fix(deps): pin AngleSharp 1.4.0 → 1.5.2 to resolve GHSA-pgww-w46g-26qg (#18), release v1.1.1

[moisesja]

Closes #18.

Problem

The build fails under TreatWarningsAsErrors=true with NU1902: AngleSharp 1.4.0 carries the moderate-severity advisory GHSA-pgww-w46g-26qg (annotation-xml elements), fixed in AngleSharp 1.5.0+.

AngleSharp is not referenced directly anywhere — it arrives transitively through the opt-in RDFC library:

Credentials.Rdfc → DataProofsDotnet.Rdfc → dotNetRdf.Core 3.5.1 → AngleSharp 1.4.0

Because of that single chain, the advisory surfaces in every project downstream of Credentials.Rdfc — not just the two the issue names. Credentials.Core / Credentials.Extensions.DependencyInjection are clean (they don't reference Rdfc).

Fix

A single security-forcing pin at the source:

• Directory.Packages.props — declare AngleSharp 1.5.2 centrally (CPM).
• Credentials.Rdfc.csproj — add a versionless direct PackageReference in the one project that owns the dotNetRDF chain; the promotion flows to every downstream project.

1.5.2 is the latest patch on the 1.5 line and >= dotNetRdf.Core 3.5.1's AngleSharp floor. Chosen over solution-wide CentralPackageTransitivePinningEnabled (which pins every centrally-versioned transitive) so the blast radius is only AngleSharp, only in the Rdfc subtree.

This is a dependency-only change with no public API delta.

Release v1.1.1

• Directory.Build.props — CredentialsVersion 1.1.0 → 1.1.1.
• CHANGELOG.md — v1.1.1 Security entry.

release.yml is tag-driven (version derived from the pushed tag), so no workflow edit is needed — publishing 1.1.1 is triggered by pushing tag v1.1.1 after merge.

Verification (all green, locally)

• dotnet list … --vulnerable --include-transitive: 0 vulnerable packages across all 29 projects (was AngleSharp 1.4.0 in the Rdfc subtree). Credentials.Rdfc and Credentials.Conformance.VcApi (both named in the issue) confirmed clean, resolving AngleSharp 1.5.2.
• dotnet build -c Release: 0 warnings / 0 errors (NU1902 gone).
• dotnet test --filter "Category!=Conformance": all pass — Core 172, DI 161, Rdfc 21, RoundTrip 9, SampleSmoke 14, Interop 5, Architecture 9. The Rdfc/RoundTrip suites exercise the dotNetRDF canonicalization path against AngleSharp 1.5.2 → runtime-compatible.
• tools/check-no-newtonsoft-closure.sh: NFR-002 OK (default closure Newtonsoft-free; unaffected).
• tools/check-api-compat.sh: no breaking changes for Core / DI / Rdfc vs the published 1.1.0 baseline.
• dotnet pack -p:CredentialsVersion=1.1.1: all 3 packages + snupkg pack; the Rdfc nuspec declares <dependency id="AngleSharp" version="1.5.2" />.

🤖 Generated with Claude Code

[moisesja]

Reviewed the diff and independently checked the two claims that matter most for a security-pin PR:

• Compatibility floor: dotNetRdf.Core 3.5.1's NuGet metadata declares AngleSharp: [1.4.0, ) (no upper bound), so 1.5.2 satisfies it cleanly — confirms the "≥ dotNetRDF's floor" claim in the PR body.
• No breaking changes 1.4.0 → 1.5.2: AngleSharp's 1.5.0 and 1.5.2 release notes are bug-fix/spec-compliance only (the GHSA-pgww-w46g-26qg fix, DOM Range/NodeIterator corrections, SVG style detection) — nothing that should affect dotNetRDF's usage surface, consistent with the green Rdfc/RoundTrip canonicalization test runs reported.

Scope is tight and well-targeted: single CPM version pin (Directory.Packages.props) + a versionless PackageReference at the one project that actually owns the dotNetRDF chain (Credentials.Rdfc), rather than a blanket CentralPackageTransitivePinningEnabled or per-project pins. Directory.Build.props version bump and CHANGELOG.md entry are consistent with a patch release. Confirmed release.yml is genuinely tag-driven (version=${GITHUB_REF_NAME#v}), so no workflow changes are needed to ship this, as claimed.

One nit, non-blocking: tasks/todo-2026-07-20-issue-18-anglesharp.md references a local absolute path (/Users/moises/.claude/plans/floofy-knitting-wall.md) that won't resolve for anyone else — harmless since it's just a planning artifact, but worth dropping or making relative in future task docs.

No test/critical-path/scope concerns. Would approve if I weren't the PR author's own review restriction — looks good to merge (CI pending as of this review).

---

Generated by Claude Code