依存パッケージの脆弱性を修正し、更新確認と脆弱性チェックを定期実行する

.github/dependabot.yml

@@ -0,0 +1,51 @@
+# 依存パッケージの更新確認（週1回）。更新があれば dev 向けの PR を作る
+# PR は担当者に自分を割り当て、GitHub の通知（Inbox）と「Assigned」の一覧に出す
+version: 2
+updates:
+  - package-ecosystem: nuget
+    directory: /
+    target-branch: dev
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Asia/Tokyo
+    assignees:
+      - msmsrep
+    commit-message:
+      prefix: "依存更新"
+    groups:
+      # Microsoft.* / System.* は同じサービシングで揃えて上げる（版がずれると NU1605 の格下げエラーになる）
+      dotnet:
+        patterns:
+          - "Microsoft.*"
+          - "System.*"
+        update-types:
+          - minor
+          - patch
+      others:
+        patterns:
+          - "*"
+        exclude-patterns:
+          - "Microsoft.*"
+          - "System.*"
+        update-types:
+          - minor
+          - patch
+
+  - package-ecosystem: github-actions
+    directory: /
+    target-branch: dev
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Asia/Tokyo
+    assignees:
+      - msmsrep
+    commit-message:
+      prefix: "依存更新"
+    groups:
+      actions:
+        patterns:
+          - "*"

.github/workflows/vulnerability.yml

@@ -0,0 +1,66 @@
+# 依存パッケージの既知の脆弱性チェック（推移的な依存も含む）。見つかったら失敗させる
+# コードを触っていない期間に公開された脆弱性にも気づけるよう、週1回の定期実行もかける
+# （定期実行は既定ブランチ main で動く）
+name: Vulnerability
+
+on:
+  push:
+    branches: [main, dev]
+  pull_request:
+  schedule:
+    # 毎週月曜 09:00（JST）。Dependabot の確認と同じ時刻
+    - cron: "0 0 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: vulnerability-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  vulnerable-packages:
+    # ソリューションに MesApp.Desktop（net10.0-windows）を含むため Windows で復元する
+    runs-on: windows-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 10.0.x
+
+      # 警告をエラーにしているため、復元時の NuGet 監査（NU1901〜1904）で先に落ちて一覧が出ない。
+      # 復元では監査を止め、次の手順でパッケージ・重大度・アドバイザリを一覧にして判定する
+      - name: 復元
+        run: dotnet restore ParallelFactoryMES.slnx -p:NuGetAudit=false
+
+      - name: 脆弱なパッケージの確認
+        shell: pwsh
+        run: |
+          $json = dotnet list ParallelFactoryMES.slnx package --vulnerable --include-transitive --no-restore --format json | Out-String
+          if ($LASTEXITCODE -ne 0) { Write-Output $json; exit 1 }
+          $report = $json | ConvertFrom-Json
+          $found = foreach ($project in $report.projects) {
+            foreach ($framework in @($project.frameworks)) {
+              foreach ($package in @($framework.topLevelPackages) + @($framework.transitivePackages)) {
+                if (-not $package) { continue }
+                foreach ($v in @($package.vulnerabilities)) {
+                  [pscustomobject]@{
+                    Project  = Split-Path $project.path -Leaf
+                    Package  = $package.id
+                    Version  = $package.resolvedVersion
+                    Severity = $v.severity
+                    Advisory = $v.advisoryurl
+                  }
+                }
+              }
+            }
+          }
+          if ($found) {
+            $found | Sort-Object Package, Advisory -Unique | Format-Table -AutoSize | Out-String -Width 300 | Write-Output
+            Write-Output "::error::既知の脆弱性があるパッケージが $(@($found | Sort-Object Package -Unique).Count) 件あります。修正版へ更新してください。"
+            exit 1
+          }
+          Write-Output "脆弱なパッケージはありません。"

dotnet-tools.json

@@ -3,7 +3,7 @@
   "isRoot": true,
   "tools": {
     "dotnet-ef": {
-      "version": "10.0.10",
+      "version": "10.0.13",
       "commands": [
         "dotnet-ef"
       ],

src/MesApp.Api/MesApp.Api.csproj

@@ -12,14 +12,14 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.10" />
-    <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.Server" Version="10.0.10" />
-    <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.10" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.10">
+    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.13" />
+    <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.Server" Version="10.0.13" />
+    <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.13" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.13">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>
-    <PackageReference Include="Microsoft.OpenApi" Version="2.11.0" />
+    <PackageReference Include="Microsoft.OpenApi" Version="2.12.2" />
   </ItemGroup>
 
   <ItemGroup>

src/MesApp.Client.Web/MesApp.Client.Web.csproj

@@ -9,10 +9,10 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly" Version="10.0.10" />
-    <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.DevServer" Version="10.0.10" PrivateAssets="all" />
-    <PackageReference Include="Microsoft.AspNetCore.Components.Authorization" Version="10.0.10" />
-    <PackageReference Include="Microsoft.Extensions.Localization" Version="10.0.10" />
+    <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly" Version="10.0.13" />
+    <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.DevServer" Version="10.0.13" PrivateAssets="all" />
+    <PackageReference Include="Microsoft.AspNetCore.Components.Authorization" Version="10.0.13" />
+    <PackageReference Include="Microsoft.Extensions.Localization" Version="10.0.13" />
   </ItemGroup>
 
   <ItemGroup>

src/MesApp.Core/MesApp.Core.csproj

@@ -7,7 +7,7 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.Identity.Stores" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Identity.Stores" Version="10.0.13" />
   </ItemGroup>
 
 </Project>

src/MesApp.Infrastructure/MesApp.Infrastructure.csproj

@@ -5,11 +5,13 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore" Version="10.0.10" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.10" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.10" />
+    <PackageReference Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore" Version="10.0.13" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.13" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.13" />
     <PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="10.0.3" />
     <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.4" />
+    <!-- SqlClient 6.1.1 が引く 9.0.4 に既知の脆弱性（GHSA-846f-f764-76mx）があるため、修正版を直接参照して上書きする -->
+    <PackageReference Include="System.Security.Cryptography.Pkcs" Version="10.0.13" />
   </ItemGroup>
 
   <ItemGroup>

tests/MesApp.Api.Tests/MesApp.Api.Tests.csproj

@@ -9,7 +9,7 @@
 
   <ItemGroup>
     <PackageReference Include="coverlet.collector" Version="6.0.4" />
-    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.10" />
+    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.13" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
     <PackageReference Include="xunit" Version="2.9.3" />
     <PackageReference Include="xunit.runner.visualstudio" Version="3.1.4" />