fix(deps): pin AngleSharp 1.4.0 → 1.5.2 to resolve GHSA-pgww-w46g-26qg (#18), release v1.1.1

CHANGELOG.md

@@ -4,6 +4,25 @@ All notable changes to `credentials-dotnet` are documented here. The format is b
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v1.1.1 - 7/20/2026
+
+### Security
+
+- **AngleSharp transitive dependency bumped `1.4.0` → `1.5.2`**
+  ([#18](https://github.com/moisesja/credentials-dotnet/issues/18)) to resolve the moderate-severity
+  advisory [GHSA-pgww-w46g-26qg](https://github.com/advisories/GHSA-pgww-w46g-26qg) (annotation-xml
+  elements). AngleSharp is not a first-party dependency — it arrives only through the opt-in RDFC
+  library's `dotNetRDF` chain (`Credentials.Rdfc` → `DataProofsDotnet.Rdfc` → `dotNetRdf.Core` →
+  `AngleSharp`), so with `TreatWarningsAsErrors` the `NU1902` audit warning failed the build for every
+  project downstream of `Credentials.Rdfc`. The fix is a single security-forcing pin: AngleSharp's
+  version is declared centrally (`Directory.Packages.props`) and a direct `PackageReference` is added
+  only in `Credentials.Rdfc` (the sole owner of the `dotNetRDF` chain), which promotes the resolved
+  version to `1.5.2` across all downstream projects. `1.5.2` satisfies `dotNetRdf.Core 3.5.1`'s
+  AngleSharp floor. This is a **dependency-only change with no public API delta** — all three published
+  packages pass ApiCompat against the 1.1.0 baseline with no breaking changes, and the default
+  (`Credentials.Core` / `Credentials.Extensions.DependencyInjection`) consumer closure is unaffected
+  (it does not reference `Credentials.Rdfc`).
+
 ## v1.1.0 - 7/14/2026
 
 ### Changed

Directory.Build.props

@@ -5,7 +5,7 @@
     <Nullable>enable</Nullable>
     <LangVersion>latest</LangVersion>
     <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
-    <CredentialsVersion>1.1.0</CredentialsVersion>
+    <CredentialsVersion>1.1.1</CredentialsVersion>
     <GenerateDocumentationFile>true</GenerateDocumentationFile>
     <Deterministic>true</Deterministic>
     <EmbedUntrackedSources>true</EmbedUntrackedSources>

Directory.Packages.props

@@ -36,6 +36,11 @@
     <!-- JSON Schema 2020-12 validation (M2). STJ-native; no Newtonsoft. Latest published is 7.3.2
          (the implementation plan's 9.2.2 was a recon error). -->
     <PackageVersion Include="JsonSchema.Net" Version="7.3.2" />
+    <!-- Security pin (issue #18, GHSA-pgww-w46g-26qg): force dotNetRDF's transitive AngleSharp up from
+         the vulnerable 1.4.0. Not a first-party dependency — referenced only in Credentials.Rdfc (the
+         sole owner of the dotNetRDF chain: Credentials.Rdfc -> DataProofsDotnet.Rdfc -> dotNetRdf.Core
+         -> AngleSharp) so the fix flows to every downstream project. 1.5.2 is >= dotNetRDF's floor. -->
+    <PackageVersion Include="AngleSharp" Version="1.5.2" />
 
     <!-- Microsoft.Extensions -->
     <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.8" />

src/Credentials.Rdfc/Credentials.Rdfc.csproj

@@ -16,6 +16,10 @@
     <PackageReference Include="DataProofsDotnet.Rdfc" />
     <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" />
     <PackageReference Include="Microsoft.SourceLink.GitHub" PrivateAssets="All" />
+    <!-- Security pin (issue #18, GHSA-pgww-w46g-26qg): promote dotNetRDF's transitive AngleSharp off the
+         vulnerable 1.4.0. Not used directly by this library — this is the single source of the dotNetRDF
+         chain, so pinning here flows the fix to every downstream project. Version is central (CPM). -->
+    <PackageReference Include="AngleSharp" />
   </ItemGroup>
 
