From 1698d00f1b4eaf9b5c270c6ceb95e135fd130c7b Mon Sep 17 00:00:00 2001
From: Thorsten Sommer <SommerEngineering@users.noreply.github.com>
Date: Tue, 4 Aug 2026 08:10:23 +0200
Subject: [PATCH] Fixed a vulnerable transitive NuGet dependency in the build
 script

---
 app/Build/Build Script.csproj | 3 +++
 app/Directory.Build.props     | 8 ++++++++
 2 files changed, 11 insertions(+)
 create mode 100644 app/Directory.Build.props

diff --git a/app/Build/Build Script.csproj b/app/Build/Build Script.csproj
index 5694b509..5a184f2d 100644
--- a/app/Build/Build Script.csproj	
+++ b/app/Build/Build Script.csproj	
@@ -12,6 +12,9 @@
 
     <ItemGroup>
       <PackageReference Include="Cocona" Version="2.2.0" />
+
+      <!-- Pins Cocona's transitive Microsoft.Extensions.Hosting 6.0.0, which pulled in the vulnerable System.Text.Json 6.0.0 (GHSA-8g4q-xg66-9fp4) -->
+      <PackageReference Include="Microsoft.Extensions.Hosting" Version="9.0.18" />
     </ItemGroup>
 
     <ItemGroup>
diff --git a/app/Directory.Build.props b/app/Directory.Build.props
new file mode 100644
index 00000000..a3c7e870
--- /dev/null
+++ b/app/Directory.Build.props
@@ -0,0 +1,8 @@
+<Project>
+
+    <PropertyGroup>
+        <!-- Audit direct and transitive packages, so vulnerable transitive dependencies surface during restore instead of only in the IDE -->
+        <NuGetAuditMode>all</NuGetAuditMode>
+    </PropertyGroup>
+
+</Project>
\ No newline at end of file