Investigate resolving NU1903 for System.Security.Cryptography.Xml in Uno browserwasm sample head #526

Summary

Discovered while fixing #506's NU1605 restore blocker. Once TodoApp.Uno.csproj restores cleanly (Uno.Sdk bumped 5.4.5 -> 5.6.54), restoring the net10.0-browserwasm head surfaces two more NU1903 findings that were previously masked by the NU1605 restore failure:

warning NU1903: Package 'System.Security.Cryptography.Xml' 8.0.2 has a known high severity vulnerability, https://github.com/advisories/GHSA-37gx-xxp4-5rgx [TargetFramework=net10.0-browserwasm]
warning NU1903: Package 'System.Security.Cryptography.Xml' 8.0.2 has a known high severity vulnerability, https://github.com/advisories/GHSA-w3x6-4m5h-cxqf [TargetFramework=net10.0-browserwasm]

This is independent of the Tmds.DBus finding tracked in #506/#524 (different package, different head - browserwasm rather than desktop).

Ask

Investigate:

1. Where System.Security.Cryptography.Xml 8.0.2 is pulled in from for the net10.0-browserwasm head specifically (likely transitively via a browserwasm-specific Uno/WebAssembly package).
2. What patched version resolves both GHSA-37gx-xxp4-5rgx and GHSA-w3x6-4m5h-cxqf.
3. Whether a direct PackageReference/PackageVersion override (mirroring the SQLitePCLRaw.bundle_e_sqlite3 pattern from fix: resolve NU1903 for SQLitePCLRaw.lib.e_sqlite3 by pinning SQLitePCLRaw 3.x #498) is sufficient, or whether it requires a broader Uno.Sdk bump.

Related

• Investigate resolving NU1903 for Tmds.DBus in Uno desktop sample #506 - fixed the NU1605 restore blocker that was masking this finding.
• Major-version bump: Uno Platform 5 -> 6 (TodoApp.Uno sample) #524 - sibling NU1903 finding (Tmds.DBus) on the desktop head, requires a Uno 6.x major bump.