Security: pin SSH.NET past GHSA-q939-rpr3-3284

[arnelirobles]

SSH.NET 2025.1.0 arrives transitively — we never reference it. The chain is BarakoCMS.Tests → Testcontainers.PostgreSql → Testcontainers → SSH.NET, which Testcontainers uses for its SSH port-forwarding container.

GHSA-q939-rpr3-3284 (path traversal in ScpClient's recursive download, CVSS 7.1 High) was published 2026-08-09 and patched in SSH.NET 2026.0.0. Master last built green on 2026-08-11, so CI started failing on a tree nobody had touched — the .NET vulnerability gate doing exactly its job.

Has Testcontainers fixed it upstream?

Not yet. Every published version still declares the vulnerable one:

Testcontainers	declares
4.8.0	SSH.NET 2024.2.0
4.9.0 (ours)	SSH.NET 2025.1.0
4.10.0 – 4.13.0 (latest)	SSH.NET 2025.1.0

So upgrading Testcontainers would not help. testcontainers-dotnet#1738 and PR #1739 opened upstream today to raise the floor, both still open.

The upstream issue explains why the pin is the right fix rather than a workaround: Testcontainers declares SSH.NET [2025.1.0, ), an open-ended range, and NuGet resolves the lowest version in a range — so a default restore lands on exactly 2025.1.0. Naming 2026.0.0 satisfies that range and is a supported resolution, not an override. When upstream releases, this pin becomes redundant and can be dropped.

Scope

Test-only: SSH.NET is not in any shipped package, and nothing in the product touches ScpClient. The gate is right to fail on it regardless — a High advisory in the build shouldn't be something we learn to ignore.

Transitive pinning is already on, so naming the version in Directory.Packages.props is the entire fix. dotnet list package --vulnerable --include-transitive now reports nothing, and the full suite passes.

Split out from #78 so a security bump isn't buried in a test-coverage change.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 7e8a804e-f2e5-4b3b-bfb1-425215a65273

📥 Commits

Reviewing files that changed from the base of the PR and between f30c320 and 7557383.

📒 Files selected for processing (1)

• Directory.Packages.props

---

📝 Walkthrough

Walkthrough

The package configuration adds a central SSH.NET version pin at 2026.0.0 for a transitive dependency associated with GHSA-q939-rpr3-3284.

Changes

SSH.NET security update

Layer / File(s)	Summary
Central SSH.NET version pin Directory.Packages.props	The central package configuration pins transitive SSH.NET to version 2026.0.0 and documents the addressed advisory.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Mergeability Score: ⚪ Minimal · up to 75573

This change pins SSH.NET to address the reported vulnerable transitive version, with vulnerability checks and the full test suite passing. No actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the security change and the specific SSH.NET advisory addressed.
Description check	✅ Passed	The description clearly explains the vulnerability, dependency path, rationale, scope, and validation results, but it omits the template headings and checklist.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch security-sshnet

---

_{Comment @coderabbitai help to get the list of available commands.}