msmsrep · Oct 22, 2026 · Oct 22, 2026 · Oct 22, 2026
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -0,0 +1,51 @@
+# 依存パッケージの更新確認（週1回）。更新があれば dev 向けの PR を作る
+# PR は担当者に自分を割り当て、GitHub の通知（Inbox）と「Assigned」の一覧に出す
+version: 2
+updates:
+  - package-ecosystem: nuget
+    directory: /
+    target-branch: dev
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Asia/Tokyo
+    assignees:
+      - msmsrep
+    commit-message:
+      prefix: "依存更新"
+    groups:
+      # Microsoft.* / System.* は同じサービシングで揃えて上げる（版がずれると NU1605 の格下げエラーになる）
+      dotnet:
+        patterns:
+          - "Microsoft.*"
+          - "System.*"
+        update-types:
+          - minor
+          - patch
+      others:
+        patterns:
+          - "*"
+        exclude-patterns:
+          - "Microsoft.*"
+          - "System.*"
+        update-types:
+          - minor
+          - patch
+
+  - package-ecosystem: github-actions
+    directory: /
+    target-branch: dev
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Asia/Tokyo
+    assignees:
+      - msmsrep
+    commit-message:
+      prefix: "依存更新"
+    groups:
+      actions:
+        patterns:
+          - "*"
diff --git a/.github/workflows/vulnerability.yml b/.github/workflows/vulnerability.yml
@@ -0,0 +1,66 @@
+# 依存パッケージの既知の脆弱性チェック（推移的な依存も含む）。見つかったら失敗させる
+# コードを触っていない期間に公開された脆弱性にも気づけるよう、週1回の定期実行もかける
+# （定期実行は既定ブランチ main で動く）
+name: Vulnerability
+
+on:
+  push:
+    branches: [main, dev]
+  pull_request:
+  schedule:
+    # 毎週月曜 09:00（JST）。Dependabot の確認と同じ時刻
+    - cron: "0 0 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: vulnerability-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  vulnerable-packages:
+    # ソリューションに MesApp.Desktop（net10.0-windows）を含むため Windows で復元する
+    runs-on: windows-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 10.0.x
+
+      # 警告をエラーにしているため、復元時の NuGet 監査（NU1901〜1904）で先に落ちて一覧が出ない。
+      # 復元では監査を止め、次の手順でパッケージ・重大度・アドバイザリを一覧にして判定する
+      - name: 復元
+        run: dotnet restore ParallelFactoryMES.slnx -p:NuGetAudit=false
+
+      - name: 脆弱なパッケージの確認
+        shell: pwsh
+        run: |
+          $json = dotnet list ParallelFactoryMES.slnx package --vulnerable --include-transitive --no-restore --format json | Out-String
+          if ($LASTEXITCODE -ne 0) { Write-Output $json; exit 1 }
+          $report = $json | ConvertFrom-Json
+          $found = foreach ($project in $report.projects) {
+            foreach ($framework in @($project.frameworks)) {
+              foreach ($package in @($framework.topLevelPackages) + @($framework.transitivePackages)) {
+                if (-not $package) { continue }
+                foreach ($v in @($package.vulnerabilities)) {
+                  [pscustomobject]@{
+                    Project  = Split-Path $project.path -Leaf
+                    Package  = $package.id
+                    Version  = $package.resolvedVersion
+                    Severity = $v.severity
+                    Advisory = $v.advisoryurl
+                  }
+                }
+              }
+            }
+          }
+          if ($found) {
+            $found | Sort-Object Package, Advisory -Unique | Format-Table -AutoSize | Out-String -Width 300 | Write-Output
+            Write-Output "::error::既知の脆弱性があるパッケージが $(@($found | Sort-Object Package -Unique).Count) 件あります。修正版へ更新してください。"
+            exit 1
+          }
+          Write-Output "脆弱なパッケージはありません。"
diff --git a/Spec.md b/Spec.md
diff --git a/dotnet-tools.json b/dotnet-tools.json
@@ -3,7 +3,7 @@
   "isRoot": true,
   "tools": {
     "dotnet-ef": {
-      "version": "10.0.10",
+      "version": "10.0.13",
       "commands": [
         "dotnet-ef"
       ],

