From 1216970e35da78764bf94ef8db3455643d1cd16e Mon Sep 17 00:00:00 2001
From: Matt Edmondson <matthew.edmondson@gmail.com>
Date: Wed, 5 Aug 2026 19:31:34 +1000
Subject: [PATCH] [patch] Fix restore failures from duplicate and vulnerable
 package versions

Remove the Microsoft.Testing.Extensions.* PackageVersion entries. MSTest.Sdk
injects its own PackageVersion for every extension it references under central
package management, so the repo-side pins collided with the SDK-owned versions
and failed restore with NU1506. KTSU0005 explicitly skips this package prefix,
so nothing else depended on them.

Pin System.Security.Cryptography.Xml forward to 10.0.10. It arrives
transitively via Microsoft.PowerShell.SDK / System.Management.Automation at
10.0.6, which carries five high-severity advisories and failed restore with
NU1903.
---
 CrossRepoActions/CrossRepoActions.csproj |  1 +
 Directory.Packages.props                 | 13 ++++++-------
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/CrossRepoActions/CrossRepoActions.csproj b/CrossRepoActions/CrossRepoActions.csproj
index 1d42169..6a7211a 100644
--- a/CrossRepoActions/CrossRepoActions.csproj
+++ b/CrossRepoActions/CrossRepoActions.csproj
@@ -30,6 +30,7 @@
     <PackageReference Include="NuGet.Versioning" />
     <PackageReference Include="Polyfill" />
     <PackageReference Include="System.Management.Automation" />
+    <PackageReference Include="System.Security.Cryptography.Xml" />
   </ItemGroup>
 
 </Project>
diff --git a/Directory.Packages.props b/Directory.Packages.props
index 671736e..cddebe2 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -19,15 +19,14 @@
     <PackageVersion Include="Microsoft.SemanticKernel.Abstractions" Version="1.78.0" />
     <PackageVersion Include="Microsoft.SemanticKernel.Connectors.OpenAI" Version="1.78.0" />
     <PackageVersion Include="Microsoft.SemanticKernel.Core" Version="1.78.0" />
-    <PackageVersion Include="Microsoft.Testing.Extensions.CodeCoverage" Version="17.14.2" />
-    <PackageVersion Include="Microsoft.Testing.Extensions.CrashDump" Version="1.7.2" />
-    <PackageVersion Include="Microsoft.Testing.Extensions.Fakes" Version="17.14.1" />
-    <PackageVersion Include="Microsoft.Testing.Extensions.HangDump" Version="1.7.2" />
-    <PackageVersion Include="Microsoft.Testing.Extensions.HotReload" Version="1.7.2" />
-    <PackageVersion Include="Microsoft.Testing.Extensions.Retry" Version="1.7.2" />
-    <PackageVersion Include="Microsoft.Testing.Extensions.TrxReport" Version="1.7.2" />
+    <!-- Microsoft.Testing.Extensions.* versions are owned by MSTest.Sdk, which injects a matching
+         PackageVersion for every extension it references. Declaring them here duplicates those
+         entries and fails restore with NU1506. -->
     <PackageVersion Include="NuGet.Versioning" Version="7.6.0" />
     <PackageVersion Include="Polyfill" Version="11.0.1" />
     <PackageVersion Include="System.Management.Automation" Version="7.6.4" />
+    <!-- Transitive of Microsoft.PowerShell.SDK / System.Management.Automation; pinned forward off
+         the vulnerable 10.0.6 those packages resolve to (NU1903). -->
+    <PackageVersion Include="System.Security.Cryptography.Xml" Version="10.0.10" />
   </ItemGroup>
 </Project>
\ No newline at end of file