Fix high-severity Snyk findings by pinning vulnerable transitive packages

[devin-ai-integration]

Summary

Resolves all Snyk findings from snyk test --all-projects by bumping Npgsql and adding explicit PackageReference pins for packages that were only present transitively.

.csproj changes:

• src/Infrastructure: Npgsql 7.0.4 → 7.0.7 (CVE-2024-32655, SQL injection); pin Azure.Identity 1.13.2 (CVE-2023-36414 RCE + two medium findings still open in 1.10.2), Microsoft.Data.SqlClient 5.1.3 (CVE-2024-0056, unprotected credential storage), System.Text.Json 8.0.5 (CVE-2024-30105 DoS), System.Formats.Asn1 8.0.1, Microsoft.IdentityModel.JsonWebTokens / System.IdentityModel.Tokens.Jwt 6.35.0
• src/WebApi: pin Npgsql 7.0.7 and System.Text.Json 8.0.5
• tests/Application.Tests, tests/WebApi.Tests: pin System.Net.Http 4.3.4 (CVE-2017-0247/0248/0249, CVE-2018-8292) and System.Text.RegularExpressions 4.3.1 (CVE-2019-0820 ReDoS) — both pulled in via FakeItEasy > Castle.Core > NETStandard.Library

Two deviations from the reported fix versions, both deliberate:

• System.Text.Json is pinned to 8.0.5, not 8.0.4: after upgrading to 8.0.4 Snyk reported a new high finding (SNYK-DOTNET-SYSTEMTEXTJSON-8168848, inefficient algorithmic complexity) fixed in 8.0.5.
• System.Drawing.Common is not pinned to 5.0.3. Microsoft.Data.SqlClient 5.1.3 already brings in System.Drawing.Common 6.0.0 transitively (via System.Configuration.ConfigurationManager → System.Security.Permissions → System.Windows.Extensions), which is above the vulnerable range; pinning 5.0.3 caused an NU1605 package-downgrade build error. Snyk confirms the finding is gone.

The last four pins (System.Formats.Asn1, the two IdentityModel packages, and the Azure.Identity 1.10.2 → 1.13.2 bump) address medium/low findings that the Snyk PR gate flagged after the initial high-severity fix, and are all pulled in transitively by Microsoft.Data.SqlClient / Azure.Identity.

Before / after (snyk test --all-projects):

	high issues	vulnerable paths
before	17 (across 4 projects)	87
after	0 (0 at any severity)	0 — "Tested 6 projects, no vulnerable paths were found."

dotnet build succeeds (0 errors) and dotnet test passes (6 Application + 14 WebApi tests). No source code or tests were modified.

Deliberately not fixed — recommended follow-up

The Dockerfile runtime base image mcr.microsoft.com/dotnet/aspnet:7.0 is out of Microsoft support and Snyk reports 14 critical and 96 high OS-level vulnerabilities against it. Fixing this requires moving TargetFramework from net7.0 to a supported LTS (net8.0) across all six projects plus the SDK build stage, which is a larger change with its own compatibility risk (EF Core / Npgsql / HotChocolate major bumps). It should be done in a dedicated PR.

Link to Devin session: https://app.devin.ai/sessions/660d66a3e0c145b6a0f863dc25b54ba3
Requested by: @shayanshafii

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring