From 43827afbcb414ff491e38c52fcfc3b15c23bb5af Mon Sep 17 00:00:00 2001
From: "Gavin Barron (from Dev Box)" <gavinbarron@microsoft.com>
Date: Mon, 20 Jul 2026 16:40:23 -0700
Subject: [PATCH] Bump System.Security.Cryptography.Xml for CVEs

Pins System.Security.Cryptography.Xml to 9.0.18 to remediate CVE-2026-26171 and CVE-2026-33116 in the Typewriter project.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: b925a358-5d34-4537-8327-fe1fa580d903
---
 src/Typewriter/Typewriter.csproj | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/Typewriter/Typewriter.csproj b/src/Typewriter/Typewriter.csproj
index bb36c7bee..18ab90007 100644
--- a/src/Typewriter/Typewriter.csproj
+++ b/src/Typewriter/Typewriter.csproj
@@ -22,6 +22,7 @@
     <PackageReference Include="Microsoft.Extensions.Configuration.EnvironmentVariables" Version="9.0.0" />
     <PackageReference Include="Microsoft.Extensions.Configuration.Json" Version="9.0.0" />
     <PackageReference Include="Microsoft.Extensions.Configuration.Xml" Version="9.0.3" />
+    <PackageReference Include="System.Security.Cryptography.Xml" Version="9.0.18" />
     <PackageReference Include="Nito.AsyncEx">
       <Version>5.1.2</Version>
     </PackageReference>