From 3b756934d4662e8a2903ad1a4b0eb058a2212b0d Mon Sep 17 00:00:00 2001
From: Karl Bauer <karl.bauer@bauer-group.com>
Date: Sat, 10 Oct 2026 02:45:33 +0200
Subject: [PATCH] fix(security): stopped the test restore from fetching
 SqlClient 4.7.0

The direct System.Data.SqlClient 4.9.1 reference in Desktop.Reporting
(9b620a0) fixed the resolved graph, but Dependabot alerts #3-#6 stayed
open. nuget.config puts the global packages folder at ./Packages, and
automatic dependency submission scans every nupkg/nuspec in it.

Restoring the test project still downloaded 4.7.0 into ./Packages
(CI restore log: GET .../system.data.sqlclient/4.7.0/...nupkg). The
NuGet resolver only skips a transitive dependency before fetching it
when the restored project itself references it directly; a direct
reference inside a ProjectReference does not count. 4.9.1 still won
resolution, so no build ever used 4.7.0 (no NU1903 warning).

* BAUERGROUP.Shared.Test references System.Data.SqlClient directly
  (central version 4.9.1), so Stimulsoft's request for 4.7.0 is
  skipped and never downloaded
* Test project only (IsPackable=false): no published package changes

Advisories (System.Data.SqlClient 4.7.0 -> 4.9.1 in ./Packages):
* GHSA-98g6-xh36-x2p7 (CVE-2024-0056, high) - alerts #4, #6
* GHSA-8g2p-5pqh-5jmc (CVE-2022-41064, moderate) - alerts #3, #5
---
 Directory.Packages.props                                   | 3 ++-
 tests/BAUERGROUP.Shared.Test/BAUERGROUP.Shared.Test.csproj | 7 +++++++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index 1bffca6..db7c449 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -39,7 +39,8 @@
     <PackageVersion Include="Microsoft.Win32.SystemEvents" Version="10.0.12" />
     <PackageVersion Include="System.Configuration.ConfigurationManager" Version="10.0.12" />
     <PackageVersion Include="System.Data.Odbc" Version="10.0.12" />
-    <!-- Direct reference only to lift the vulnerable 4.7.0 that Stimulsoft 2022.1.2 pulls in -->
+    <!-- Direct reference only to lift the vulnerable 4.7.0 that Stimulsoft 2022.1.2 pulls in
+         (Desktop.Reporting, plus the test project so its restore never fetches 4.7.0) -->
     <PackageVersion Include="System.Data.SqlClient" Version="4.9.1" />
 
     <PackageVersion Include="System.ServiceProcess.ServiceController" Version="10.0.12" />
diff --git a/tests/BAUERGROUP.Shared.Test/BAUERGROUP.Shared.Test.csproj b/tests/BAUERGROUP.Shared.Test/BAUERGROUP.Shared.Test.csproj
index a25776f..1d1247f 100644
--- a/tests/BAUERGROUP.Shared.Test/BAUERGROUP.Shared.Test.csproj
+++ b/tests/BAUERGROUP.Shared.Test/BAUERGROUP.Shared.Test.csproj
@@ -13,6 +13,13 @@
     <PackageReference Include="Moq" />
     <PackageReference Include="xunit" />
     <PackageReference Include="xunit.runner.visualstudio" />
+    <!-- Not used by the tests. NuGet only skips a transitive dependency without fetching it
+         when the project being restored references that package directly; a direct reference
+         in a ProjectReference (Desktop.Reporting) does not count. Without this line, restoring
+         this project downloads the vulnerable System.Data.SqlClient 4.7.0 that Stimulsoft
+         2022.1.2 requests into ./Packages, where the dependency graph reports it
+         (GHSA-98g6-xh36-x2p7, GHSA-8g2p-5pqh-5jmc), although 4.9.1 wins resolution. -->
+    <PackageReference Include="System.Data.SqlClient" />
   </ItemGroup>
 
   <ItemGroup>