From 989a91dc9cfa7c65fd7bbcb1436fa6a582efd5a5 Mon Sep 17 00:00:00 2001
From: Nikita Tsukanov <keks9n@gmail.com>
Date: Mon, 11 May 2026 00:16:55 +0500
Subject: [PATCH] Bump SharpCompress from 0.41.0 to 0.48.0 (#21339)

Addresses path traversal vulnerability GHSA-6c8g-7p36-r338
(CVE in IArchive.WriteToDirectory) which affects all versions
<= 0.47.4. Version 0.48.0 is the first non-vulnerable release
per the NuGet vulnerability API.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 Directory.Packages.props | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index 942a01d13b..b61a4bcfea 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -41,7 +41,7 @@
     <PackageVersion Include="NUnit" Version="4.5.1" />
     <PackageVersion Include="NUnit3TestAdapter" Version="6.2.0" />
     <PackageVersion Include="Quamotion.RemoteViewing" Version="1.1.211" />
-    <PackageVersion Include="SharpCompress" Version="0.41.0" />
+    <PackageVersion Include="SharpCompress" Version="0.48.0" />
     <PackageVersion Include="Silk.NET.Direct3D.Compilers" Version="2.22.0" />
     <PackageVersion Include="Silk.NET.Direct3D11" Version="2.22.0" />
     <PackageVersion Include="Silk.NET.Vulkan" Version="2.22.0" />