fix(deps): pin SSH.NET to 2026.0.0 (CVE-2026-48798) - #1909
Merged
Aaronontheweb merged 1 commit intoAug 13, 2026
Conversation
Testcontainers 4.13.0 pulls SSH.NET 2025.1.0 as a transitive dependency, which is flagged by NuGetAudit as NU1903 (CVE-2026-48798 / GHSA-q939-rpr3-3284): a path traversal in ScpClient.Download recursive downloads, affecting versions <= 2025.1.0. Under our TreatWarningsAsErrors policy this fails restore/CI. Add a transitive pin for SSH.NET 2026.0.0 (the patched line) in Directory.Packages.props. CentralPackageTransitivePinningEnabled is already on, so this overrides the vulnerable 2025.1.0 wherever Testcontainers pulls it without adding SSH.NET to any project that does not already use it. 2026.0.0 still satisfies Testcontainers' >= 2025.1.0 constraint. SSH.NET is a test-only transitive dependency (integration-test projects only) with no runtime or shipped exposure. Validated: dotnet restore Netclaw.slnx succeeds with no NU1903, SSH.NET resolves to 2026.0.0 across all projects, the three affected test projects build clean, and the Testcontainers-backed daemon integration test passes.
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Add a transitive-dependency pin for SSH.NET
2026.0.0inDirectory.Packages.props.Why
CI restore currently fails with:
ScpClient.Download()recursive downloads, affecting SSH.NET<= 2025.1.0, patched in2026.0.0.Renci.SshNet, no directPackageReference). It arrives only as a transitive dependency ofTestcontainers 4.13.0(<dependency id="SSH.NET" version="2025.1.0" />, a>=minimum), so it lands solely in the integration-test projects (Netclaw.Daemon.IntegrationTests,Netclaw.Channels.Mattermost.IntegrationTests,Netclaw.Search.Tests). Test-only; no runtime or shipped exposure.TreatWarningsAsErrors+ NuGetAudit policy, the advisory fails restore.CentralPackageTransitivePinningEnabledis already enabled, so this single pin overrides the vulnerable2025.1.0wherever Testcontainers pulls it, without adding SSH.NET to any project that doesn't already use it.2026.0.0still satisfies Testcontainers'>= 2025.1.0constraint. Testcontainers is left untouched.How validated
dotnet restore Netclaw.slnxsucceeds and no longer emits NU1903 for SSH.NET.dotnet nuget whyconfirms SSH.NET resolves to2026.0.0(transitive viaTestcontainers 4.13.0) in all three affected test projects; a scan ofproject.assets.jsonshows onlySSH.NET/2026.0.0resolved anywhere (no2025.1.0remaining).Netclaw.Daemon.IntegrationTests,Netclaw.Channels.Mattermost.IntegrationTests,Netclaw.Search.Tests.2026.0.0in the graph — confirming the bump doesn't break Testcontainers at runtime.Scope
Single-line dependency pin plus its explanatory comment (matching the existing transitive-security-pin convention already used for
Microsoft.OpenApiandMessagePackin this file). No other changes.