arrives as Testcontainers.Redis -> Docker.DotNet -> SSH.NET, because Docker.DotNet supports reaching a daemon over SSH, which this project's Testcontainers usage does not do. So the practical exposure is nil: test-only, never in a runtime image, no SCP anywhere. The build breakage was the whole problem. Testcontainers.Redis 4.13.0 is the newest release, so there is no upstream bump to take and the fix is a direct pin overriding the transitive resolution. Docker.DotNet's constraint is a lower bound, so 2026.0.0 satisfies it and no NU1608 is raised. Documented in docs/testing.md with the condition for removing it, in the same shape as the manual's Vite override. Verified without -p:NuGetAudit=false: restore and the solution build are clean, SSH.NET resolves to 2026.0.0 in project.assets.json, and the full backend suite passes (3,003 passed, 8 skipped, 0 failed). Note on coverage: Docker is unavailable in this environment, so the container-backed Redis tests skipped — the one path that actually exercises Docker.DotNet, and therefore the only place a major SSH.NET bump could plausibly bite, was not run locally. CI has Docker and sets PROXYTRACE_REQUIRE_DOCKER_TESTS=true, so those tests are hard-required there. No CHANGELOG entry: the dependency is test-only and ships in nothing. Closes #534 Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01VA7JB61dw77kiymoNoeGqt --- .../Proxytrace.Messaging.Tests.csproj | 17 ++++++++++++++ docs/testing.md | 23 +++++++++++++++++++ 2 files changed, 40 insertions(+) diff --git a/Proxytrace.Messaging.Tests/Proxytrace.Messaging.Tests.csproj b/Proxytrace.Messaging.Tests/Proxytrace.Messaging.Tests.csproj index 9a59a86f..9a759300 100644 --- a/Proxytrace.Messaging.Tests/Proxytrace.Messaging.Tests.csproj +++ b/Proxytrace.Messaging.Tests/Proxytrace.Messaging.Tests.csproj @@ -15,6 +15,23 @@ + + diff --git a/docs/testing.md b/docs/testing.md index d6efb86d..d8274a0b 100644 --- a/docs/testing.md +++ b/docs/testing.md @@ -112,6 +112,29 @@ container inside the test method — no shared fixture, same isolation rule as e and remember these cost seconds, not milliseconds. They are a targeted supplement to the mocked tests, not a replacement for them. +### The SSH.NET pin + +`Proxytrace.Messaging.Tests` carries a direct `PackageReference` to **SSH.NET 2026.0.0** for a +package no code here calls. It arrives transitively — `Testcontainers.Redis` → `Docker.DotNet` → +`SSH.NET`, because Docker.DotNet can reach a daemon over SSH — and every version at or below +**2025.1.0** carries [CVE-2026-48798](https://github.com/advisories/GHSA-q939-rpr3-3284) (high, +CVSS 7.1): `ScpClient.Download()` does not validate server-supplied filenames on a recursive +download, so a malicious server can traverse out of the target directory. + +The exposure is nil — it is a test-only dependency that never ships in a runtime image, and +nothing in this repository downloads over SCP. The *build* breakage was total: NuGet's audit +raises it as `NU1903`, `TreatWarningsAsErrors` promotes it to an error, and the whole solution +build fails, on every branch at once ([#534](https://github.com/NordsteinSoftware/Proxytrace/issues/534)). + +`Testcontainers.Redis` 4.13.0 is the newest release, so there was no upstream bump to take. Drop +the pin once one of its releases resolves SSH.NET ≥ 2026.0.0 on its own — check the transitive +graph with `dotnet list package` (including transitives), delete the line, and confirm +`dotnet restore` stays clean without it. + +This is the same shape as the manual's Vite override (see +[`commands.md`](commands.md#manual-toolchain-vitepress--the-vite-override)): a pin that exists +only to get ahead of a transitive advisory, and that should be deleted rather than maintained. + ## End-to-end tests (Playwright) The e2e suite (repo-root `e2e/`) boots the full stack via Docker Compose (`docker-compose.e2e.yml`).