From 87f338ed683224a7d5e6b5e135e05048ae183dd5 Mon Sep 17 00:00:00 2001
From: Jannis <jannis@home>
Date: Sat, 17 Oct 2026 11:40:58 +0200
Subject: [PATCH] fix: bump ASP.NET Core/EF Core to 10.0.13 and pin vulnerable
 transitive packages

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 Directory.Packages.props | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index b24a548..672b1b7 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -1,13 +1,19 @@
 <Project>
   <PropertyGroup>
     <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
-    <CentralPackageTransitivePinningEnabled>false</CentralPackageTransitivePinningEnabled>
+    <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
     <AspireVersion>13.6.1</AspireVersion>
-    <AspNetCoreVersion>10.0.12</AspNetCoreVersion>
-    <EfCoreVersion>10.0.12</EfCoreVersion>
+    <AspNetCoreVersion>10.0.13</AspNetCoreVersion>
+    <EfCoreVersion>10.0.13</EfCoreVersion>
     <OpenTelemetryVersion>1.19.1</OpenTelemetryVersion>
   </PropertyGroup>
 
+  <ItemGroup Label="Transitive security pins">
+    <PackageVersion Include="System.Security.Cryptography.Pkcs" Version="$(AspNetCoreVersion)" />
+    <PackageVersion Include="System.Security.Cryptography.Xml" Version="$(AspNetCoreVersion)" />
+    <PackageVersion Include="MessagePack" Version="2.5.307" />
+  </ItemGroup>
+
   <ItemGroup Label="Aspire">
     <PackageVersion Include="Aspire.Hosting.SqlServer" Version="$(AspireVersion)" />
     <PackageVersion Include="Aspire.Hosting.Docker" Version="$(AspireVersion)" />