release: 1.0.2 — security patch (System.Security.Cryptography.Xml 8.0.4)

[systemslibrarian]

Prepares the security release for the fix merged in #24.

Why this matters

PostQuantum.DataProtection 1.0.1 declares System.Security.Cryptography.Xml 8.0.3 as a direct dependency, and .Aws, .AzureKeyVault, .Cli, .Fips, .OpenTelemetry, .Redis and .Testing all depend on the core package. So all eight published packages currently resolve a library affected by five HIGH-severity advisories:

GHSA-23rf-6693-g89p · GHSA-8q5v-6pqq-x66h · GHSA-cvvh-rhrc-wg4q · GHSA-g8r8-53c2-pm3f · GHSA-mmjf-rqrv-855v

Until 1.0.2 ships, every consumer of any of those eight packages is exposed. The fix is already on main; it just isn't on nuget.org.

What's here

• All 8 packable projects 1.0.1 → 1.0.2 (Version, plus FileVersion/InformationalVersion where present)
• CHANGELOG entry naming each advisory and its CVE
• README status line

Patch, not minor — no wire-format change, no public API change. Every 1.0.1 envelope decodes identically; drop-in over 1.0.1.

Known state at time of release

• CI coverage gate is red — 78.25% line / 69.32% branch against an 85%/75% target. Tracked in Coverage has drifted to 78.25% line / 69.32% branch (gate expects 85% / 75%) #25. This is pre-existing drift, not a regression: restore failed on every main commit from 2026-06-04 onward, so the gate has been unenforceable for two and a half months. All 108 tests pass with 0 skipped.
• Both Release 1.0.0 and Release 1.0.1 were cut from that same red build.

This does not publish anything

This repository has no release automation — no release.yml, and nothing in CI pushes to NuGet. v1.0.0 and v1.0.1 were published by hand. After merging you'll need to tag v1.0.2, then dotnet pack and dotnet nuget push the eight packages yourself.

Worth considering a release.yml modelled on the one in postquantum-file-encryption — its version gate caught a genuine docs/version mismatch during the 1.7.0 release today, before anything was published.

🤖 Generated with Claude Code