7 high-severity advisories via Nuke.Common in build/Build.csproj

[jeremydmiller]

build/Build.csproj pulls seven high-severity advisories plus one low, transitively:

Nuke.Common 10.1.0
  └─ NuGet.Packaging 6.12.1                      (NU1901, low: GHSA-g4vj-cjjj-v7hg)
       └─ System.Security.Cryptography.Xml 9.0.0 (NU1903 x7, high)

The seven on System.Security.Cryptography.Xml: GHSA-23rf-6693-g89p, GHSA-37gx-xxp4-5rgx, GHSA-8q5v-6pqq-x66h, GHSA-cvvh-rhrc-wg4q, GHSA-g8r8-53c2-pm3f, GHSA-mmjf-rqrv-855v, GHSA-w3x6-4m5h-cxqf.

Why it went unnoticed

build/Build.csproj is marked <Build Project="false" /> in jasperfx.slnx, so dotnet restore jasperfx.slnx skips it. Only ./build.sh restores it — which means these warnings appear in CI logs but not in a local solution restore. Found by grepping the CI log on #579 after that PR cleared the MessagePack advisories.

Severity in context

Lower real-world risk than a shipped dependency: this is the Nuke build orchestrator, dev/CI-time only, never packaged or shipped to consumers. But it's seven high-severity advisories on every build, and it makes CI restore output permanently noisy.

Can't be fixed by bumping Nuke

Nuke.Common 10.1.0 is already the latest release. This is blocked upstream until Nuke ships against a newer NuGet.Packaging.

Proposed fix

Add a direct pin in build/Build.csproj to float the transitive up:

<PackageReference Include="System.Security.Cryptography.Xml" Version="9.0.18" />

9.0.18 is the patched floor covering all seven (per the GitHub Advisory DB; 9.0.15 clears only four of them). This is contained and low-risk:

• build/ already opts out of central package management via its own Directory.Packages.props (see chore: migrate to .slnx and enable central package management #576), so an inline version is the established pattern there.
• Nothing is shipped from build/, so adding a dependency has zero consumer impact.

Worth also re-checking NuGet.Packaging after the bump — the low-severity GHSA-g4vj-cjjj-v7hg on 6.12.1 is separate and may still need Nuke to move.

Verification

dotnet restore build/Build.csproj should come back free of NU1901/NU1903, and ./build.sh test should stay green.