Security: Upgrade Scriban from 6.2.0 to address known vulnerabilities

[dnyw4l3n13]

Summary

Package Scriban 6.2.0 has multiple known vulnerabilities. Currently suppressed in src/BuildBot/BuildBot.csproj pending upgrade.

CVEs to address

• GHSA-24c8-4792-22hx (high)
• GHSA-5rpf-x9jg-8j5p (moderate)
• GHSA-5wr9-m6jw-xx44 (critical)
• GHSA-c875-h985-hvrc (high)
• GHSA-grr9-747v-xvcp (high)
• GHSA-m2p3-hwv5-xpqw (moderate)
• GHSA-p6q4-fgr8-vx4p (high)
• GHSA-v66j-x4hw-fv9g (high)
• GHSA-wgh7-7m3c-fx25 (high)
• GHSA-x6m9-38vm-2xhf (high)
• GHSA-xcx6-vp38-8hr5 (high)
• GHSA-xw6w-9jjh-p9cr (moderate)

Action required

Upgrade Scriban to a version that resolves all listed advisories and remove the suppression entries.

[credfeto]

Implementation Plan

Files to change

• src/BuildBot/BuildBot.csproj: delete the 12-entry NuGetAuditSuppress ItemGroup (lines 118-133) and its two preceding comment lines referencing Scriban 6.2.0.
• src/BuildBot.Discord/BuildBot.Discord.csproj: delete the 3-entry NuGetAuditSuppress block (GHSA-5rpf-x9jg-8j5p, GHSA-grr9-747v-xvcp, GHSA-wgh7-7m3c-fx25) and its comments.

Approach

Scriban was never a direct dependency - it was pulled in transitively, build-time only, by Mediator.SourceGenerator. The suppression was added on 26 May while the repo was pinned to Mediator.SourceGenerator 3.0.1, whose nuspec depends on Scriban 6.2.0. On 22 Jun, Mediator.SourceGenerator was bumped to 3.0.2 (already in main), whose nuspec dependency group is empty - Scriban was dropped upstream entirely. Verified empirically: with the suppressions stripped, a clean dotnet build of BuildBot.csproj produces 0 warnings/0 errors, and Scriban does not appear anywhere in any of the 8 projects' restored project.assets.json. No direct PackageReference to Scriban is needed - the suppressions are now dead weight and can simply be deleted.

Test strategy

dotnet restore + dotnet build across the solution after removing the suppressions; confirm 0 warnings/errors and that NU1902/NU1903 do not fire for Scriban. Already verified manually during triage.

Assumptions

None, ready to proceed pending approval.

Open questions

None, ready to proceed pending approval.

[dnyw4l3n13]

Picking up this issue. An implementation plan is already posted above (by @credfeto, 2026-07-30) covering removal of the now-dead NuGetAuditSuppress entries in src/BuildBot/BuildBot.csproj and src/BuildBot.Discord/BuildBot.Discord.csproj. That plan's own text ends with "ready to proceed pending approval," and the Workflow board status for this issue is still "Not Started" - there is no recorded human approval yet.

Adopting that plan as-is rather than re-posting a duplicate. Marking this Blocked and setting the board to Planning until a human sets Workflow Status to Approved and removes Blocked.