From 298c9089d564fcdc86b1616b0ee06b58b021d0c2 Mon Sep 17 00:00:00 2001
From: PowerShell GitHub Bot <pwshbot@microsoft.com>
Date: Sat, 8 Aug 2026 02:42:35 +0000
Subject: [PATCH 1/2] Update packages to fix known vulnerabilities

---
 CHANGELOG/v7.6/dependencychanges.json         | 47 +++++++++++++++++++
 .../Microsoft.PowerShell.SDK.csproj           |  4 +-
 test/tools/TestService/TestService.csproj     |  4 +-
 3 files changed, 51 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG/v7.6/dependencychanges.json b/CHANGELOG/v7.6/dependencychanges.json
index 558c4351ede..150a950307a 100644
--- a/CHANGELOG/v7.6/dependencychanges.json
+++ b/CHANGELOG/v7.6/dependencychanges.json
@@ -88,5 +88,52 @@
     "AdvisoryUrls": [],
     "Justification": "Updated .NET SDK. Building with the latest SDK is required.",
     "TimestampUtc": "2026-07-15T15:01:47.0062032Z"
+  },
+  {
+    "ChangeType": "Security",
+    "Branch": "release/v7.6.5",
+    "PackageId": "System.Security.Cryptography.Xml",
+    "FromVersion": "10.0.6",
+    "ToVersion": "10.0.10",
+    "VulnerabilityId": [
+      "CVE-2026-47302",
+      "CVE-2026-47304",
+      "CVE-2026-50525",
+      "CVE-2026-50527",
+      "CVE-2026-50648",
+      "GHSA-23RF-6693-G89P",
+      "GHSA-8Q5V-6PQQ-X66H",
+      "GHSA-CVVH-RHRC-WG4Q",
+      "GHSA-G8R8-53C2-PM3F",
+      "GHSA-MMJF-RQRV-855V"
+    ],
+    "Severity": [
+      "high"
+    ],
+    "VulnerableRanges": [
+      "[10.0.0, 10.0.9]"
+    ],
+    "AdvisoryUrls": [
+      "https://github.com/advisories/GHSA-23rf-6693-g89p",
+      "https://github.com/advisories/GHSA-8q5v-6pqq-x66h",
+      "https://github.com/advisories/GHSA-cvvh-rhrc-wg4q",
+      "https://github.com/advisories/GHSA-g8r8-53c2-pm3f",
+      "https://github.com/advisories/GHSA-mmjf-rqrv-855v"
+    ],
+    "Justification": "",
+    "TimestampUtc": "2026-08-08T02:42:35.4810370Z"
+  },
+  {
+    "ChangeType": "NonSecurity",
+    "Branch": "release/v7.6.5",
+    "PackageId": "System.Security.Cryptography.Pkcs",
+    "FromVersion": "10.0.6",
+    "ToVersion": "10.0.10",
+    "VulnerabilityId": [],
+    "Severity": [],
+    "VulnerableRanges": [],
+    "AdvisoryUrls": [],
+    "Justification": "Required by System.Security.Cryptography.Xml 10.0.10 dependency constraint '[10.0.10, )'.",
+    "TimestampUtc": "2026-08-08T02:42:35.4946389Z"
   }
 ]
diff --git a/src/Microsoft.PowerShell.SDK/Microsoft.PowerShell.SDK.csproj b/src/Microsoft.PowerShell.SDK/Microsoft.PowerShell.SDK.csproj
index 82f0a2ebf9a..3d503a47a4f 100644
--- a/src/Microsoft.PowerShell.SDK/Microsoft.PowerShell.SDK.csproj
+++ b/src/Microsoft.PowerShell.SDK/Microsoft.PowerShell.SDK.csproj
@@ -58,9 +58,9 @@
     <PackageReference Include="System.Net.Http.WinHttpHandler" Version="10.0.5" />
     <PackageReference Include="System.Reflection.Context" Version="10.0.5" />
     <PackageReference Include="System.Runtime.Caching" Version="10.0.5" />
-    <PackageReference Include="System.Security.Cryptography.Pkcs" Version="10.0.6" />
+    <PackageReference Include="System.Security.Cryptography.Pkcs" Version="10.0.10" />
     <PackageReference Include="System.Security.Cryptography.ProtectedData" Version="10.0.5" />
-    <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.6" />
+    <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.10" />
     <PackageReference Include="System.Security.Permissions" Version="10.0.5" />
     <!-- the following package(s) are from https://github.com/dotnet/wcf -->
     <PackageReference Include="System.ServiceModel.Http" Version="10.0.652802" />
diff --git a/test/tools/TestService/TestService.csproj b/test/tools/TestService/TestService.csproj
index 0a5eaf8d6fd..85cb85ef246 100644
--- a/test/tools/TestService/TestService.csproj
+++ b/test/tools/TestService/TestService.csproj
@@ -53,9 +53,9 @@
     <PackageReference Include="System.Management" Version="10.0.5" />
     <PackageReference Include="System.Reflection.Context" Version="10.0.5" />
     <PackageReference Include="System.Runtime.Caching" Version="10.0.5" />
-    <PackageReference Include="System.Security.Cryptography.Pkcs" Version="10.0.6" />
+    <PackageReference Include="System.Security.Cryptography.Pkcs" Version="10.0.10" />
     <PackageReference Include="System.Security.Cryptography.ProtectedData" Version="10.0.5" />
-    <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.6" />
+    <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.10" />
     <PackageReference Include="System.Security.Permissions" Version="10.0.5" />
     <PackageReference Include="System.ServiceModel.Syndication" Version="10.0.5" />
     <PackageReference Include="System.ServiceProcess.ServiceController" Version="10.0.5" />

From f0ddbac3df05b7cd827ac9746642fd8b014e5d5a Mon Sep 17 00:00:00 2001
From: PowerShell GitHub Bot <pwshbot@microsoft.com>
Date: Sat, 8 Aug 2026 03:49:25 +0000
Subject: [PATCH 2/2] Update cgmanifest

---
 tools/cgmanifest/main/cgmanifest.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/cgmanifest/main/cgmanifest.json b/tools/cgmanifest/main/cgmanifest.json
index e06492f2e75..5f29ce3505a 100644
--- a/tools/cgmanifest/main/cgmanifest.json
+++ b/tools/cgmanifest/main/cgmanifest.json
@@ -626,7 +626,7 @@
         "Type": "nuget",
         "Nuget": {
           "Name": "System.Security.Cryptography.Pkcs",
-          "Version": "10.0.6"
+          "Version": "10.0.10"
         }
       },
       "DevelopmentDependency": false
@@ -646,7 +646,7 @@
         "Type": "nuget",
         "Nuget": {
           "Name": "System.Security.Cryptography.Xml",
-          "Version": "10.0.6"
+          "Version": "10.0.10"
         }
       },
       "DevelopmentDependency": false