fix: resolve remaining sample package drift and Microsoft.OpenApi NU1903 (#489) (#493)

- Bump samples/todoapp-mvc Microsoft.EntityFrameworkCore.SqlServer 10.0.3 -> 10.0.9
  to match the repo's EFCoreVersion (missed in #485).
- Bump stray Microsoft.AspNetCore.Components.WebAssembly*/Microsoft.Extensions.Http
  pins in todoapp-blazor-wasm from 10.0.3 -> 10.0.9.
- Bump Microsoft.EntityFrameworkCore (Avalonia), Microsoft.Extensions.Logging.Debug
  (MAUI), Microsoft.Extensions.DependencyInjection (WinUI3), and
  System.Text.Json/System.Formats.Asn1/System.IO.Packaging (Uno, local CPM) from
  10.0.3 -> 10.0.9 across the todoapp client-platform samples.
- Bump CommunityToolkit.Datasync.Client 10.0.0 -> 10.1.0 across every client
  sample (Avalonia, MAUI, Uno, WPF, WinUI3, todoapp-tutorial/ClientApp,
  todoapp-blazor-wasm/Client) to match the latest published package, alongside
  the already-updated 10.1.0 server samples.
- Pin Microsoft.OpenApi to 2.7.5 in root Directory.Packages.props to resolve the
  NU1903 high-severity advisory (GHSA-v5pm-xwqc-g5wc) on the 2.0.0 version
  floated transitively via Microsoft.AspNetCore.OpenApi/NSwag.AspNetCore/
  Swashbuckle.AspNetCore. CentralPackageTransitivePinningEnabled propagates this
  through project references into samples/datasync-server and
  samples/datasync-server-cosmosdb-singlecontainer without needing per-sample
  pins; verified every restored project.assets.json in the repo now resolves
  Microsoft.OpenApi/2.7.5.

The remaining NU1903 advisory (SQLitePCLRaw.lib.e_sqlite3, GHSA-2m69-gcr7-jv3q)
has no patched version available and is tracked separately in #492.

Verified: dotnet restore/build/test on Datasync.Toolkit.sln (2280+ tests
passing across all suites), plus restore+build for every affected sample
solution/project (todoapp-mvc, todoapp-blazor-wasm, datasync-server,
datasync-server-cosmosdb-singlecontainer, todoapp-tutorial, TodoApp.Avalonia,
TodoApp.Avalonia.Desktop, TodoApp.WPF). TodoApp.MAUI/TodoApp.Uno mobile TFMs
and TodoApp.WinUI3 build could not be fully exercised in this environment due
to missing Android/iOS/Windows workloads, but package restore succeeded up to
that point, confirming the version pins resolve cleanly.

Co-authored-by: ahall <ahall@cloudflare.com>

Author: adrianhall

Directory.Packages.props

@@ -31,6 +31,14 @@
     <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="$(DotNetVersion)" />
     <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.6.0" />
     <PackageVersion Include="Microsoft.OData.Core" Version="$(ODataVersion)" />
+    <!--
+      Microsoft.AspNetCore.OpenApi/NSwag.AspNetCore/Swashbuckle.AspNetCore all float a transitive
+      dependency on Microsoft.OpenApi 2.0.0, which has a known high-severity vulnerability (NU1903,
+      GHSA-v5pm-xwqc-g5wc - a crafted OpenAPI document with a circular schema reference can crash the
+      process). Pin explicitly to the patched 2.x release; CentralPackageTransitivePinningEnabled above
+      forces this version across all transitive references.
+    -->
+    <PackageVersion Include="Microsoft.OpenApi" Version="2.7.5" />
     <PackageVersion Include="Microsoft.SourceLink.GitHub" Version="10.0.300" />
     <PackageVersion Include="Microsoft.Spatial" Version="8.4.3" />
     <PackageVersion Include="Newtonsoft.Json" Version="13.0.4" />

samples/todoapp-blazor-wasm/TodoApp.BlazorWasm.Client/TodoApp.BlazorWasm.Client.csproj

@@ -7,10 +7,10 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="CommunityToolkit.Datasync.Client" Version="10.0.0" />
-    <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly" Version="10.0.3" />
-    <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.DevServer" Version="10.0.3" PrivateAssets="all" />
-    <PackageReference Include="Microsoft.Extensions.Http" Version="10.0.3" />
+    <PackageReference Include="CommunityToolkit.Datasync.Client" Version="10.1.0" />
+    <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly" Version="10.0.9" />
+    <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.DevServer" Version="10.0.9" PrivateAssets="all" />
+    <PackageReference Include="Microsoft.Extensions.Http" Version="10.0.9" />
   </ItemGroup>
 
   <ItemGroup>

samples/todoapp-blazor-wasm/TodoApp.BlazorWasm.Server/TodoApp.BlazorWasm.Server.csproj

@@ -11,7 +11,7 @@
     <PackageReference Include="CommunityToolkit.Datasync.Server.EntityFrameworkCore" Version="10.1.0" />
     <PackageReference Include="Microsoft.EntityFrameworkCore" Version="10.0.9" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" Version="10.0.9" />
-    <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.Server" Version="10.0.3" />
+    <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.Server" Version="10.0.9" />
   </ItemGroup>
 
