From 34c0785a5c9fcb9cdeae153b746098d05fb388df Mon Sep 17 00:00:00 2001
From: Ivan Vydrin <ivan.vydrin@techfabric.com>
Date: Fri, 14 Aug 2026 04:26:06 +0300
Subject: [PATCH] Raise SSH.NET past the advisory Testcontainers drags in

`Testcontainers` 4.13.0 resolves `SSH.NET` 2025.1.0, which is GHSA-q939-rpr3-3284,
high severity: ScpClient's recursive download writes wherever a malicious server's
filenames point. Every restore has been reporting it as NU1903, on both target
frameworks. It is a test-only path and this repository does not treat warnings as
errors, so nothing was failing -- it was just being printed and ignored.

Patched in 2026.0.0, and 4.13.0 is Testcontainers' own latest release, so there is
nothing upstream to wait for.

Raised by referencing it directly from Healthie.Tests.Unit rather than by turning
on CentralPackageTransitivePinningEnabled. That switch pins one version of every
transitive package across the solution, which collides with the per-target-framework
Microsoft.Extensions.* versions this file deliberately keeps apart: enabling it
fails restore with 34 NU1109 downgrade errors. Verified both ways round.

`dotnet restore --locked-mode` and `dotnet build -c Release` now finish with no
warnings at all, where they previously printed two.
---
 Directory.Packages.props                      | 12 ++++++
 .../Healthie.Tests.Unit.csproj                |  1 +
 tests/Healthie.Tests.Unit/packages.lock.json  | 42 ++++++++++---------
 3 files changed, 35 insertions(+), 20 deletions(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index 067ffd4..baaa5ee 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -73,6 +73,18 @@
     <PackageVersion Include="Testcontainers.PostgreSql" Version="4.13.0" />
     <PackageVersion Include="Testcontainers.MsSql" Version="4.13.0" />
     <PackageVersion Include="Testcontainers.CosmosDb" Version="4.13.0" />
+    <!--
+      Referenced directly by Healthie.Tests.Unit purely to raise it. Testcontainers 4.13.0 resolves
+      SSH.NET 2025.1.0, which is GHSA-q939-rpr3-3284 (high): ScpClient's recursive download writes
+      wherever a malicious server's filenames point. Patched in 2026.0.0, and 4.13.0 is
+      Testcontainers' own latest, so there is nothing upstream to wait for.
+
+      A direct reference rather than CentralPackageTransitivePinningEnabled: that switch forces one
+      version of every transitive package across the whole solution, which collides head-on with the
+      per-target-framework Microsoft.Extensions.* versions above and fails restore with NU1109.
+      Drop this when Testcontainers resolves 2026.0.0 itself.
+    -->
+    <PackageVersion Include="SSH.NET" Version="2026.0.0" />
   </ItemGroup>
 
 </Project>
diff --git a/tests/Healthie.Tests.Unit/Healthie.Tests.Unit.csproj b/tests/Healthie.Tests.Unit/Healthie.Tests.Unit.csproj
index 49b2c01..6176a90 100644
--- a/tests/Healthie.Tests.Unit/Healthie.Tests.Unit.csproj
+++ b/tests/Healthie.Tests.Unit/Healthie.Tests.Unit.csproj
@@ -21,6 +21,7 @@
     <PackageReference Include="Testcontainers.PostgreSql" />
     <PackageReference Include="Testcontainers.MsSql" />
     <PackageReference Include="Testcontainers.CosmosDb" />
+    <PackageReference Include="SSH.NET" />
     <PackageReference Include="xunit.runner.visualstudio" />
   </ItemGroup>
 
