From dc5923ff32278e7a7a466dea7865ded639b5feac Mon Sep 17 00:00:00 2001
From: ahall <ahall@cloudflare.com>
Date: Sat, 11 Jul 2026 09:23:03 +0100
Subject: [PATCH] fix: remove redundant NU1510 PackageReference pins in
 TodoApp.Uno

System.Formats.Asn1, System.Private.Uri, and System.Text.Json were pinned
as top-level PackageReference/PackageVersion entries since the Uno sample
was first added, but NuGet's package-pruning feature now considers these
pins redundant on every head (desktop, browserwasm, windows, android,
ios-maccatalyst) - the implicitly-resolved versions already satisfy the
pins, so restore emits NU1510 for each.

Removed the three redundant entries from Directory.Packages.props and
TodoApp.Uno.csproj. System.IO.Packaging (never triggers NU1510) and
SQLitePCLRaw.bundle_e_sqlite3 (genuine NU1903 CVE floor, see #492) are
left untouched.

Verified: dotnet restore/build -f net10.0-desktop now completes with no
NU1510 warnings (previously 3) and no new warnings/errors. Other heads
(android/ios-maccatalyst/browserwasm/windows) require Uno workloads not
available locally; verification for those relies on the todoapp-uno CI
matrix.

Fixes #540
---
 samples/todoapp/TodoApp.Uno/Directory.Packages.props       | 3 ---
 samples/todoapp/TodoApp.Uno/TodoApp.Uno/TodoApp.Uno.csproj | 3 ---
 2 files changed, 6 deletions(-)

diff --git a/samples/todoapp/TodoApp.Uno/Directory.Packages.props b/samples/todoapp/TodoApp.Uno/Directory.Packages.props
index 6ab74fc..68459b3 100644
--- a/samples/todoapp/TodoApp.Uno/Directory.Packages.props
+++ b/samples/todoapp/TodoApp.Uno/Directory.Packages.props
@@ -14,9 +14,6 @@
     <!-- Force the SQLitePCLRaw 3.x line to resolve NU1903 (GHSA-2m69-gcr7-jv3q) floated by CommunityToolkit.Datasync.Client -> Microsoft.EntityFrameworkCore.Sqlite. See #492. -->
     <PackageVersion Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.3" />
     <PackageVersion Include="Refit" Version="8.0.0" />
-    <PackageVersion Include="System.Formats.Asn1" Version="10.0.9" />
     <PackageVersion Include="System.IO.Packaging" Version="10.0.9" />
-    <PackageVersion Include="System.Private.Uri" Version="4.3.2" />
-    <PackageVersion Include="System.Text.Json" Version="10.0.9" />
   </ItemGroup>
 </Project>
diff --git a/samples/todoapp/TodoApp.Uno/TodoApp.Uno/TodoApp.Uno.csproj b/samples/todoapp/TodoApp.Uno/TodoApp.Uno/TodoApp.Uno.csproj
index 7dba7bb..647e257 100644
--- a/samples/todoapp/TodoApp.Uno/TodoApp.Uno/TodoApp.Uno.csproj
+++ b/samples/todoapp/TodoApp.Uno/TodoApp.Uno/TodoApp.Uno.csproj
@@ -74,10 +74,7 @@
     <PackageReference Include="CommunityToolkit.Datasync.Client" />
     <!-- Force the SQLitePCLRaw 3.x line to resolve NU1903 (GHSA-2m69-gcr7-jv3q) floated by CommunityToolkit.Datasync.Client -> Microsoft.EntityFrameworkCore.Sqlite. See #492. -->
     <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" />
-    <PackageReference Include="System.Formats.Asn1" />
     <PackageReference Include="System.IO.Packaging" />
-    <PackageReference Include="System.Private.Uri" />
-    <PackageReference Include="System.Text.Json" />
   </ItemGroup>
   <ItemGroup>
     <Page Update="Views\TodoListPage.xaml">