[Bug] Security warning/errors when restoring on net9preview

[nickrandolph]

Current behavior

Create new application using any of the template options
Update global.json to allow prerelease versions
Run dotnet restore

C:\temp\UnoApp15\UnoApp15\UnoApp15.csproj : warning NU1903: Package 'System.Formats.Asn1' 8.0.0 has a known high severity vulnerability, https://github.com/advisories/GHSA-447r-wph3-92pm
C:\temp\UnoApp15\UnoApp15\UnoApp15.csproj : warning NU1903: Package 'System.Private.Uri' 4.3.0 has a known high severity vulnerability, https://github.com/advisories/GHSA-5f2m-466j-3848
C:\temp\UnoApp15\UnoApp15\UnoApp15.csproj : warning NU1902: Package 'System.Private.Uri' 4.3.0 has a known moderate severity vulnerability, https://github.com/advisories/GHSA-x5qj-9vmx-7g6g
C:\temp\UnoApp15\UnoApp15\UnoApp15.csproj : warning NU1903: Package 'System.Private.Uri' 4.3.0 has a known high severity vulnerability, https://github.com/advisories/GHSA-xhfc-gr8f-ffwc
C:\temp\UnoApp15\UnoApp15\UnoApp15.csproj : warning NU1903: Package 'System.Text.Json' 8.0.0 has a known high severity vulnerability, https://github.com/advisories/GHSA-hh2w-p6rv-4g7w

Expected behavior

No security warnings/errors

How to reproduce it (as minimally and precisely as possible)

No response

Workaround

No response

Works on UWP/WinUI

None

Environment

No response

NuGet package version(s)

No response

Affected platforms

No response

IDE

No response

IDE version

No response

Relevant plugins

No response

Anything else we need to know?

No response

[Youssef1313]

These are false positives from NuGet. NuGet/Home#13622

[Youssef1313]

The possible options:

1. <NuGetAuditMode>direct</NuGetAuditMode>: If we go this way, it should be only during .NET 9 previews. Once stable, we shouldn't do this. I mean, it could just be a temporary easy workaround until we see if NuGet will fix things up on their side.
2. NuGetAuditSuppress MSBuild item: we could do this to specify specific advisories where we are sure it's a false positive.
3. Add direct PackageReference with non-vulnerable versions to silence NuGet warnings.

[Youssef1313]

The NuGet issue will not be fixed in .NET 9 stable

[Youssef1313]

@jeromelaban Do you have a preference on what we should do here?

[jeromelaban]

There's no good way for fixing this. All modes are causing trouble. We'll need to fix this in multiple locations, or workaround in multiple locations and this is going to either be a security risk, or very verbose change to the default templates.

[MrYossu]

.NET9 now in general release and this error swamps the output. I'm getting this...

warning NU1903: Package 'System.Private.Uri' 4.3.0 has a known high severity vulnerability

What should we do about it? The description for that package on Nuget explicitly says not to reference it directly.

Please advise what we are supposed to do. Thanks.