diff --git a/src/MesApp.Api/Controllers/MaintenanceOrdersController.cs b/src/MesApp.Api/Controllers/MaintenanceOrdersController.cs
@@ -89,8 +89,10 @@ public async Task<ActionResult<MaintenanceOrderResponse>> Create(
     /// <summary>
     /// 保全実績の登録（E-40-30-01）。登録と同時に指示は完了。元計画は完了、
     /// 治工具メンテでresetToolLife指定時は寿命カウンタをリセットする（E-60-30）。
+    /// 在庫の引落し・設備の復帰・寿命のリセットまで動かすため、突発依頼と違い保全ロールに限る（Spec.md 7.4）。
     /// </summary>
     [HttpPost("{id:int}/record")]
+    [Authorize(Roles = MesRoleGroups.MaintenanceManage)]
     public async Task<ActionResult<MaintenanceOrderResponse>> AddRecord(
         int id, MaintenanceRecordRequest request, CancellationToken ct)
     {

diff --git a/src/MesApp.Api/MesApp.Api.csproj b/src/MesApp.Api/MesApp.Api.csproj
@@ -12,14 +12,14 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.10" />
-    <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.Server" Version="10.0.10" />
-    <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.10" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.10">
+    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.13" />
+    <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.Server" Version="10.0.13" />
+    <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.13" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.13">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>
-    <PackageReference Include="Microsoft.OpenApi" Version="2.11.0" />
+    <PackageReference Include="Microsoft.OpenApi" Version="2.12.2" />
   </ItemGroup>
 
   <ItemGroup>

diff --git a/src/MesApp.Api/Services/ActualCsvKinds.cs b/src/MesApp.Api/Services/ActualCsvKinds.cs
@@ -238,7 +238,7 @@ public static class ActualCsvKinds
             new("PartLocationCode", "払出元ロケーションコード", false, "消費部材を書くときは必須"),
             new("PartQuantity", "消費数量", false, "消費部材を書くときは必須"),
             new("PartNote", "部材の備考", false, null),
-        ]), AnyRole),
+        ]), MesRoleGroups.MaintenanceManage),
         new(new CsvKindInfo(ToolUsages, "治工具の利用実績", false,
         [
             new("ToolCode", "治工具コード", true, "登録済みで有効な治工具"),

diff --git a/src/MesApp.Client.Web/MesApp.Client.Web.csproj b/src/MesApp.Client.Web/MesApp.Client.Web.csproj
@@ -9,10 +9,10 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly" Version="10.0.10" />
-    <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.DevServer" Version="10.0.10" PrivateAssets="all" />
-    <PackageReference Include="Microsoft.AspNetCore.Components.Authorization" Version="10.0.10" />
-    <PackageReference Include="Microsoft.Extensions.Localization" Version="10.0.10" />
+    <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly" Version="10.0.13" />
+    <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.DevServer" Version="10.0.13" PrivateAssets="all" />
+    <PackageReference Include="Microsoft.AspNetCore.Components.Authorization" Version="10.0.13" />
+    <PackageReference Include="Microsoft.Extensions.Localization" Version="10.0.13" />
   </ItemGroup>
 
   <ItemGroup>

diff --git a/src/MesApp.Client.Web/Pages/Maintenance/MaintenanceOrdersTab.razor b/src/MesApp.Client.Web/Pages/Maintenance/MaintenanceOrdersTab.razor
@@ -121,8 +121,10 @@
                     <Pager TItem="MaintenanceOrderResponse" Result="_orders" OnPageChanged="LoadMaintenanceOrdersAsync" />
                 }
 
+                @* 保全実績の登録・取消は保全ロールだけ（APIと同じ定数。突発依頼の起票は全ロールに開いている） *@
                 @if (order.Status == MaintenanceOrderStatus.Instructed)
                 {
+                    <AuthorizeView Roles="@MesRoleGroups.MaintenanceManage" Context="mtRecord">
                     <div class="form-grid mt-2">
                         <div class="form-field">
                             <label>@L["開始時刻"]</label>
@@ -184,10 +186,9 @@
 
