Pin transitive System.Security.Cryptography.Xml to a patched 8.x release

Author: bart-vmware

src/Configuration/test/PlaceholderBase.Test/Steeltoe.Extensions.Configuration.PlaceholderBase.Test.csproj

@@ -18,6 +18,7 @@
   </ItemGroup>
 
   <ItemGroup>
+    <PackageReference Include="System.Security.Cryptography.Xml" Version="$(SystemSecurityCryptographyXmlVersion)" />
     <PackageReference Include="Microsoft.AspNetCore.TestHost" Version="$(AspNetCoreVersion)" />
     <PackageReference Include="Microsoft.Extensions.Configuration.Json" Version="$(ExtensionsVersion)" />
     <PackageReference Include="Microsoft.Extensions.Configuration.Xml" Version="$(ExtensionsVersion)" />

src/Configuration/test/PlaceholderCore.Test/Steeltoe.Extensions.Configuration.PlaceholderCore.Test.csproj

@@ -16,6 +16,7 @@
     <ProjectReference Include="..\..\src\PlaceholderCore\Steeltoe.Extensions.Configuration.PlaceholderCore.csproj" />
   </ItemGroup>
   <ItemGroup>
+    <PackageReference Include="System.Security.Cryptography.Xml" Version="$(SystemSecurityCryptographyXmlVersion)" />
     <PackageReference Include="Microsoft.Extensions.Configuration.Json" Version="$(ExtensionsVersion)" />
     <PackageReference Include="Microsoft.Extensions.Configuration.Xml" Version="$(ExtensionsVersion)" />
     <PackageReference Include="Microsoft.Extensions.Configuration.Ini" Version="$(ExtensionsVersion)" />

src/Configuration/test/SpringBootCore.Test/Steeltoe.Extensions.Configuration.SpringBootCore.Test.csproj

@@ -16,6 +16,7 @@
     <ProjectReference Include="..\..\src\SpringBootCore\Steeltoe.Extensions.Configuration.SpringBootCore.csproj" />
   </ItemGroup>
   <ItemGroup>
+    <PackageReference Include="System.Security.Cryptography.Xml" Version="$(SystemSecurityCryptographyXmlVersion)" />
     <PackageReference Include="Microsoft.Extensions.Configuration.Json" Version="$(ExtensionsVersion)" />
     <PackageReference Include="Microsoft.Extensions.Configuration.Xml" Version="$(ExtensionsVersion)" />
     <PackageReference Include="Microsoft.Extensions.Configuration.Ini" Version="$(ExtensionsVersion)" />

src/Security/src/DataProtection.RedisCore/Steeltoe.Security.DataProtection.RedisCore.csproj

@@ -13,5 +13,6 @@
     <PackageReference Include="Microsoft.AspNetCore.DataProtection" Version="$(ExtensionsVersion)" />
     <PackageReference Include="Microsoft.AspNetCore.DataProtection.StackExchangeRedis" Version="$(ExtensionsVersion)" />
     <PackageReference Include="System.Formats.Asn1" Version="$(SystemFormatsAsn1Version)" />
+    <PackageReference Include="System.Security.Cryptography.Xml" Version="$(SystemSecurityCryptographyXmlVersion)" />
   </ItemGroup>
 </Project>

versions.props

@@ -46,6 +46,10 @@
       <!-- Earliest non-vulnerable version in 8.x release line -->
       8.0.1
     </SystemFormatsAsn1Version>
+    <SystemSecurityCryptographyXmlVersion>
+      <!-- Earliest non-vulnerable version in 8.x release line -->
+      8.0.3
+    </SystemSecurityCryptographyXmlVersion>
     <SystemTextRegularExpressionsVersion>4.3.1</SystemTextRegularExpressionsVersion>
     <SystemNetHttpVersion>4.3.4</SystemNetHttpVersion>