From 3ba019fe832e5eb606609f84f237e4da6a03fc3d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lu=C3=ADs=20Amorim?= <lgamorim@users.noreply.github.com>
Date: Thu, 13 Aug 2026 01:24:49 +0100
Subject: [PATCH] Override vulnerable transitive SSH.NET with 2026.0.0 in
 integration tests

CI restore fails with NU1903 (warnings-as-errors) because Testcontainers
4.13.0 transitively pulls SSH.NET 2025.1.0, which has a known
high-severity vulnerability (GHSA-q939-rpr3-3284, path traversal in
ScpClient recursive download, patched in 2026.0.0). No Testcontainers
release depends on the patched version yet (4.13.0 is latest), so add a
direct SSH.NET 2026.0.0 reference to the four affected integration-test
projects to lift the resolved version. Remove once Testcontainers
depends on SSH.NET >= 2026.0.0.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../SqlBound.Cli.IntegrationTests.csproj                       | 3 +++
 .../SqlBound.MySql.IntegrationTests.csproj                     | 3 +++
 .../SqlBound.Npgsql.IntegrationTests.csproj                    | 3 +++
 .../SqlBound.SqlServer.IntegrationTests.csproj                 | 3 +++
 4 files changed, 12 insertions(+)

diff --git a/test/SqlBound.Cli.IntegrationTests/SqlBound.Cli.IntegrationTests.csproj b/test/SqlBound.Cli.IntegrationTests/SqlBound.Cli.IntegrationTests.csproj
index 607b9d6..c3af069 100644
--- a/test/SqlBound.Cli.IntegrationTests/SqlBound.Cli.IntegrationTests.csproj
+++ b/test/SqlBound.Cli.IntegrationTests/SqlBound.Cli.IntegrationTests.csproj
@@ -21,6 +21,9 @@
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.7.0" />
+    <!-- Overrides the vulnerable SSH.NET 2025.1.0 pulled in transitively by Testcontainers
+         (GHSA-q939-rpr3-3284); remove once Testcontainers depends on SSH.NET >= 2026.0.0. -->
+    <PackageReference Include="SSH.NET" Version="2026.0.0" />
     <PackageReference Include="Testcontainers.MsSql" Version="4.13.0" />
     <PackageReference Include="Testcontainers.MySql" Version="4.13.0" />
     <PackageReference Include="Testcontainers.PostgreSql" Version="4.13.0" />
diff --git a/test/SqlBound.MySql.IntegrationTests/SqlBound.MySql.IntegrationTests.csproj b/test/SqlBound.MySql.IntegrationTests/SqlBound.MySql.IntegrationTests.csproj
index 3b65b88..7780aa7 100644
--- a/test/SqlBound.MySql.IntegrationTests/SqlBound.MySql.IntegrationTests.csproj
+++ b/test/SqlBound.MySql.IntegrationTests/SqlBound.MySql.IntegrationTests.csproj
@@ -19,6 +19,9 @@
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.7.0" />
+    <!-- Overrides the vulnerable SSH.NET 2025.1.0 pulled in transitively by Testcontainers
+         (GHSA-q939-rpr3-3284); remove once Testcontainers depends on SSH.NET >= 2026.0.0. -->
+    <PackageReference Include="SSH.NET" Version="2026.0.0" />
     <PackageReference Include="Testcontainers.MySql" Version="4.13.0" />
     <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
diff --git a/test/SqlBound.Npgsql.IntegrationTests/SqlBound.Npgsql.IntegrationTests.csproj b/test/SqlBound.Npgsql.IntegrationTests/SqlBound.Npgsql.IntegrationTests.csproj
index c515867..159c4f6 100644
--- a/test/SqlBound.Npgsql.IntegrationTests/SqlBound.Npgsql.IntegrationTests.csproj
+++ b/test/SqlBound.Npgsql.IntegrationTests/SqlBound.Npgsql.IntegrationTests.csproj
@@ -19,6 +19,9 @@
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.7.0" />
+    <!-- Overrides the vulnerable SSH.NET 2025.1.0 pulled in transitively by Testcontainers
+         (GHSA-q939-rpr3-3284); remove once Testcontainers depends on SSH.NET >= 2026.0.0. -->
+    <PackageReference Include="SSH.NET" Version="2026.0.0" />
     <PackageReference Include="Testcontainers.PostgreSql" Version="4.13.0" />
     <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
diff --git a/test/SqlBound.SqlServer.IntegrationTests/SqlBound.SqlServer.IntegrationTests.csproj b/test/SqlBound.SqlServer.IntegrationTests/SqlBound.SqlServer.IntegrationTests.csproj
index 4dd34dd..a3940a3 100644
--- a/test/SqlBound.SqlServer.IntegrationTests/SqlBound.SqlServer.IntegrationTests.csproj
+++ b/test/SqlBound.SqlServer.IntegrationTests/SqlBound.SqlServer.IntegrationTests.csproj
@@ -19,6 +19,9 @@
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.7.0" />
+    <!-- Overrides the vulnerable SSH.NET 2025.1.0 pulled in transitively by Testcontainers
+         (GHSA-q939-rpr3-3284); remove once Testcontainers depends on SSH.NET >= 2026.0.0. -->
+    <PackageReference Include="SSH.NET" Version="2026.0.0" />
     <PackageReference Include="Testcontainers.MsSql" Version="4.13.0" />
     <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>