   <ItemGroup>

samples/todoapp-mvc/TodoApp.Service/TodoApp.Service.csproj

@@ -9,7 +9,7 @@
   <ItemGroup>
     <PackageReference Include="CommunityToolkit.Datasync.Server" Version="10.1.0" />
     <PackageReference Include="CommunityToolkit.Datasync.Server.EntityFrameworkCore" Version="10.1.0" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.3" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.9" />
     <PackageReference Include="Microsoft.Web.LibraryManager.Build" Version="3.0.71" />
   </ItemGroup>
 

samples/todoapp-tutorial/ClientApp/ClientApp.csproj

@@ -9,7 +9,7 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="CommunityToolkit.Datasync.Client" Version="10.0.0" />
+    <PackageReference Include="CommunityToolkit.Datasync.Client" Version="10.1.0" />
     <PackageReference Include="CommunityToolkit.Mvvm" Version="8.4.0" />
   </ItemGroup>
 

samples/todoapp/TodoApp.Avalonia/TodoApp.Avalonia/TodoApp.Avalonia.csproj

@@ -16,8 +16,8 @@
         <PackageReference Include="Avalonia.Fonts.Inter" Version="11.3.0" />
         <!--Condition below is needed to remove Avalonia.Diagnostics package from build output in Release configuration.-->
         <PackageReference Condition="'$(Configuration)' == 'Debug'" Include="Avalonia.Diagnostics" Version="11.3.0" />
-        <PackageReference Include="CommunityToolkit.Datasync.Client" Version="10.0.0" />
+        <PackageReference Include="CommunityToolkit.Datasync.Client" Version="10.1.0" />
         <PackageReference Include="CommunityToolkit.Mvvm" Version="8.4.0" />
-        <PackageReference Include="Microsoft.EntityFrameworkCore" Version="10.0.3" />
+        <PackageReference Include="Microsoft.EntityFrameworkCore" Version="10.0.9" />
     </ItemGroup>
 </Project>

samples/todoapp/TodoApp.MAUI/TodoApp.MAUI.csproj

@@ -50,10 +50,10 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="CommunityToolkit.Datasync.Client" Version="10.0.0" />
+    <PackageReference Include="CommunityToolkit.Datasync.Client" Version="10.1.0" />
     <PackageReference Include="CommunityToolkit.Mvvm" Version="8.4.0" />
     <PackageReference Include="Microsoft.Maui.Controls" Version="10.0.40" />
-    <PackageReference Include="Microsoft.Extensions.Logging.Debug" Version="10.0.3" />
+    <PackageReference Include="Microsoft.Extensions.Logging.Debug" Version="10.0.9" />
   </ItemGroup>
 
   <ItemGroup>

samples/todoapp/TodoApp.Uno/Directory.Packages.props

@@ -10,11 +10,11 @@
   <ItemGroup>
     <PackageVersion Include="CommunityToolkit.WinUI.Behaviors" Version="8.2.250402" />
     <PackageVersion Include="CommunityToolkit.WinUI.Converters" Version="8.2.250402" />
-    <PackageVersion Include="CommunityToolkit.Datasync.Client" Version="10.0.0" />
+    <PackageVersion Include="CommunityToolkit.Datasync.Client" Version="10.1.0" />
     <PackageVersion Include="Refit" Version="8.0.0" />
-    <PackageVersion Include="System.Formats.Asn1" Version="10.0.3" />
-    <PackageVersion Include="System.IO.Packaging" Version="10.0.3" />
+    <PackageVersion Include="System.Formats.Asn1" Version="10.0.9" />
+    <PackageVersion Include="System.IO.Packaging" Version="10.0.9" />
     <PackageVersion Include="System.Private.Uri" Version="4.3.2" />
-    <PackageVersion Include="System.Text.Json" Version="10.0.3" />
+    <PackageVersion Include="System.Text.Json" Version="10.0.9" />
   </ItemGroup>
 </Project>

samples/todoapp/TodoApp.WPF/TodoApp.WPF.csproj

@@ -10,6 +10,6 @@
 
   <ItemGroup>
     <PackageReference Include="CommunityToolkit.Mvvm" Version="8.4.0" />
-    <PackageReference Include="CommunityToolkit.Datasync.Client" Version="10.0.0" />
+    <PackageReference Include="CommunityToolkit.Datasync.Client" Version="10.1.0" />
   </ItemGroup>
 </Project>

samples/todoapp/TodoApp.WinUI3/TodoApp.WinUI3.csproj

@@ -29,11 +29,11 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="CommunityToolkit.Datasync.Client" Version="10.0.0" />
+    <PackageReference Include="CommunityToolkit.Datasync.Client" Version="10.1.0" />
     <PackageReference Include="CommunityToolkit.Mvvm" Version="8.4.0" />
     <PackageReference Include="CommunityToolkit.WinUI.Behaviors" Version="8.2.250402" />
     <PackageReference Include="CommunityToolkit.WinUI.Converters" Version="8.2.250402" />
-    <PackageReference Include="Microsoft.Extensions.DependencyInjection" Version="10.0.3" />
+    <PackageReference Include="Microsoft.Extensions.DependencyInjection" Version="10.0.9" />
     <PackageReference Include="Microsoft.WindowsAppSDK" Version="1.7.250401001" />
     <PackageReference Include="Microsoft.Windows.SDK.BuildTools" Version="10.0.26100.3916" />
     <Manifest Include="$(ApplicationManifest)" />