fix: remediate AngleSharp CVE-2026-54570 and add dependency audit gate

[cwinland]

Plain language

Fixes a moderate security vulnerability (CVE-2026-54570) in the AngleSharp HTML parser that FastMoq.Web pulls in transitively through bUnit, by forcing the patched 1.5.0 build. Also adds a CI check that fails the build if any dependency has a known vulnerability.

Why / Value

AngleSharp 1.4.0, resolved transitively via bunit, is affected by CVE-2026-54570 / GHSA-pgww-w46g-26qg (mutation XSS, CVSS 6.9). FastMoq.Web ships bunit as a dependency, so the vulnerable package flows to consumers of the package. Pinning the patched build clears the advisory, and the new CI gate stops future vulnerable dependencies from merging silently.

What

• Pins AngleSharp to the patched 1.5.0 build centrally, overriding the vulnerable 1.4.0 resolved transitively via bunit.
• Adds a direct AngleSharp reference in FastMoq.Web so the patched version applies to the packable web project and every project that references it.
• Adds a security-audit CI job that runs the NuGet vulnerability audit and fails the build when any advisory is detected.

Validation

dotnet list FastMoq.sln package --vulnerable --include-transitive
dotnet build FastMoq.Web/FastMoq.Web.csproj -c Release

Risk & Rollback

Final: Low.

• Surface baseline: Low - a dependency version bump plus a CI-only gate; no product or runtime code changed.
• AngleSharp 1.5.0 is API-compatible for this use (bunit requires >=1.4.0, <2.0.0) and the web project builds clean against it.
• Rollback: revert the three changed files; no data, schema, or migration impact.

[Copilot]

Pull request overview

This PR remediates a reported AngleSharp vulnerability affecting FastMoq.Web (via bUnit) by pinning AngleSharp to a patched version and adds a CI gate to prevent known-vulnerable NuGet dependencies from merging unnoticed.

Changes:

• Pin AngleSharp to 1.5.0 via central package management.
• Add an explicit AngleSharp PackageReference to FastMoq.Web so the patched version is applied and flows to consumers of the packable web package.
• Add a security-audit CI job that runs dotnet list ... --vulnerable --include-transitive and fails the workflow when advisories are detected.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
FastMoq.Web/FastMoq.Web.csproj	Adds a direct AngleSharp package reference so the centrally pinned patched version is applied for the packable web project.
Directory.Packages.props	Centrally pins AngleSharp to 1.5.0 with context for the advisory being remediated.
.github/workflows/template_ci.yml	Introduces a CI “security-audit” job to fail builds when vulnerable NuGet dependencies are detected.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (1)

.github/workflows/template_ci.yml:36

• actions/setup-dotnet caching uses the cache-dependency-path file list to build the cache key. Since this repo manages versions centrally via Directory.Packages.props, changes to that file (like the AngleSharp pin in this PR) won't invalidate the cache unless it's included here, which can cause CI to reuse stale NuGet caches.

          cache: true
          cache-dependency-path: |
            **/*.csproj
            **/*.sln