From 255ad2df2f8a602f535cd57c62336fbff3b5321d Mon Sep 17 00:00:00 2001 From: kevin Date: Wed, 14 Oct 2026 21:12:20 +0200 Subject: [PATCH] Pin Microsoft.Windows.Compatibility to the patched 10.0.13 for the wasm head Uno.Sdk 6.5.36 pins Microsoft.Windows.Compatibility to 10.0.7 for the browserwasm head only, through its packages.json group WindowsCompatibility and Uno.Implicit.Packages.ProjectSystem.Wasm.targets. That carries System.Security.Cryptography.Pkcs 10.0.7, which GHSA-2fmv-rv2c-59x7 flags as moderate, so NuGet raises NU1902 and TreatWarningsAsErrors turns it into a build error. Restore covers every target framework regardless of the -f flag, so it broke builds of all heads and not only wasm. 10.0.13 is the first patched 10.0.x release. Setting it through the SDK per-group override property WindowsCompatibilityVersion avoids both a direct reference to a package the app never calls and enabling transitive pinning across central package management. Drop the line once the Uno.Sdk pinned in global.json ships 10.0.13 or newer. Verified: Pkcs now resolves to 10.0.13 and all four buildable heads build with zero errors without any NU1902 suppression. Co-Authored-By: Claude Opus 5 (cherry picked from commit 2d46c19b3648441a6b631f5e743a8f20367f855f) --- Source/Trackify/Trackify.csproj | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/Source/Trackify/Trackify.csproj b/Source/Trackify/Trackify.csproj index 60f6762..a3d4f15 100644 --- a/Source/Trackify/Trackify.csproj +++ b/Source/Trackify/Trackify.csproj @@ -10,6 +10,14 @@ flagged NU1903 — accepted repo-wide (as in Infrastructure/CLI), so don't fail the build. --> $(NoWarn);NU1903 + + 10.0.13 + Trackify