[release/9.0.1xx] Build break: error NU1903: Warning As Error: Package has a known high severity vulnerability

[MichaelSimons]

This is affecting several legs in this failing build (Internal Microsoft link)

    /vmr/src/arcade/src/Microsoft.DotNet.NuGetRepack/tasks/Microsoft.DotNet.NuGetRepack.Tasks.csproj : error NU1903: Warning As Error: Package 'System.IO.Packaging' 9.0.0-rc.1.24431.7 has a known high severity vulnerability, https://github.com/advisories/GHSA-f32c-w444-8ppv [/vmr/src/arcade/Arcade.sln]

##[error]/vmr/src/arcade/src/Microsoft.DotNet.NuGetRepack/tasks/Microsoft.DotNet.NuGetRepack.Tasks.csproj(0,0): error NU1903: (NETCORE_ENGINEERING_TELEMETRY=Restore) Warning As Error: Package 'System.IO.Packaging' 9.0.0-rc.1.24431.7 has a known high severity vulnerability, https://github.com/advisories/GHSA-f32c-w444-8ppv

[MichaelSimons]

This is blocking PRs as well. Example - https://dev.azure.com/dnceng-public/public/_build/results?buildId=835442&view=logs&j=609589e2-4f74-5576-cdb7-914bcaea778b&t=5ba03121-3cea-598c-07fa-53815ace41ff

[MichaelSimons]

Does this need dotnet/sdk#43993 to fix?

[MichaelSimons]

Perhaps we need to globally no-warn NU1903 to unblock. The fsharp fix needed to unblock dotnet/sdk#43993 won't pass PR validation because of this issue.

[MichaelSimons]

This was fixed by dotnet/sdk#44028.