diff --git a/tests/Healthie.Tests.Unit/packages.lock.json b/tests/Healthie.Tests.Unit/packages.lock.json
index 2a86fff..de1ac6c 100644
--- a/tests/Healthie.Tests.Unit/packages.lock.json
+++ b/tests/Healthie.Tests.Unit/packages.lock.json
@@ -31,6 +31,15 @@
         "resolved": "13.0.4",
         "contentHash": "pdgNNMai3zv51W5aq268sujXUyx7SNdE2bj1wZcWjAQrKMFZV260lbqYop1d2GM67JI1huLRwxo9ZqnfF/lC6A=="
       },
+      "SSH.NET": {
+        "type": "Direct",
+        "requested": "[2026.0.0, )",
+        "resolved": "2026.0.0",
+        "contentHash": "Yu9dirPq8l3oaat0+OQ7K0nUf5MmYltpia5UGqsApTG4zTPvBC1cxbNnC3NERij26dUST0A3Ef1QdHSn5ArbWQ==",
+        "dependencies": {
+          "BouncyCastle.Cryptography": "2.7.0"
+        }
+      },
       "Testcontainers.CosmosDb": {
         "type": "Direct",
         "requested": "[4.13.0, )",
@@ -116,8 +125,8 @@
       },
       "BouncyCastle.Cryptography": {
         "type": "Transitive",
-        "resolved": "2.6.2",
-        "contentHash": "7oWOcvnntmMKNzDLsdxAYqApt+AjpRpP2CShjMfIa3umZ42UQMvH0tl1qAliYPNYO6vTdcGMqnRrCPmsfzTI1w=="
+        "resolved": "2.7.0",
+        "contentHash": "U+12df8UEWHgBi04YVf/Lgi2dy3SItlIYvHjjEVa/BngCQIzDCDRBk50DDByCfDvSbe5pRNFr3b7UrVK2kMcLw=="
       },
       "Docker.DotNet.Enhanced": {
         "type": "Transitive",
@@ -399,14 +408,6 @@
           "SQLitePCLRaw.core": "2.1.12"
         }
       },
-      "SSH.NET": {
-        "type": "Transitive",
-        "resolved": "2025.1.0",
-        "contentHash": "jrnbtf0ItVaXAe6jE8X/kSLa6uC+0C+7W1vepcnRQB/rD88qy4IxG7Lf1FIbWmkoc4iVXv0pKrz+Wc6J4ngmHw==",
-        "dependencies": {
-          "BouncyCastle.Cryptography": "2.6.2"
-        }
-      },
       "System.ClientModel": {
         "type": "Transitive",
         "resolved": "1.1.0",
@@ -831,6 +832,15 @@
         "resolved": "13.0.4",
         "contentHash": "pdgNNMai3zv51W5aq268sujXUyx7SNdE2bj1wZcWjAQrKMFZV260lbqYop1d2GM67JI1huLRwxo9ZqnfF/lC6A=="
       },
+      "SSH.NET": {
+        "type": "Direct",
+        "requested": "[2026.0.0, )",
+        "resolved": "2026.0.0",
+        "contentHash": "Yu9dirPq8l3oaat0+OQ7K0nUf5MmYltpia5UGqsApTG4zTPvBC1cxbNnC3NERij26dUST0A3Ef1QdHSn5ArbWQ==",
+        "dependencies": {
+          "BouncyCastle.Cryptography": "2.7.0"
+        }
+      },
       "Testcontainers.CosmosDb": {
         "type": "Direct",
         "requested": "[4.13.0, )",
@@ -916,8 +926,8 @@
       },
       "BouncyCastle.Cryptography": {
         "type": "Transitive",
-        "resolved": "2.6.2",
-        "contentHash": "7oWOcvnntmMKNzDLsdxAYqApt+AjpRpP2CShjMfIa3umZ42UQMvH0tl1qAliYPNYO6vTdcGMqnRrCPmsfzTI1w=="
+        "resolved": "2.7.0",
+        "contentHash": "U+12df8UEWHgBi04YVf/Lgi2dy3SItlIYvHjjEVa/BngCQIzDCDRBk50DDByCfDvSbe5pRNFr3b7UrVK2kMcLw=="
       },
       "Docker.DotNet.Enhanced": {
         "type": "Transitive",
@@ -1312,14 +1322,6 @@
           "SQLitePCLRaw.core": "2.1.12"
         }
       },
-      "SSH.NET": {
-        "type": "Transitive",
-        "resolved": "2025.1.0",
-        "contentHash": "jrnbtf0ItVaXAe6jE8X/kSLa6uC+0C+7W1vepcnRQB/rD88qy4IxG7Lf1FIbWmkoc4iVXv0pKrz+Wc6J4ngmHw==",
-        "dependencies": {
-          "BouncyCastle.Cryptography": "2.6.2"
-        }
-      },
       "System.ClientModel": {
         "type": "Transitive",
         "resolved": "1.1.0",