Fix NU1903 by overriding SSH.NET to the patched release (task 206) #146

Merged

rob merged 2 commits from task-206-nu1903-ssh-net into main 2026-08-13 09:21:25 +00:00

Conversation 2 Commits 2 Files changed 3 +16

rob commented 2026-08-13 08:57:53 +00:00

Owner

Copy link

Task 206. dotnet restore fails on main itself: NU1903 on SSH.NET 2025.1.0 (GHSA-q939-rpr3-3284, high severity), pulled transitively by Testcontainers.PostgreSql (4.13.0, still latest — no newer Testcontainers exists yet to pick up a fix on its own). TreatWarningsAsErrors turns the audit warning into a hard error, so nothing restores, builds or tests on any branch.

Upgrade, not suppression. SSH.NET 2026.0.0 is out and is the advisory's own listed patched version (confirmed against the GHSA record, not inherited from an earlier check). Added as a direct PackageReference in the three affected projects — PlaceMark.Infrastructure.Tests, PlaceMark.E2E.Tests, PlaceMark.Api.Tests, the only ones referencing Testcontainers.PostgreSql — which overrides the transitive 2025.1.0 pull. No production project is affected; this project never uses SSH.NET directly or the remote-Docker-over-SSH transport it's for.

No NuGetAuditSuppress, no NoWarn, no TreatWarningsAsErrors change — the advisory is gone, not silenced.

No ADR: this is a routine transitive-dependency override picking up a published patch, not a suppression or an architecturally significant decision — nothing here is expensive to reverse or worth re-arguing later. ADR-0124 stays unclaimed.

Verified against main itself, not just this branch: restore and full solution build are clean with no NU1903. Full suite green, including PlaceMark.Infrastructure.Tests (320) and PlaceMark.Api.Tests (605) — the two heaviest Testcontainers users, confirming no runtime break from the SSH.NET major-version bump. 1802 total / 1788 passing / 14 skipped (E2E gated, PLACEMARK_RUN_E2E_TESTS unset locally). dotnet format --verify-no-changes clean.

Task 206. `dotnet restore` fails on `main` itself: `NU1903` on SSH.NET 2025.1.0 (GHSA-q939-rpr3-3284, high severity), pulled transitively by `Testcontainers.PostgreSql` (4.13.0, still latest — no newer Testcontainers exists yet to pick up a fix on its own). `TreatWarningsAsErrors` turns the audit warning into a hard error, so nothing restores, builds or tests on any branch. **Upgrade, not suppression.** SSH.NET 2026.0.0 is out and is the advisory's own listed patched version (confirmed against the GHSA record, not inherited from an earlier check). Added as a direct `PackageReference` in the three affected projects — `PlaceMark.Infrastructure.Tests`, `PlaceMark.E2E.Tests`, `PlaceMark.Api.Tests`, the only ones referencing `Testcontainers.PostgreSql` — which overrides the transitive 2025.1.0 pull. No production project is affected; this project never uses SSH.NET directly or the remote-Docker-over-SSH transport it's for. No `NuGetAuditSuppress`, no `NoWarn`, no `TreatWarningsAsErrors` change — the advisory is gone, not silenced. No ADR: this is a routine transitive-dependency override picking up a published patch, not a suppression or an architecturally significant decision — nothing here is expensive to reverse or worth re-arguing later. ADR-0124 stays unclaimed. Verified against `main` itself, not just this branch: restore and full solution build are clean with no NU1903. Full suite green, including `PlaceMark.Infrastructure.Tests` (320) and `PlaceMark.Api.Tests` (605) — the two heaviest Testcontainers users, confirming no runtime break from the SSH.NET major-version bump. 1802 total / 1788 passing / 14 skipped (E2E gated, `PLACEMARK_RUN_E2E_TESTS` unset locally). `dotnet format --verify-no-changes` clean.

rob added 1 commit 2026-08-13 08:57:53 +00:00

Override SSH.NET to 2026.0.0 in Testcontainers-referencing test projects 723760346c

rob reviewed 2026-08-13 09:05:37 +00:00

rob left a comment

Copy link

Verdict: changes needed

Checked against commit 7237603 (current PR head, matches CI #612, success, 5m6s — a real full run, not a fast restore failure).

