fix(deps): bump Testcontainers to 4.14.0 to clear the SSH.NET advisory

[maxiar]

Problem

dotnet restore fails for Integration.Tests and Integration.Middleware.Tests:

error NU1903: Warning As Error: Package 'SSH.NET' 2025.1.0 has a known high
severity vulnerability, https://github.com/advisories/GHSA-q939-rpr3-3284

SSH.NET is not a direct dependency, which is why it does not appear in Directory.Packages.props. It arrives transitively:

Testcontainers.PostgreSql / .Redis / .Minio (4.11.0)
  └── Testcontainers (4.11.0)
        └── SSH.NET (2025.1.0)

GHSA-q939-rpr3-3284 (high) — ScpClient recursive download allows arbitrary file write via server-controlled SCP filenames. Affects <= 2025.1.0; first patched in 2026.0.0.

Fix

Bump the three Testcontainers.* packages 4.11.0 → 4.14.0. Testcontainers 4.14.0 already depends on the patched SSH.NET 2026.0.0, so the advisory clears without adding a transitive pin under the "Transitive security pins" group — one less pin to remember to remove later.

Verification

• dotnet restore src/FSH.Starter.slnx — succeeds, all 51 projects, no NU1903.
• dotnet build on both integration test projects — 0 warnings / 0 errors under TreatWarningsAsErrors.
• Integration tests themselves were not run locally (they need Docker). Worth a CI eye, since this crosses three minor Testcontainers releases (4.11 → 4.14).

Notes

• Test-only dependency change: no runtime, endpoint, or config surface moves, so no docs-repo or changelog entry (golden rule 10 does not apply here).

🤖 Generated with Claude Code

[marcelo-maciel]

Merge order for the open batch, and what each merge breaks

Posting this here because this PR is the root of the chain: nothing else in the batch has a green Backend CI on a fresh clone until it lands. The pairwise conflicts below are not guesses; I ran git merge-tree over all 91 pairs of the fourteen open PRs and only the pairs that actually conflict are listed.

1. Infrastructure first: this PR, then #1375, then #1388

main today carries Microsoft.SourceLink.GitHub 8.0.0 and Testcontainers.* 4.11.0, which are the two advisories (NU1902/NU1903, the SSH.NET one being GHSA-q939-rpr3-3284), and it still pulls MinIO from Docker Hub, where the image no longer exists. The effect is that restore fails before compilation and every Testcontainers-backed test dies on the image pull, which is why so many PRs in this batch carry byte-identical copies of these three fixes just to reach their own code.

This PR is green. #1375 is red for exactly one reason: restore trips over the SSH.NET advisory that this PR clears. Its failing run is from 2026-09-09 and GitHub does not re-run a PR's checks when the base branch moves, so after this merges, #1375 needs gh pr update-branch 1375 (or any push to its branch) before it can go green. #1388 is independent of both and can land anywhere in this first group.

Once the three are in, the carried copies in #1377, #1379, #1380, #1382, #1383, #1384, #1385, #1386 and #1387 become redundant. Each of those branches will need update-branch, and two files conflict on essentially all of them: src/Directory.Packages.props (against this PR and #1375) and deploy/docker/README.md (against #1388). Both resolve to the same content on either side, so the resolution is mechanical, but it will not happen automatically.

2. Identity: #1377, then #1387, then the i18n chain

Three PRs write to the same Identity surface, and the order decides who pays.

• fix(identity): resolve front-end origin per-request for auth e-mail links #1377 → feat(localization): request localization, localized errors and user locale (1/4) #1381, and fix(identity): resolve front-end origin per-request for auth e-mail links #1377 → fix(identity): reject stale profile updates with ETag/If-Match instead of losing the write #1387: both conflict in src/Modules/Identity/Modules.Identity/Services/UserProfileService.cs. Small, one file.
• feat(localization): request localization, localized errors and user locale (1/4) #1381 → fix(identity): reject stale profile updates with ETag/If-Match instead of losing the write #1387: eight files conflict, including UserDto, IUserProfileService, IUserService, UpdateUserCommand, UpdateUserCommandHandler, UserProfileService, UserService and UpdateUserCommandHandlerTests. This is the expensive one, and it is unavoidable: feat(localization): request localization, localized errors and user locale (1/4) #1381 adds a locale field to the same command and DTO that fix(identity): reject stale profile updates with ETag/If-Match instead of losing the write #1387 rewrites for the ETag precondition. Only the order changes who resolves it.
• feat(dashboard): localize the tenant app with react-i18next (4/4) #1384 → fix(identity): reject stale profile updates with ETag/If-Match instead of losing the write #1387: clients/dashboard/src/api/identity.ts, topbar.tsx and settings/profile.tsx. On top of the textual conflict there is a type break: fix(identity): reject stale profile updates with ETag/If-Match instead of losing the write #1387 changes the updateMyProfile signature and deletes getMyProfile, both of which feat(dashboard): localize the tenant app with react-i18next (4/4) #1384's language switcher calls, so whichever merges second fails tsc -b in Frontend CI until the switcher is adapted.

Recommended order: #1377, then #1387, then #1381 → #1382 → #1383 → #1384. #1377 is the smallest of the three and unblocks the others; #1387 is a data-loss fix and is ready, while the i18n chain is still in review and can absorb the adaptation. #1384 adapts its switcher to getMyProfileWithETag, passing profile, expectedETag and locale.

3. Mailing: #1380 before #1385

#1385 is cut from #1380: it deletes EmailBodies.cs and replaces it with BuildingBlocks/Mailing/HtmlEmail.cs. They do not conflict textually, because #1385 already contains #1380's content, but merging them the other way round reintroduces a file the refactor exists to delete.

4. Independent

#1378 conflicts with nothing in the batch. #1379 and #1386 carry the same trust-list commit content-identically, so either order works and the second one's copy drops as an empty cherry-pick.

Why #1382's Backend CI is red

It is ordering, not code: PagedQueryValidator.cs references FSH.Framework.Core.Localization.SharedResources, which only exists once #1381 lands. Against main it could not compile, and retargeting it at #1381's branch is not available, since the base of a cross-fork PR has to be a branch in this repository. #1382 therefore carries #1381 until that one merges, which is what turns its Backend CI green.

[marcelo-maciel]

Reviewed, and verified rather than assumed: the bump is sufficient on its own.

I checked the package metadata instead of trusting the release notes. Testcontainers 4.11.0 declares <dependency id="SSH.NET" version="2025.1.0" />, which is the vulnerable one (GHSA-q939-rpr3-3284), and 4.14.0 declares <dependency id="SSH.NET" version="2026.0.0" />, which is the first patched release. So this single bump clears NU1903 at restore time with no transitive pin needed.

That is worth stating explicitly because several PRs in the current batch carry their own <PackageVersion Include="SSH.NET" Version="2026.0.0" /> pin, added when 4.11.0 and 4.13.0 were the only options and bumping Testcontainers genuinely did not help. Once this lands, that pin is redundant and its comment is out of date; it should come out when those branches drop their carried copies of this fix.

One cosmetic nit, take it or leave it: the diff leaves a blank line before </ItemGroup> that was not there before.