chore: audit and clean legacy project artifacts

Author: Rouniy

.gitattributes

@@ -0,0 +1,5 @@
+# Preserve native Windows project files without treating their CRLF terminator as trailing space.
+*.bat text eol=crlf whitespace=cr-at-eol
+*.cmd text eol=crlf whitespace=cr-at-eol
+*.csproj whitespace=cr-at-eol
+*.sln whitespace=cr-at-eol

.github/workflows/ci.yml

@@ -2,7 +2,7 @@ name: Avalonia CI and packages
 
 on:
   push:
-    branches: [master, 'port/**']
+    branches: [master, 'port/**', 'cleanup/**']
   pull_request:
     branches: [master]
   workflow_dispatch:

.github/workflows/codeql.yml

@@ -2,7 +2,7 @@ name: Avalonia CodeQL
 
 on:
   push:
-    branches: [master, 'port/**']
+    branches: [master, 'port/**', 'cleanup/**']
   pull_request:
     branches: [master]
   schedule:

.github/workflows/main.yml

@@ -0,0 +1,11 @@
+<Project>
+  <PropertyGroup>
+    <!-- Audit the complete transitive graph and never allow a known NuGet advisory into an
+         active build silently. Keep these errors explicit instead of hiding them in NoWarn. -->
+    <NuGetAudit>true</NuGetAudit>
+    <NuGetAuditMode>all</NuGetAuditMode>
+    <NuGetAuditLevel>low</NuGetAuditLevel>
+    <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
+    <WarningsAsErrors>$(WarningsAsErrors);NU1901;NU1902;NU1903;NU1904</WarningsAsErrors>
+  </PropertyGroup>
+</Project>

Directory.Build.props

@@ -4,7 +4,6 @@
     <PackageVersion Include="Avalonia.Desktop" Version="11.3.13" />
     <PackageVersion Include="Avalonia.Themes.Fluent" Version="11.3.13" />
     <PackageVersion Include="Avalonia.Fonts.Inter" Version="11.3.13" />
-    <PackageVersion Include="Avalonia.Diagnostics" Version="11.3.18" />
     <PackageVersion Include="Avalonia.Controls.DataGrid" Version="11.3.13" />
     <PackageVersion Include="Avalonia.Controls.ColorPicker" Version="11.3.18" />
     <PackageVersion Include="CommunityToolkit.Mvvm" Version="8.4.2" />
@@ -37,5 +36,7 @@
     <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
     <PackageVersion Include="Microsoft.NETFramework.ReferenceAssemblies" Version="1.0.2" />
     <PackageVersion Include="coverlet.collector" Version="10.0.1" />
+    <PackageVersion Include="System.Text.RegularExpressions" Version="4.3.1" />
+    <PackageVersion Include="System.Private.Uri" Version="4.3.2" />
   </ItemGroup>
 </Project>

Directory.Packages.props

@@ -24,6 +24,7 @@
     <PackageReference Include="SharpDX.DirectInput" Version="4.1.0" />
     <PackageReference Include="DokanNet" Version="2.1.0" />
     <PackageReference Include="System.IO.FileSystem.AccessControl" Version="5.0.0" />
+    <PackageReference Include="System.Private.Uri" Version="4.3.2" PrivateAssets="all" />
   </ItemGroup>
 
   <ItemGroup>

ExtLibs/ArduPilot/MissionPlanner.ArduPilot.csproj

@@ -41,6 +41,7 @@
     <PackageReference Include="System.Memory" Version="4.6.3" />
     <PackageReference Include="System.Net.NameResolution" Version="4.3.0" />
     <PackageReference Include="System.Net.Security" Version="4.3.2" />
+    <PackageReference Include="System.Private.Uri" Version="4.3.2" PrivateAssets="all" />
   </ItemGroup>
 
   <ItemGroup>
@@ -62,4 +63,4 @@
   </ItemGroup>
 
 
-</Project>
+</Project>

ExtLibs/Comms/MissionPlanner.Comms.csproj

@@ -20,6 +20,7 @@
   <ItemGroup>
     <PackageReference Include="SkiaSharp" Version="2.80.2" />
     <PackageReference Include="System.Drawing.Primitives" Version="4.3.0" />
+    <PackageReference Include="System.Private.Uri" Version="4.3.2" PrivateAssets="all" />
   </ItemGroup>
 
   <ItemGroup>

ExtLibs/MissionPlanner.Drawing/MissionPlanner.Drawing.csproj

@@ -52,6 +52,10 @@
     <PackageReference Include="System.ComponentModel" Version="4.3.0" />
     <PackageReference Include="System.ComponentModel.Primitives" Version="4.3.0" />
     <PackageReference Include="System.Drawing.Primitives" Version="4.3.0" />
+    <!-- Override the vulnerable 4.3.0 transitive dependency pulled by the legacy netstandard
+         graph. This project is the shared source of that dependency for ArduPilot and tests. -->
+    <PackageReference Include="System.Text.RegularExpressions" Version="4.3.1" />
+    <PackageReference Include="System.Private.Uri" Version="4.3.2" PrivateAssets="all" />
     <PackageReference Include="System.Runtime.Loader" Version="4.3.0" />
     <PackageReference Include="WebSocket4Net" Version="0.15.2" />
   </ItemGroup>