Remove temporary AngleSharp 1.5.2 transitive pin once bUnit references a patched AngleSharp (>= 1.5.0)

[jschick04]

Summary

Directory.Packages.props currently carries a temporary security override that pins the
transitively-resolved AngleSharp package to 1.5.2. This issue tracks the upstream fix so we can
remove the override once bUnit ships a release that references a non-vulnerable AngleSharp
(>= 1.5.0) on its own.

Background

bUnit 2.7.2 (test-only, used by EventLogExpert.UI.Tests) transitively resolves:

bunit (2.7.2) ──► AngleSharp.Diffing (1.1.1) ──► AngleSharp (1.4.0)   ← mXSS
              └─► AngleSharp.Css (1.0.0-beta.157)

AngleSharp <= 1.4.x is affected by
CVE-2026-54570 (Moderate) - a mutation-XSS caused
by mis-parsing MathML annotation-xml HTML integration points and not escaping < / > when
serializing attribute values. The fix shipped in AngleSharp 1.5.0; there is no 1.4.x patch. bUnit 2.7.2 (the latest bUnit at time of writing) still references the 1.4.x line.

Because TreatWarningsAsErrors promotes NuGetAudit's NU1902, this advisory broke the build until the
override was added.

Current override (what to remove later)

In Directory.Packages.props (added in #654):

• <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled> (shared with the SQLitePCLRaw override, Remove temporary SQLitePCLRaw.lib.e_sqlite3 3.50.3 security override once Microsoft.Data.Sqlite ships the CVE-2025-6965 fix #604)
• <PackageVersion Include="AngleSharp" Version="1.5.2" />

This pins only the AngleSharp core package (the vulnerability is in AngleSharp core -
HtmlParser / HtmlMarkupFormatter); the sibling AngleSharp.Css / AngleSharp.Diffing packages are
not covered by the advisory and are left untouched. AngleSharp.Diffing 1.1.1 depends on
AngleSharp >= 1.1.2 (a floor, not a cap), so pinning 1.5.2 causes no downgrade. Verified compatible -
the full EventLogExpert.UI.Tests (bUnit) suite passes against AngleSharp 1.5.2.

Upstream tracking

Repo	Item	State	Notes
AngleSharp/AngleSharp	GHSA-pgww-w46g-26qg	Fixed	Patched in AngleSharp 1.5.0.
bUnit-dev/bUnit	needs a release referencing AngleSharp >= 1.5.0	Pending	2.7.2 still references AngleSharp 1.4.x.

Done when

• bUnit upgraded to a release that transitively resolves AngleSharp >= 1.5.0 on its own.
• AngleSharp PackageVersion pin removed from Directory.Packages.props.
• CentralPackageTransitivePinningEnabled removed only if the SQLitePCLRaw override (Remove temporary SQLitePCLRaw.lib.e_sqlite3 3.50.3 security override once Microsoft.Data.Sqlite ships the CVE-2025-6965 fix #604) is also gone.
• dotnet list package --vulnerable --include-transitive re-verified clean and the NU1902 warning is gone.