From b26c16ec3a82c886339a8534d981278e98e30f74 Mon Sep 17 00:00:00 2001
From: Andreas Bednarz <110360248+abparticular@users.noreply.github.com>
Date: Wed, 13 May 2026 19:42:32 +1000
Subject: [PATCH] Pin dependencies to fix CVEs in Raven3 acceptance tests

---
 .../TimeoutMigrationTool.Raven3.AcceptanceTests.csproj          | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/TimeoutMigrationTool.Raven3.AcceptanceTests/TimeoutMigrationTool.Raven3.AcceptanceTests.csproj b/src/TimeoutMigrationTool.Raven3.AcceptanceTests/TimeoutMigrationTool.Raven3.AcceptanceTests.csproj
index 196a1ecb..1421aa5a 100644
--- a/src/TimeoutMigrationTool.Raven3.AcceptanceTests/TimeoutMigrationTool.Raven3.AcceptanceTests.csproj
+++ b/src/TimeoutMigrationTool.Raven3.AcceptanceTests/TimeoutMigrationTool.Raven3.AcceptanceTests.csproj
@@ -22,6 +22,8 @@
   </ItemGroup>
 
   <ItemGroup Label="Direct references to transitive dependencies to avoid versions with CVE">
+    <PackageReference Include="System.Drawing.Common" Version="4.7.3" />
+    <PackageReference Include="System.Security.Cryptography.Xml" Version="8.0.3" />
     <PackageReference Include="System.ServiceModel.Primitives" Version="8.1.2" />
   </ItemGroup>