From 8a252bbe0f6773d9c89c901043070868756df114 Mon Sep 17 00:00:00 2001
From: Rafael Vuijk <r.vuijk@sownet.nl>
Date: Sat, 24 Oct 2026 23:07:34 +0000
Subject: [PATCH] Pin the patched System.Text.Json under the notebook extension

Microsoft.DotNet.Interactive 1.0.0-beta.23611.1 brings System.Text.Json 8.0.0
into AngouriMath.Interactive, with two high severity advisories, both denials
of service: GHSA-hh2w-p6rv-4g7w and GHSA-8g4q-xg66-9fp4. A direct reference to
8.0.6, the patched build on the same major line, pulls it forward, as #797 did
for System.Security.Cryptography.Xml under the terminal.

Not an upgrade of Microsoft.DotNet.Interactive, although its newest beta
depends on System.Text.Json 10.0.0: the notebook host supplies that package,
and building against a newer one than the host's is how FSharp.Core 10.1 hung
a kernel in #2108.

dotnet list --vulnerable --include-transitive goes from two advisories to none,
the build has no warnings, and the Interactive wrapper tests pass, 19 with 1
skipped. Packed with AngouriMath and AngouriMath.FSharp at a dev version to a
local feed and loaded in the binder image (dotnet-interactive 1.0.712001), the
F# sample runs all 39 of its code cells and a C# kernel loads the extension
and runs its cells, with no errors. The System.Text.Json loaded is the host's
own, 10.0.0.0 from the shared framework.

Part of https://github.com/asc-community/AngouriMath/issues/542

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012sonx8iAspMiwRwokT1Ura
---
 .../AngouriMath.Interactive.fsproj                        | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/Sources/Wrappers/AngouriMath.Interactive/AngouriMath.Interactive.fsproj b/Sources/Wrappers/AngouriMath.Interactive/AngouriMath.Interactive.fsproj
index c256984fd..cef84fa5d 100644
--- a/Sources/Wrappers/AngouriMath.Interactive/AngouriMath.Interactive.fsproj
+++ b/Sources/Wrappers/AngouriMath.Interactive/AngouriMath.Interactive.fsproj
@@ -51,6 +51,14 @@
          against rather than the SDK's: 8.0.403 is Plotly.NET's floor, and 10.1 hung a C# kernel under a
          host carrying 10.0. https://github.com/asc-community/AngouriMath/issues/2108 -->
     <PackageReference Update="FSharp.Core" Version="8.0.403" />
+    <!-- Pinned to pull the patched build of a transitive dependency forward. Microsoft.DotNet.Interactive
+         1.0.0-beta.23611.1 brings System.Text.Json 8.0.0, which has two high severity advisories (NU1903),
+         GHSA-hh2w-p6rv-4g7w and GHSA-8g4q-xg66-9fp4; 8.0.6 is the patched build on the same major line.
+         Not an upgrade of that package: the host supplies it, and building against a newer one than the
+         host's is what hung a kernel through FSharp.Core, above. Remove this line once the
+         Microsoft.DotNet.Interactive reference moves to a build whose own dependency is patched.
+         https://github.com/asc-community/AngouriMath/issues/542 -->
+    <PackageReference Include="System.Text.Json" Version="8.0.6" />
   </ItemGroup>
 
   <ItemGroup>