   <ItemGroup>

tasks/todo-2026-07-20-issue-18-anglesharp.md

@@ -0,0 +1,48 @@
+# Task — Issue #18: Upgrade AngleSharp to fix GHSA-pgww-w46g-26qg + prep 1.1.1 release
+
+Full plan: `/Users/moises/.claude/plans/floofy-knitting-wall.md`
+
+## Problem
+
+Build failed under `TreatWarningsAsErrors=true` with `NU1902`: **AngleSharp 1.4.0** carries
+moderate-severity advisory GHSA-pgww-w46g-26qg. AngleSharp is a transitive-only dependency arriving
+via `Credentials.Rdfc → DataProofsDotnet.Rdfc → dotNetRdf.Core 3.5.1 → AngleSharp`, so the advisory
+surfaced in every project downstream of `Credentials.Rdfc` (not just the 2 the issue named).
+
+## Changes (branch `fix/anglesharp-1.5.2-issue-18`)
+
+- [x] `Directory.Packages.props` — added `<PackageVersion Include="AngleSharp" Version="1.5.2" />`
+      (central, CPM) with a security-pin comment.
+- [x] `src/Credentials.Rdfc/Credentials.Rdfc.csproj` — added versionless
+      `<PackageReference Include="AngleSharp" />` at the single source project; the promotion flows to
+      all downstream projects.
+- [x] `Directory.Build.props` — `CredentialsVersion` 1.1.0 → 1.1.1.
+- [x] `CHANGELOG.md` — added `## v1.1.1 - 7/20/2026` (Security) entry.
+
+## Pipelines
+
+No workflow edit needed: `.github/workflows/release.yml` is tag-driven and derives the version from
+the pushed tag (`version=${GITHUB_REF_NAME#v}`), overriding `CredentialsVersion`. Deploy = push tag
+`v1.1.1` after merge to `main`. Tag push is an irreversible nuget.org publish — left to the user.
+
+## Review — verification results (all green)
+
+- `dotnet list … --vulnerable --include-transitive`: **0 vulnerable packages** across all 29 projects
+  (was AngleSharp 1.4.0 in the Rdfc subtree). `Credentials.Rdfc` and `Credentials.Conformance.VcApi`
+  (both named in the issue) confirmed clean.
+- AngleSharp resolves to **1.5.2** in Rdfc (direct) and Conformance.VcApi (inherited).
+- `dotnet build Credentials.sln -c Release`: **0 warnings, 0 errors** (NU1902 gone).
+- `dotnet test … --filter "Category!=Conformance"`: all pass — Core 172, DI 161, Rdfc 21,
+  RoundTrip 9, SampleSmoke 14, Interop 5, Architecture 9. The Rdfc/RoundTrip suites exercise the
+  dotNetRDF canonicalization path against AngleSharp 1.5.2 → runtime-compatible.
+- `tools/check-no-newtonsoft-closure.sh`: **NFR-002 OK** (default closure Newtonsoft-free; unaffected).
+- `tools/check-api-compat.sh`: **no breaking changes** for Core / DI / Rdfc vs published 1.1.0
+  baseline → confirms dependency-only, no public API delta.
+- `dotnet pack -p:CredentialsVersion=1.1.1`: all 3 packages + snupkg pack; Rdfc nuspec declares
+  `<dependency id="AngleSharp" version="1.5.2" />`. Assemblies stamped `1.1.1+<sha>`.
+
+## Notes / lessons
+
+- No user correction this session → no new `tasks/lessons.md` entry.
+- The issue listed only 2 affected projects; the real blast radius was every downstream-of-Rdfc
+  project, which is why a single pin at the source (not two per-project edits) is the correct fix.