Everything substantive checks out, independently, not just re-reading the PR body:

• Genuine fix, not a postdate. Fetched the advisory directly (GHSA-q939-rpr3-3284 / CVE-2026-48798): affected "≤ 2025.1.0", patched version listed as "2026.0.0" — exactly what's pinned.
• Runtime binary compatibility confirmed by actually running the suites, not just restoring: PlaceMark.Infrastructure.Tests (320) and PlaceMark.Api.Tests (605) both pass clean on this branch, real Testcontainers spin-up (~58-60s each), no MethodNotFoundException/TypeLoadException anywhere.
• Scope confirmed at the resolved-graph level, not just the source diff: dotnet list package --include-transitive shows SSH.NET resolves to 2026.0.0 in the three test projects and is entirely absent from every production project (PlaceMark.Infrastructure, PlaceMark.Api checked directly).
• Branch equals merge-with-main: origin/main is still exactly the PR's own merge-base (2405cf3), so what I built and tested is the merge. Full suite: 1802 total / 1788 passing / 14 skipped, matching the PR body's own count exactly. dotnet restore and dotnet format --verify-no-changes both clean with no flags, no bypass.

The one gap, and why it's worth a round trip rather than a suggestion: the added line in all three .csproj files is bare —

<PackageReference Include="SSH.NET" Version="2026.0.0" />

— no comment naming the advisory, why 2026.0.0 specifically, or what makes this removable later. Skipping the ADR is fine (this is squarely ADR-0001's own "choosing a library version is not an ADR" example), but the PR body's own reasoning needs to live in the file a future dotnet list package --outdated or dependency bump finds, not only in a merged PR description nobody reads again. One short comment above each of the three lines — advisory id, that 2026.0.0 is the advisory's own listed patch, and "remove once Testcontainers.PostgreSql depends on a patched SSH.NET itself" — closes it.

Nothing else to change.

Verdict: changes needed Checked against commit 7237603 (current PR head, matches CI #612, success, 5m6s — a real full run, not a fast restore failure). Everything substantive checks out, independently, not just re-reading the PR body: - **Genuine fix, not a postdate.** Fetched the advisory directly (GHSA-q939-rpr3-3284 / CVE-2026-48798): affected "≤ 2025.1.0", patched version listed as "2026.0.0" — exactly what's pinned. - **Runtime binary compatibility confirmed by actually running the suites**, not just restoring: `PlaceMark.Infrastructure.Tests` (320) and `PlaceMark.Api.Tests` (605) both pass clean on this branch, real Testcontainers spin-up (~58-60s each), no `MethodNotFoundException`/`TypeLoadException` anywhere. - **Scope confirmed at the resolved-graph level, not just the source diff**: `dotnet list package --include-transitive` shows SSH.NET resolves to 2026.0.0 in the three test projects and is entirely absent from every production project (`PlaceMark.Infrastructure`, `PlaceMark.Api` checked directly). - **Branch equals merge-with-main**: `origin/main` is still exactly the PR's own merge-base (2405cf3), so what I built and tested *is* the merge. Full suite: 1802 total / 1788 passing / 14 skipped, matching the PR body's own count exactly. `dotnet restore` and `dotnet format --verify-no-changes` both clean with no flags, no bypass. **The one gap, and why it's worth a round trip rather than a suggestion**: the added line in all three `.csproj` files is bare — ```xml <PackageReference Include="SSH.NET" Version="2026.0.0" /> ``` — no comment naming the advisory, why 2026.0.0 specifically, or what makes this removable later. Skipping the ADR is fine (this is squarely ADR-0001's own "choosing a library version is not an ADR" example), but the PR body's own reasoning needs to live in the file a future `dotnet list package --outdated` or dependency bump finds, not only in a merged PR description nobody reads again. One short comment above each of the three lines — advisory id, that 2026.0.0 is the advisory's own listed patch, and "remove once Testcontainers.PostgreSql depends on a patched SSH.NET itself" — closes it. Nothing else to change.

rob added 1 commit 2026-08-13 09:07:34 +00:00

Document the SSH.NET override's reason and removal condition ba7d917347

rob reviewed 2026-08-13 09:21:06 +00:00

rob left a comment

Copy link

Verdict: mergeable

Checked against commit ba7d917 (current PR head, matches CI #613, success, 5m8s).

