.Net: Bump Scriban from 7.1.0 to 7.2.0 to address GHSA-24c8-4792-22hx

[jluocsa]

What

Bumps Scriban from 7.1.0 to 7.2.0 in dotnet/Directory.Packages.props to clear GHSA-24c8-4792-22hx (High, CVSS 8.7).

Why

Scriban ≤ 7.1.0 has a known high-severity DoS in ArrayFunctions.InsertAt: the array.insert_at template builtin allocates index - list.Count null entries in a tight loop with no bound, bypassing LoopLimit, LimitToString, RecursiveLimit, and ObjectRecursionLimit. A one-line template such as {{ [1] | array.insert_at 200000000 'x' | array.size }} OOMs the host process in ~600 ms. Patched in Scriban 7.2.0.

NuGet now flags this as NU1903 on restore. Combined with dotnet build … --warnaserror in the Debug CI legs (dotnet/.github/workflows/dotnet-build-and-test.yml), every open .NET PR (#14030, #14029, …) is currently failing on three projects that reference Scriban transitively or directly:

• dotnet/samples/Concepts/Concepts.csproj
• dotnet/src/Functions/Functions.Prompty/Functions.Prompty.csproj
• dotnet/src/Functions/Functions.Prompty.UnitTests/Functions.Prompty.UnitTests.csproj

error NU1903: Package 'Scriban' 7.1.0 has a known high severity vulnerability,
https://github.com/advisories/GHSA-24c8-4792-22hx

How

Single-line bump in Directory.Packages.props (central package management — all three projects inherit). No source changes needed; the advisory affects a runtime template builtin not exercised by SK's tests.

Validation

Locally on Windows with .NET 10.0.100 SDK, GITHUB_ACTIONS=true, mirroring the CI build command:

dotnet build dotnet\src\Functions\Functions.Prompty\Functions.Prompty.csproj -c Debug --warnaserror
  Build succeeded.    0 Warning(s)    0 Error(s)

dotnet build dotnet\src\Functions\Functions.Prompty.UnitTests\Functions.Prompty.UnitTests.csproj -c Debug --warnaserror
  Build succeeded.    0 Warning(s)    0 Error(s)

Targeted Redis unit tests still pass (109/109) — sanity check that nothing transitive broke.

Release notes

Bump Scriban from 7.1.0 to 7.2.0 to address GHSA-24c8-4792-22hx (CVSS 8.7 High).

Contribution Checklist

• The code builds clean without any errors or warnings
• The PR follows the SK Contribution Guidelines and the pre-submission formatting script raises no violations
• All unit tests pass, and I have added new tests where possible
• I didn't break anyone 😄

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates the central .NET package version configuration to bump Scriban.

Changes:

• Bumped Scriban NuGet package version from 7.1.0 to 7.2.0.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

Automated Code Review

Reviewers: 4 | Confidence: 95% | Result: All clear

Reviewed: Correctness, Security Reliability, Test Coverage, Design Approach

---

Automated review by jluocsa's agents