Fix Snyk high-severity dependency vulnerabilities (Infrastructure.csproj)

[devin-ai-integration]

Summary

All 14 Snyk SCA findings (across src/Infrastructure, src/WebApi, tests/WebApi.Tests manifests) originate from src/Infrastructure/Infrastructure.csproj, so a single 3-line csproj change fixes them everywhere.

- <PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" Version="7.0.10" />
- <PackageReference Include="Npgsql" Version="7.0.4" />
+ <PackageReference Include="Npgsql" Version="7.0.7" />
+ <PackageReference Include="System.Text.Json" Version="8.0.5" />

• Microsoft.EntityFrameworkCore.SqlServer removed rather than upgraded: the app is PostgreSQL-only (UseNpgsql in Program.cs; no UseSqlServer anywhere), so the package was dead weight. Removing it drops the entire Microsoft.Data.SqlClient → Azure.Identity / System.Drawing.Common chain. (Upgrading to EF SqlServer 7.0.20 would still pull Microsoft.Data.SqlClient 5.1.x with a vulnerable Azure.Identity transitive, so removal is the cleaner fix.)
• Npgsql 7.0.4 → 7.0.7 (patch bump, minimum fixed version). AspNetCore.HealthChecks.NpgSql@7.0.0 in WebApi still references Npgsql 7.0.4, but NuGet resolves to 7.0.7 via the transitive Infrastructure reference (verified in all three project.assets.json).
• System.Text.Json 8.0.5 pinned directly to override the 7.0.0 transitive from Microsoft.EntityFrameworkCore.Design → Microsoft.Extensions.DependencyModel@7.0.0 (no EF 7.x Design release moves off it). The listed fix version 8.0.4 has its own high-severity issue (SNYK-DOTNET-SYSTEMTEXTJSON-8168848, flagged by the Snyk PR check), so 8.0.5 is used. Targets net6.0/netstandard2.0, compatible with net7.0.

Verified locally: dotnet restore, dotnet build (0 errors), dotnet test (20/20 pass), snyk test --all-projects → "Tested 6 projects, no vulnerable paths were found."

Note on CI: the build check fails on main too (pre-existing): .github/workflows/dotnet.yml installs dotnet-version: 6.0.x and the ubuntu-latest runner has no .NET 7 runtime, so dotnet test aborts with "You must install or update .NET". Changing it to 7.0.x would fix CI; left out of this PR as it's unrelated to the Snyk remediation.

Snyk issues resolved

• SNYK-DOTNET-AZUREIDENTITY-6009155 (Azure.Identity 1.6.0) — all 3 manifests
• SNYK-DOTNET-MICROSOFTDATASQLCLIENT-6149434 (Microsoft.Data.SqlClient 5.0.2) — all 3 manifests
• SNYK-DOTNET-SYSTEMDRAWINGCOMMON-3063427 (System.Drawing.Common 5.0.0) — all 3 manifests
• SNYK-DOTNET-NPGSQL-6825563 (Npgsql 7.0.4) — all 3 manifests
• SNYK-DOTNET-SYSTEMTEXTJSON-7433719 (System.Text.Json 7.0.0) — Infrastructure + WebApi manifests
• SNYK-DOTNET-SYSTEMTEXTJSON-8168848 (System.Text.Json 8.0.4; not in original list, surfaced by PR check)

Skipped

None. No SAST (Snyk Code) findings were reported for this repo.

Link to Devin session: https://app.devin.ai/sessions/ad1a5e21240446f29784a9b63c8387b0
Open in Devin Desktop: https://app.devin.ai/desktop/session/ad1a5e21240446f29784a9b63c8387b0?variant=devin
Requested by: @shayanshafii

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring