From 0a70f8feb253749fcd53ee4a9a6a63e52a9d39f3 Mon Sep 17 00:00:00 2001
From: mforce <3101827+mforce@users.noreply.github.com>
Date: Mon, 19 Oct 2026 22:30:21 +0000
Subject: [PATCH 1/2] ci: resubmit the NuGet dependency graph daily

Dependabot matched GHSA-qhrr-8q5h-9q3h (MessagePack) against the submitted graph only when the next snapshot arrived: published 2026-10-15 18:35 UTC, alerted 2026-10-16 17:24 UTC. A daily run bounds that delay to a day when main has no dependency push.

Refs #1291
---
 .github/workflows/dependency-submission.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.github/workflows/dependency-submission.yml b/.github/workflows/dependency-submission.yml
index c72c0b292..3eca93172 100644
--- a/.github/workflows/dependency-submission.yml
+++ b/.github/workflows/dependency-submission.yml
@@ -18,8 +18,15 @@ name: NuGet dependency submission
 #
 # Runs on push to main so the graph tracks the default branch, which is what
 # dependency-review diffs a PR against.
+#
+# Also runs daily (#1291): Dependabot matched a new advisory against the
+# submitted graph only when the next snapshot arrived. MessagePack's
+# GHSA-qhrr-8q5h-9q3h was published 2026-10-15 18:35 UTC and alerted
+# 2026-10-16 17:24 UTC, when a dependency push to main resubmitted.
 
 on:
+  schedule:
+    - cron: "30 5 * * *"
   push:
     branches:
       - main

From d56e5d23c1ab86baea64a3631d6c5bdc3ca0e63a Mon Sep 17 00:00:00 2001
From: mforce <3101827+mforce@users.noreply.github.com>
Date: Mon, 19 Oct 2026 22:30:46 +0000
Subject: [PATCH 2/2] docs(decisions): note the daily dependency submission in
 #146

---
 docs/decisions/146-ci-security-gates.md | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/docs/decisions/146-ci-security-gates.md b/docs/decisions/146-ci-security-gates.md
index 463641529..985cc02eb 100644
--- a/docs/decisions/146-ci-security-gates.md
+++ b/docs/decisions/146-ci-security-gates.md
@@ -45,8 +45,10 @@ entirely. The tree-scoped `dotnet list package --vulnerable
 covers those at PR time. All of this leaves
 dependency-review blind to a transitively-introduced vulnerable package.
 `.github/workflows/dependency-submission.yml` closes that: on a push to `main`
-touching the dependency set, Microsoft's component-detection reads the restore
-output and submits the resolved graph via the Dependency Submission API. npm needs
+touching the dependency set, and daily, Microsoft's component-detection reads the restore
+output and submits the resolved graph via the Dependency Submission API. The
+daily run exists because Dependabot matched a new advisory against the submitted
+graph only when the next snapshot arrived (#1291). npm needs
 none of this — the graph reads `web/package-lock.json` and already has the full tree.
 
 ### Dependabot NuGet PRs: automatic lock-file healing