                     <div class="actions">
                         <button class="btn" disabled="@_busy" @onclick="() => AddRecordAsync(order)">@L["保全実績を登録"]</button>
-                        <AuthorizeView Roles="@MesRoleGroups.MaintenanceManage" Context="mtCancel">
-                            <button class="btn btn-danger" disabled="@_busy" @onclick="() => CancelOrderAsync(order.Id)">@L["取消"]</button>
-                        </AuthorizeView>
+                        <button class="btn btn-danger" disabled="@_busy" @onclick="() => CancelOrderAsync(order.Id)">@L["取消"]</button>
                     </div>
+                    </AuthorizeView>
                 }
             </div>
         }

diff --git a/src/MesApp.Core/MesApp.Core.csproj b/src/MesApp.Core/MesApp.Core.csproj
@@ -7,7 +7,7 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.Identity.Stores" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Identity.Stores" Version="10.0.13" />
   </ItemGroup>
 
 </Project>
diff --git a/src/MesApp.Infrastructure/MesApp.Infrastructure.csproj b/src/MesApp.Infrastructure/MesApp.Infrastructure.csproj
@@ -5,11 +5,13 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore" Version="10.0.10" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.10" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.10" />
+    <PackageReference Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore" Version="10.0.13" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.13" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.13" />
     <PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="10.0.3" />
     <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.4" />
+    <!-- SqlClient 6.1.1 が引く 9.0.4 に既知の脆弱性（GHSA-846f-f764-76mx）があるため、修正版を直接参照して上書きする -->
+    <PackageReference Include="System.Security.Cryptography.Pkcs" Version="10.0.13" />
   </ItemGroup>
 
   <ItemGroup>

diff --git a/tests/MesApp.Api.Tests/MaintenanceTests.cs b/tests/MesApp.Api.Tests/MaintenanceTests.cs
@@ -972,7 +972,7 @@ public async Task 指示発行済みの保全計画は指示を取り消すま
     }
 
     [Fact]
-    public async Task 突発の保全依頼は作業者も起票できるが計画保全は保全ロールのみ()
+    public async Task 突発の保全依頼は作業者も起票できるが計画保全と保全実績は保全ロールのみ()
     {
         using var factory = new ApiFactory();
         using var admin = await TestAuth.CreateAdminClientAsync(factory);
@@ -996,6 +996,19 @@ public async Task 突発の保全依頼は作業者も起票できるが計画
         var plan = await operator_.PostAsJsonAsync("/api/maintenance-plans",
             new MaintenancePlanRequest(equipment.Id, MaintenanceCategory.Periodic, 2026, null, null, null));
         Assert.Equal(HttpStatusCode.Forbidden, plan.StatusCode);
+
+        // 保全実績の登録は保全ロールのみ（在庫の引落し・設備の復帰・寿命のリセットを動かすため）。単票もCSVも同じ
+        var order = await spot.Content.ReadFromJsonAsync<MaintenanceOrderResponse>();
+        var record = await operator_.PostAsJsonAsync($"/api/maintenance-orders/{order!.Id}/record",
+            new MaintenanceRecordRequest(DateTimeOffset.Now.AddHours(-1), DateTimeOffset.Now, null, "点検完了", null));
+        Assert.Equal(HttpStatusCode.Forbidden, record.StatusCode);
+        var csv = await Phase3TestData.PostActualCsvAsync(operator_, "maintenance-records", $"""
+            MaintenanceNo,StartedAt
+            {order.OrderNo},2026-09-24 09:00
+            """);
+        Assert.Equal(HttpStatusCode.Forbidden, csv.StatusCode);
+        var unchanged = await admin.GetFromJsonAsync<MaintenanceOrderResponse>($"/api/maintenance-orders/{order.Id}");
+        Assert.Equal(MaintenanceOrderStatus.Instructed, unchanged!.Status);
     }
 
     [Fact]

diff --git a/tests/MesApp.Api.Tests/MesApp.Api.Tests.csproj b/tests/MesApp.Api.Tests/MesApp.Api.Tests.csproj
@@ -9,7 +9,7 @@
 
   <ItemGroup>
     <PackageReference Include="coverlet.collector" Version="6.0.4" />
-    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.10" />
+    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.13" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
     <PackageReference Include="xunit" Version="2.9.3" />
     <PackageReference Include="xunit.runner.visualstudio" Version="3.1.4" />