[glen-84]

Summary

• Bumps Testcontainers, Testcontainers.LocalStack, and Testcontainers.ServiceBus from 4.13.0 to 4.14.0.
• Testcontainers 4.14.0 raises its SSH.NET floor to 2026.0.0, which clears GHSA-q939-rpr3-3284 (CVE-2026-48798, high — ScpClient recursive download allows arbitrary file write) for the test projects that reference Testcontainers directly. Nothing in the repo calls SSH.NET, and no shipped package resolves it.
• The test projects that get Testcontainers through Squadron 2.0.0-p.1 still resolve SSH.NET 2025.1.0; a follow-up Squadron bump to 2.0.0-p.3 clears those.

Test plan

• Restored the affected solutions (AspNetCore, Fusion, and Mocha) with --force-evaluate and built all three.
• Re-ran dotnet list package --vulnerable --include-transitive: AspNetCore and Fusion report no vulnerable packages on any target framework; Mocha reports SSH.NET only in the Squadron-fed projects.
• Ran the OPA authorization test project as a live container smoke test: 17/17 passing on net10.0.

[Copilot]

Pull request overview

Updates the centrally managed Testcontainers package versions to remediate a transitive SSH.NET vulnerability exposure in test projects that reference Testcontainers directly.

Changes:

• Bump Testcontainers, Testcontainers.LocalStack, and Testcontainers.ServiceBus from 4.13.0 to 4.14.0 in central package management.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

✅ Nitro CLI E2E snapshots: no flow recordings changed vs main.