From a15648db0487ec61d24b3f08892f54998e134893 Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Thu, 22 Oct 2026 23:26:49 +0200
Subject: [PATCH] Pin Npgsql 8.0.3, System.Text.Json 8.0.5, Caching.Memory
 8.0.1; enable NuGet lockfiles

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 Directory.Build.props              | 7 +++++++
 Dockerfile                         | 7 ++++---
 src/Bifrost.Web/Bifrost.Web.csproj | 4 ++++
 3 files changed, 15 insertions(+), 3 deletions(-)
 create mode 100644 Directory.Build.props

diff --git a/Directory.Build.props b/Directory.Build.props
new file mode 100644
index 0000000..1bb3c83
--- /dev/null
+++ b/Directory.Build.props
@@ -0,0 +1,7 @@
+<Project>
+
+  <PropertyGroup>
+    <RestorePackagesWithLockFile>true</RestorePackagesWithLockFile>
+  </PropertyGroup>
+
+</Project>
diff --git a/Dockerfile b/Dockerfile
index 4f607e6..45072e5 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,14 +1,15 @@
 FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
 WORKDIR /src
 
-COPY src/Bifrost.Web/Bifrost.Web.csproj src/Bifrost.Web/
-RUN dotnet restore src/Bifrost.Web/Bifrost.Web.csproj
+COPY Directory.Build.props .
+COPY src/Bifrost.Web/Bifrost.Web.csproj src/Bifrost.Web/packages.lock.json src/Bifrost.Web/
+RUN dotnet restore src/Bifrost.Web/Bifrost.Web.csproj --locked-mode
 
 COPY . .
 RUN dotnet publish src/Bifrost.Web/Bifrost.Web.csproj \
     --configuration Release \
     --output /app/publish \
-    /p:UseAppHost=false
+    /p:UseAppHost=false /p:RestoreLockedMode=true
 
 FROM mcr.microsoft.com/dotnet/aspnet:8.0-bookworm-slim AS runtime
 WORKDIR /app
diff --git a/src/Bifrost.Web/Bifrost.Web.csproj b/src/Bifrost.Web/Bifrost.Web.csproj
index 09a3ea4..128d84e 100644
--- a/src/Bifrost.Web/Bifrost.Web.csproj
+++ b/src/Bifrost.Web/Bifrost.Web.csproj
@@ -13,6 +13,10 @@
     </PackageReference>
     <PackageReference Include="BouncyCastle.Cryptography" Version="2.4.0" />
     <PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="8.0.0" />
+    <!-- Direct pins lift transitive packages past their advisories; the lockfile holds the result. -->
+    <PackageReference Include="Npgsql" Version="8.0.3" />
+    <PackageReference Include="System.Text.Json" Version="8.0.5" />
+    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="8.0.1" />
   </ItemGroup>
 
 </Project>