Scripta-Qumranica-Electronica / SQE_API / 29772040127

83%

master: 83%

push

github

Update dependencies to clear all package vulnerabilities

Resolves every `dotnet list --vulnerable` finding (was 5 vulnerable packages
across the solution; now zero):

- MailKit 4.14.1 -> 4.17.0 (fixes MailKit + transitive MimeKit advisories)
- Replace deprecated Microsoft.AspNetCore.SignalR.Redis 1.2.0 (ASP.NET Core 2.x
  era; pulled the vulnerable MessagePack 1.7.3.7) with
  Microsoft.AspNetCore.SignalR.StackExchangeRedis 10.0.0; Startup now calls
  .AddStackExchangeRedis(redisConn) (same StackExchange.Redis connection string)
- Pin transitive MessagePack -> 2.5.302 (GHSA-hv8m-jj95-wg3x)
- Buildalyzer 7.1.0 -> 9.0.0 in the dev-only generator (fixes Microsoft.Build*
  High advisories); pin transitive System.Security.Cryptography.Xml -> 10.0.10
- Remove redundant refs flagged by NU1510: Microsoft.Extensions.Http
  (sqe-api-server) and System.Linq.AsyncEnumerable (sqe-database-access) — both
  provided by the net10 framework

Build clean (0 errors); full integration suite green (242/242). Remaining
warnings are 12x NU1608 (benign CodeAnalysis.VisualBasic version-alignment in
the dev-only generators; not a security or correctness issue).

NOTE: the test suite disables the emailer and the Redis backplane, so the
MailKit bump and the StackExchangeRedis migration need manual/production
validation (email delivery; Redis-backed SignalR).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

1533 of 2335 branches covered (65.65%)

Branch coverage included in aggregate %.

0 of 1 new or added line in 1 file covered. (0.0%)

12385 of 14469 relevant lines covered (85.6%)

25531.7 hits per line