From 088c17f92028d331b2de09515a39073d2e2715c4 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 16 Sep 2026 21:34:35 +0000
Subject: [PATCH 1/3] Bump Sarif.Driver from 4.6.0 to 5.7.0

---
updated-dependencies:
- dependency-name: Sarif.Driver
  dependency-version: 5.7.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 src/Directory.Packages.props | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Directory.Packages.props b/src/Directory.Packages.props
index da0e12e1..f993d021 100644
--- a/src/Directory.Packages.props
+++ b/src/Directory.Packages.props
@@ -12,7 +12,7 @@
     <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.10.1" />
     <PackageVersion Include="Moq" Version="4.20.72" />
     <PackageVersion Include="Newtonsoft.Json" Version="13.0.4" />
-    <PackageVersion Include="Sarif.Driver" Version="4.6.0" />
+    <PackageVersion Include="Sarif.Driver" Version="5.7.0" />
     <PackageVersion Include="System.Collections.Immutable" Version="10.0.12" />
     <PackageVersion Include="System.Composition" Version="10.0.12" />
     <PackageVersion Include="System.Private.Uri" Version="4.3.2" />

From 1ccfa2bd06f3a19c0e2e4c9b5577bc69c001f812 Mon Sep 17 00:00:00 2001
From: Pratik Lade <prlade@microsoft.com>
Date: Wed, 16 Sep 2026 23:00:15 -0700
Subject: [PATCH 2/3] Preserve BinSkim hash output with Sarif.Driver 5

Explicitly request SHA-1 and SHA-256 when hash insertion is enabled so the Sarif.Driver 5 default change does not break BinSkim's existing --hashes contract.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 2779f142-ce84-4a8d-ba83-c0fb814808a7
---
 src/BinSkim.Driver/MultithreadedAnalyzeCommand.cs | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/BinSkim.Driver/MultithreadedAnalyzeCommand.cs b/src/BinSkim.Driver/MultithreadedAnalyzeCommand.cs
index 03d0c85d..87cb8155 100644
--- a/src/BinSkim.Driver/MultithreadedAnalyzeCommand.cs
+++ b/src/BinSkim.Driver/MultithreadedAnalyzeCommand.cs
@@ -299,6 +299,14 @@ protected override void AnalyzeTarget(
             IEnumerable<Skimmer<BinaryAnalyzerContext>> skimmers,
             ISet<string> disabledSkimmers)
         {
+            // Sarif.Driver 5 defaults to SHA-256 only, but BinSkim's --hashes contract emits both hashes.
+            if (context.DataToInsert.HasFlag(OptionallyEmittedData.Hashes))
+            {
+                context.Logger.FileRegionsCache = new FileRegionsCache(
+                    fileSystem: context.FileSystem,
+                    hashAlgorithms: HashAlgorithms.Sha1 | HashAlgorithms.Sha256);
+            }
+
             if (!context.IgnoreBinaryAnalysisErrors)
             {
                 base.AnalyzeTarget(context, skimmers, disabledSkimmers);

From 590b75dd4a7e7cd570dc9fd89538ad1558134933 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 12 Oct 2026 16:11:33 +0000
Subject: [PATCH 3/3] Align BinaryParsers Sarif.Driver dependency

Co-authored-by: plade <2185301+plade@users.noreply.github.com>
---
 src/Nuget/BinaryParsers.nuspec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Nuget/BinaryParsers.nuspec b/src/Nuget/BinaryParsers.nuspec
index b75325a2..af865c3d 100644
--- a/src/Nuget/BinaryParsers.nuspec
+++ b/src/Nuget/BinaryParsers.nuspec
@@ -17,7 +17,7 @@
     <iconUrl>https://go.microsoft.com/fwlink/?linkid=2008940</iconUrl>
     <dependencies>
       <group targetFramework=".NET9.0">
-        <dependency id="Sarif.Driver" version="4.5.4" exclude="Build,Analyzers" />
+        <dependency id="Sarif.Driver" version="5.7.0" exclude="Build,Analyzers" />
         <dependency id="ELFSharp" version="2.17.3" exclude="Build,Analyzers" />
         <dependency id="Newtonsoft.Json" version="13.0.3" exclude="Build,Analyzers" />
         <dependency id="System.Collections.Immutable" version="9.0.0" exclude="Build,Analyzers" />