diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3a0bc45..cdd7c3f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,25 @@ All notable changes to `credentials-dotnet` are documented here. The format is b
[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to
[Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+## v1.1.1 - 7/20/2026
+
+### Security
+
+- **AngleSharp transitive dependency bumped `1.4.0` → `1.5.2`**
+ ([#18](https://github.com/moisesja/credentials-dotnet/issues/18)) to resolve the moderate-severity
+ advisory [GHSA-pgww-w46g-26qg](https://github.com/advisories/GHSA-pgww-w46g-26qg) (annotation-xml
+ elements). AngleSharp is not a first-party dependency — it arrives only through the opt-in RDFC
+ library's `dotNetRDF` chain (`Credentials.Rdfc` → `DataProofsDotnet.Rdfc` → `dotNetRdf.Core` →
+ `AngleSharp`), so with `TreatWarningsAsErrors` the `NU1902` audit warning failed the build for every
+ project downstream of `Credentials.Rdfc`. The fix is a single security-forcing pin: AngleSharp's
+ version is declared centrally (`Directory.Packages.props`) and a direct `PackageReference` is added
+ only in `Credentials.Rdfc` (the sole owner of the `dotNetRDF` chain), which promotes the resolved
+ version to `1.5.2` across all downstream projects. `1.5.2` satisfies `dotNetRdf.Core 3.5.1`'s
+ AngleSharp floor. This is a **dependency-only change with no public API delta** — all three published
+ packages pass ApiCompat against the 1.1.0 baseline with no breaking changes, and the default
+ (`Credentials.Core` / `Credentials.Extensions.DependencyInjection`) consumer closure is unaffected
+ (it does not reference `Credentials.Rdfc`).
+
## v1.1.0 - 7/14/2026
### Changed
diff --git a/Directory.Build.props b/Directory.Build.props
index c4bbfd3..b3c6fb5 100644
--- a/Directory.Build.props
+++ b/Directory.Build.props
@@ -5,7 +5,7 @@
enable
latest
true
- 1.1.0
+ 1.1.1
true
true
true
diff --git a/Directory.Packages.props b/Directory.Packages.props
index 13dd7d0..0d64f08 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -36,6 +36,11 @@
+
+
diff --git a/src/Credentials.Rdfc/Credentials.Rdfc.csproj b/src/Credentials.Rdfc/Credentials.Rdfc.csproj
index f8d12cf..567287d 100644
--- a/src/Credentials.Rdfc/Credentials.Rdfc.csproj
+++ b/src/Credentials.Rdfc/Credentials.Rdfc.csproj
@@ -16,6 +16,10 @@
+
+
diff --git a/tasks/todo-2026-07-20-issue-18-anglesharp.md b/tasks/todo-2026-07-20-issue-18-anglesharp.md
new file mode 100644
index 0000000..14d8f6f
--- /dev/null
+++ b/tasks/todo-2026-07-20-issue-18-anglesharp.md
@@ -0,0 +1,48 @@
+# Task — Issue #18: Upgrade AngleSharp to fix GHSA-pgww-w46g-26qg + prep 1.1.1 release
+
+Full plan: `/Users/moises/.claude/plans/floofy-knitting-wall.md`
+
+## Problem
+
+Build failed under `TreatWarningsAsErrors=true` with `NU1902`: **AngleSharp 1.4.0** carries
+moderate-severity advisory GHSA-pgww-w46g-26qg. AngleSharp is a transitive-only dependency arriving
+via `Credentials.Rdfc → DataProofsDotnet.Rdfc → dotNetRdf.Core 3.5.1 → AngleSharp`, so the advisory
+surfaced in every project downstream of `Credentials.Rdfc` (not just the 2 the issue named).
+
+## Changes (branch `fix/anglesharp-1.5.2-issue-18`)
+
+- [x] `Directory.Packages.props` — added ``
+ (central, CPM) with a security-pin comment.
+- [x] `src/Credentials.Rdfc/Credentials.Rdfc.csproj` — added versionless
+ `` at the single source project; the promotion flows to
+ all downstream projects.
+- [x] `Directory.Build.props` — `CredentialsVersion` 1.1.0 → 1.1.1.
+- [x] `CHANGELOG.md` — added `## v1.1.1 - 7/20/2026` (Security) entry.
+
+## Pipelines
+
+No workflow edit needed: `.github/workflows/release.yml` is tag-driven and derives the version from
+the pushed tag (`version=${GITHUB_REF_NAME#v}`), overriding `CredentialsVersion`. Deploy = push tag
+`v1.1.1` after merge to `main`. Tag push is an irreversible nuget.org publish — left to the user.
+
+## Review — verification results (all green)
+
+- `dotnet list … --vulnerable --include-transitive`: **0 vulnerable packages** across all 29 projects
+ (was AngleSharp 1.4.0 in the Rdfc subtree). `Credentials.Rdfc` and `Credentials.Conformance.VcApi`
+ (both named in the issue) confirmed clean.
+- AngleSharp resolves to **1.5.2** in Rdfc (direct) and Conformance.VcApi (inherited).
+- `dotnet build Credentials.sln -c Release`: **0 warnings, 0 errors** (NU1902 gone).
+- `dotnet test … --filter "Category!=Conformance"`: all pass — Core 172, DI 161, Rdfc 21,
+ RoundTrip 9, SampleSmoke 14, Interop 5, Architecture 9. The Rdfc/RoundTrip suites exercise the
+ dotNetRDF canonicalization path against AngleSharp 1.5.2 → runtime-compatible.
+- `tools/check-no-newtonsoft-closure.sh`: **NFR-002 OK** (default closure Newtonsoft-free; unaffected).
+- `tools/check-api-compat.sh`: **no breaking changes** for Core / DI / Rdfc vs published 1.1.0
+ baseline → confirms dependency-only, no public API delta.
+- `dotnet pack -p:CredentialsVersion=1.1.1`: all 3 packages + snupkg pack; Rdfc nuspec declares
+ ``. Assemblies stamped `1.1.1+`.
+
+## Notes / lessons
+
+- No user correction this session → no new `tasks/lessons.md` entry.
+- The issue listed only 2 affected projects; the real blast radius was every downstream-of-Rdfc
+ project, which is why a single pin at the source (not two per-project edits) is the correct fix.