diff --git a/CHANGELOG.md b/CHANGELOG.md
index 29c3c36..d41dc96 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,16 @@
All notable changes to this project are documented here.
This project follows [Semantic Versioning](https://semver.org/).
+## [Unreleased]
+
+### Security
+- **Aspire moved from 13.6.4 to 13.6.5**, for
+ [GHSA-f7vh-h5g3-7jrh](https://github.com/advisories/GHSA-f7vh-h5g3-7jrh) (CVE-2026-120006), an
+ elevation-of-privilege vulnerability in `Aspire.Hosting` and `Aspire.Hosting.AppHost` below
+ 13.6.5. Only the local AppHost uses Aspire; no shipped package depends on it, so nothing
+ that consumes the library is affected. NuGet's audit fails the restore on 13.6.4, which is what
+ this unblocks.
+
## [1.0.0-preview.2] — 2026-10-26
Makes `UseAuditing(sp)` usable in a context that DotNetBoost.MultiLingual also saves to. 493 tests
diff --git a/Directory.Packages.props b/Directory.Packages.props
index 335e990..6e31645 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -31,13 +31,13 @@
chosen here rather than by a direct pin of something only Aspire uses.
────────────────────────────────────────────────────────────────────────── -->
-
-
+
+
-
+
-
-
+
+
diff --git a/aspire/DotNetBoost.Auditing.AppHost/AppHost.cs b/aspire/DotNetBoost.Auditing.AppHost/AppHost.cs
index 02d1f28..3f609ae 100644
--- a/aspire/DotNetBoost.Auditing.AppHost/AppHost.cs
+++ b/aspire/DotNetBoost.Auditing.AppHost/AppHost.cs
@@ -66,7 +66,7 @@
// Mongo Express is the counterpart to WithPgWeb, and worth opening once: an entry here is ONE
// document with its property changes embedded, where next door it is a row plus a row per property.
//
-// This is a STANDALONE mongod — Aspire.Hosting.MongoDB 13.6.4 does have WithReplicaSet, but this
+// This is a STANDALONE mongod — Aspire.Hosting.MongoDB 13.6.5 does have WithReplicaSet, but this
// AppHost does not call it yet — so transactions are not available, and the store's
// WithSession(session) has nothing to enlist in.
// That is not hidden from the sample: POST /api/products/{id}/fail exists to show the window it
diff --git a/aspire/DotNetBoost.Auditing.AppHost/DotNetBoost.Auditing.AppHost.csproj b/aspire/DotNetBoost.Auditing.AppHost/DotNetBoost.Auditing.AppHost.csproj
index 94ef0cb..ac11a77 100644
--- a/aspire/DotNetBoost.Auditing.AppHost/DotNetBoost.Auditing.AppHost.csproj
+++ b/aspire/DotNetBoost.Auditing.AppHost/DotNetBoost.Auditing.AppHost.csproj
@@ -5,7 +5,7 @@
Version-locked to the Aspire.Hosting.* packages in Directory.Packages.props, which is
where the reason for this particular number is written down. -->
-
+
Exe