Fix Snyk-reported vulnerable NuGet packages

[devin-ai-integration]

Summary

Remediates the 17 high-severity Snyk SCA findings across the 4 manifests by pinning patched versions of vulnerable (mostly transitive) NuGet packages in the .csproj files. No source/behavior changes; changes are dependency version bumps only. dotnet build, dotnet test (20/20 pass), and snyk test --all-projects all pass with 0 vulnerable paths across all 6 projects.

Findings fixed

src/Infrastructure/Infrastructure.csproj (added explicit pins to override transitive versions; Npgsql was a direct ref):

• Npgsql 7.0.4 → 7.0.7 (SQL Injection) — direct ref bumped
• Azure.Identity 1.6.0 → 1.13.2 (RCE) — pinned ≥ the 1.12.1 required by SqlClient 5.1.9
• Microsoft.Data.SqlClient 5.0.2 → 5.1.9 (Unprotected Storage of Credentials)
• System.Text.Json 7.0.0 → 8.0.6 (DoS) — 8.x runs fine on net7.0
• System.Drawing.Common 5.0.0 → 6.0.0 — resolved transitively (SqlClient 5.1.9 → System.Security.Permissions 6.0.0 → System.Windows.Extensions 6.0.0 → System.Drawing.Common ≥6.0.0), which is already past the fixed 5.0.3, so no explicit pin was needed.

src/WebApi/WebApi.csproj (transitive via AspNetCore.HealthChecks.NpgSql):

• Npgsql 7.0.4 → 7.0.7
• System.Text.Json 7.0.0 → 8.0.6

tests/Application.Tests and tests/WebApi.Tests (added explicit patched refs for the 4.3.0 transitives):

• System.Net.Http 4.3.0 → 4.3.4 (DoS / Improper Certificate Validation / Information Exposure / Privilege Escalation)
• System.Text.RegularExpressions 4.3.0 → 4.3.1 (ReDoS)

Notes / not-fixed

• Nothing was left unfixed for the SCA findings — Snyk now reports 0 vulnerable paths in all 6 projects.
• Kept all bumps within net7.0-compatible ranges and avoided floating versions and any release published in the last 7 days.
• System.Drawing.Common explicit pin was intentionally dropped: SqlClient 5.1.9's chain already forces 6.0.0 (patched), and pinning 5.0.3 caused an NU1605 downgrade error.

Additional fix (preexisting CI break, unrelated to Snyk)

.github/workflows/dotnet.yml set up dotnet-version: 6.0.x for a net7.0 project, so the test host had no matching runtime and dotnet test failed (Framework 'Microsoft.NETCore.App' 7.0.0 not found). This already failed on main before this PR. Bumped to 7.0.x so CI can actually run the tests.

• The security/snyk (Cognition-default) PR check is failing with "You have used your limit of private tests" — that's a Snyk account/plan quota, not a code issue.

Verification

• dotnet build → Build succeeded, 0 errors (3 pre-existing nullable warnings, unrelated).
• dotnet test → Passed! 6/6 Application.Tests + 14/14 WebApi.Tests = 20/20.
• snyk test --all-projects → "Tested 6 projects, no vulnerable paths were found."

Link to Devin session: https://app.devin.ai/sessions/ee2a7a2fa5db44e7a42cb47bbf5125c9
Requested by: @shayanshafii

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring