fix(deps): patch vulnerable NuGet dependencies (v0.11.8) #84

Merged

joezombie merged 3 commits from security/v0.11.8-deps into main

2026-10-22 20:12:52 +00:00

joezombie commented

2026-10-22 20:00:20 +00:00

Owner

Security-only dependency update, released as v0.11.8 from this branch commit. See commit message for advisory mapping. Restore/vulnerable scan clean for Castr and Castr.Tests; build 0 warnings; 108/108 tests pass.

joezombie added 1 commit

2026-10-22 20:00:20 +00:00

fix(deps): patch vulnerable NuGet dependencies

Release / test (release) Successful in 1m6s

Details

Release / build-and-push (release) Successful in 1m18s

Details

4b9907c61e

Security-only dependency update; no source changes.

- Microsoft.AspNetCore.OpenApi 10.0.1 -> 10.0.13 (October 2026 servicing),
  which requires Microsoft.OpenApi [2.12.2, 3.0.0): resolves
  GHSA-v5pm-xwqc-g5wc / CVE-2026-49451 (Microsoft.OpenApi <= 2.7.4).
- Microsoft.AspNetCore.SignalR.Client 10.0.1 -> 10.0.13: pulls
  SignalR.Common 10.0.13, resolving GHSA-334f-vvp4-7g6p / CVE-2026-70159
  in the non-web test graph (the web app takes it from the shared framework).
- Pin AngleSharp 1.5.0 (transitive via YoutubeExplode 6.5.6, which needs
  >= 1.3.0): GHSA-pgww-w46g-26qg / CVE-2026-54570.
- Pin SQLitePCLRaw.bundle_e_sqlite3 2.1.14 (same 2.1 line required by
  Microsoft.Data.Sqlite 9.0.0): lib.e_sqlite3 2.1.10 bundled SQLite 3.46.1,
  vulnerable to GHSA-2m69-gcr7-jv3q / CVE-2025-6965 (fixed in SQLite
  3.50.2); 2.1.14 bundles SQLite 3.54.0.

`dotnet list package --vulnerable --include-transitive` is clean for Castr
and Castr.Tests; build 0 warnings; 108/108 tests pass.

joezombie added 1 commit

2026-10-22 20:07:25 +00:00

docs: point DEPLOYMENT.md image at forgejo.ht2.io registry 681ca8af86

release.yml has pushed to forgejo.ht2.io since #83; the production image row
still named ghcr.io.

joezombie added 1 commit

2026-10-22 20:12:43 +00:00

docs: point registry and release docs at Forgejo deb098a31f

release.yml has published to forgejo.ht2.io via Forgejo Actions since #83.
Update README, CLAUDE.md, CONFIGURATION.md and the example compose image to
forgejo.ht2.io/joezombie/castr, and replace the gh release/run commands in
DEPLOYMENT.md with the fj equivalents.

joezombie merged commit 604238013d into main

2026-10-22 20:12:52 +00:00

joezombie referenced this pull request from a commit

2026-10-22 20:12:54 +00:00

Merge pull request 'fix(deps): patch vulnerable NuGet dependencies (v0.11.8)' (#84) from security/v0.11.8-deps into main