chore(deps): Bump actions/setup-dotnet from 5 to 6 in the github-actions-dependencies group (#130)

* chore(deps): Bump actions/setup-dotnet

Bumps the github-actions-dependencies group with 1 update: [actions/setup-dotnet](https://github.com/actions/setup-dotnet).


Updates `actions/setup-dotnet` from 5 to 6
- [Release notes](https://github.com/actions/setup-dotnet/releases)
- [Commits](actions/setup-dotnet@v5...v6)

---
updated-dependencies:
- dependency-name: actions/setup-dotnet
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix(deps): patch AngleSharp and System.Security.Cryptography.Xml CVEs

Vulnerability Check was failing (blocking Review Summary) due to two
pre-existing high/moderate vulnerabilities unrelated to this PR's own
diff, both surfaced by `dotnet list package --vulnerable`:

- AngleSharp 1.4.0 (transitive via bunit 2.7.2) is vulnerable to
  GHSA-pgww-w46g-26qg / CVE-2026-54570 (mXSS via annotation-xml HTML
  integration point bypass). Pin to 1.5.2 (first patched: 1.5.0).
- System.Security.Cryptography.Xml 10.0.9 in build/_build.csproj has
  5 known high-severity advisories (GHSA-cvvh-rhrc-wg4q, GHSA-g8r8-53c2-pm3f,
  GHSA-23rf-6693-g89p, GHSA-8q5v-6pqq-x66h, GHSA-mmjf-rqrv-855v). Bump to
  10.0.10, the same fix already applied in #132.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: JerrettDavis <mxjerrett@gmail.com>
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

Author: 3 people

.github/workflows/ci.yml

@@ -36,7 +36,7 @@ jobs:
         fetch-depth: 0
 
     - name: Setup .NET
-      uses: actions/setup-dotnet@v5
+      uses: actions/setup-dotnet@v6
       with:
         dotnet-version: ${{ env.DOTNET_VERSION }}
 

.github/workflows/codeql.yml

@@ -37,7 +37,7 @@ jobs:
         fetch-depth: 0
 
     - name: Setup .NET
-      uses: actions/setup-dotnet@v5
+      uses: actions/setup-dotnet@v6
       with:
         dotnet-version: ${{ env.DOTNET_VERSION }}
 
@@ -76,7 +76,7 @@ jobs:
       uses: actions/checkout@v7
 
     - name: Setup .NET
-      uses: actions/setup-dotnet@v5
+      uses: actions/setup-dotnet@v6
       with:
         dotnet-version: ${{ env.DOTNET_VERSION }}
 

.github/workflows/dependency-review.yml

@@ -37,7 +37,7 @@ jobs:
       uses: actions/checkout@v7
 
     - name: Setup .NET
-      uses: actions/setup-dotnet@v5
+      uses: actions/setup-dotnet@v6
       with:
         dotnet-version: ${{ env.DOTNET_VERSION }}
 
@@ -114,7 +114,7 @@ jobs:
         path: base
 
     - name: Setup .NET
-      uses: actions/setup-dotnet@v5
+      uses: actions/setup-dotnet@v6
       with:
         dotnet-version: ${{ env.DOTNET_VERSION }}
 

.github/workflows/pr-validation.yml

@@ -28,7 +28,7 @@ jobs:
         fetch-depth: 0
 
     - name: Setup .NET
-      uses: actions/setup-dotnet@v5
+      uses: actions/setup-dotnet@v6
       with:
         dotnet-version: ${{ env.DOTNET_VERSION }}
 
@@ -64,7 +64,7 @@ jobs:
         fetch-depth: 0
 
     - name: Setup .NET
-      uses: actions/setup-dotnet@v5
+      uses: actions/setup-dotnet@v6
       with:
         dotnet-version: ${{ env.DOTNET_VERSION }}
 
@@ -92,7 +92,7 @@ jobs:
       uses: actions/checkout@v7
 
     - name: Setup .NET
-      uses: actions/setup-dotnet@v5
+      uses: actions/setup-dotnet@v6
       with:
         dotnet-version: ${{ env.DOTNET_VERSION }}
 

.github/workflows/release.yml

@@ -32,7 +32,7 @@ jobs:
         fetch-depth: 0
 
     - name: Setup .NET
-      uses: actions/setup-dotnet@v5
+      uses: actions/setup-dotnet@v6
       with:
         dotnet-version: ${{ env.DOTNET_VERSION }}
 
@@ -198,7 +198,7 @@ jobs:
       uses: actions/checkout@v7
 
     - name: Setup .NET
-      uses: actions/setup-dotnet@v5
+      uses: actions/setup-dotnet@v6
       with:
         dotnet-version: ${{ env.DOTNET_VERSION }}
 

build/_build.csproj

@@ -20,7 +20,9 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.9" />
+    <!-- 10.0.10 patches GHSA-cvvh-rhrc-wg4q / GHSA-g8r8-53c2-pm3f / GHSA-23rf-6693-g89p /
+         GHSA-8q5v-6pqq-x66h / GHSA-mmjf-rqrv-855v (high severity) present in 10.0.9. -->
+    <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.10" />
     <PackageReference Include="NuGet.Packaging" Version="7.6.0" />
   </ItemGroup>
 

tests/PokManager.Web.Tests/PokManager.Web.Tests.csproj

@@ -15,6 +15,11 @@
     <PackageReference Include="TinyBDD" Version="0.19.28" />
     <PackageReference Include="xunit" Version="2.9.3" />
     <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5" />
+    <!-- Forced transitive upgrade: bunit 2.7.2 pulls AngleSharp 1.4.0, which is vulnerable
+         to GHSA-pgww-w46g-26qg / CVE-2026-54570 (mXSS via annotation-xml HTML integration
+         point bypass, moderate). 1.5.0 is the first patched release; pin to the latest
+         stable line. -->
+    <PackageReference Include="AngleSharp" Version="1.5.2" />
   </ItemGroup>
 
   <ItemGroup>