• Diff since 7237603 is comment-only, on all three files — confirmed from the PR's own full diff and each file's addition count (Api.Tests +3, E2E.Tests +3, Infrastructure.Tests +10; the latter two comments cross-reference the former's own). The SSH.NET PackageReference line itself is byte-identical to what I verified at 7237603 in every file. Nothing else changed.
• Comment accuracy checked against the advisory fetch I did last round, plus a fresh check on the one claim I hadn't verified: fetched Testcontainers 4.13.0's own NuGet dependency list directly — SSH.NET (>= 2025.1.0) is a genuine direct dependency of Testcontainers itself (which Testcontainers.PostgreSql depends on), consistent with the comment's "arrives transitively" claim and with GitHub's own Testcontainers-dotnet issues describing SSH-based remote Docker connections as the (currently unsupported-in-practice) reason Docker.DotNet.Enhanced carries it. Every other claim in the comment — GHSA-q939-rpr3-3284, high severity, TreatWarningsAsErrors making NU1903 fatal, 2026.0.0 being the advisory's own listed patch rather than merely newest, and that no production project carries SSH.NET — matches what I independently confirmed last round exactly, not approximately.
• Rebuilt, reformatted and reran the full suite on this exact commit rather than trusting the diff alone: build clean, dotnet format --verify-no-changes clean, no flags. 1802 total / 1788 passing / 14 skipped — identical to the count confirmed at 7237603.

Did not redo the advisory range, runtime-compatibility or scope checks themselves, per your note — nothing since 7237603 could have touched them, and this diff confirms it.

Verdict: mergeable Checked against commit ba7d917 (current PR head, matches CI #613, success, 5m8s). - Diff since 7237603 is comment-only, on all three files — confirmed from the PR's own full diff and each file's addition count (Api.Tests +3, E2E.Tests +3, Infrastructure.Tests +10; the latter two comments cross-reference the former's own). The `SSH.NET` `PackageReference` line itself is byte-identical to what I verified at 7237603 in every file. Nothing else changed. - Comment accuracy checked against the advisory fetch I did last round, plus a fresh check on the one claim I hadn't verified: fetched Testcontainers 4.13.0's own NuGet dependency list directly — `SSH.NET (>= 2025.1.0)` is a genuine direct dependency of `Testcontainers` itself (which `Testcontainers.PostgreSql` depends on), consistent with the comment's "arrives transitively" claim and with GitHub's own Testcontainers-dotnet issues describing SSH-based remote Docker connections as the (currently unsupported-in-practice) reason `Docker.DotNet.Enhanced` carries it. Every other claim in the comment — GHSA-q939-rpr3-3284, high severity, `TreatWarningsAsErrors` making NU1903 fatal, 2026.0.0 being the advisory's own listed patch rather than merely newest, and that no production project carries SSH.NET — matches what I independently confirmed last round exactly, not approximately. - Rebuilt, reformatted and reran the full suite on this exact commit rather than trusting the diff alone: build clean, `dotnet format --verify-no-changes` clean, no flags. 1802 total / 1788 passing / 14 skipped — identical to the count confirmed at 7237603. Did not redo the advisory range, runtime-compatibility or scope checks themselves, per your note — nothing since 7237603 could have touched them, and this diff confirms it.

rob merged commit 99087dfe10 into main 2026-08-13 09:21:25 +00:00

rob deleted branch task-206-nu1903-ssh-net 2026-08-13 09:21:25 +00:00

rob referenced this pull request from a commit 2026-08-13 09:21:26 +00:00

Override SSH.NET to its patched version in the test projects (#146)

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

rob/PlaceMark!146

No description provided.