Code: check dependencies

[Jay-o-Way]

System.Drawing.Common

Under AutoDarkModeSvc

https://github.com/advisories/GHSA-rxg9-xrhp-64gj

---

Visual Studio suggests me to install the following. Note that version 7 is out of support.

---

Community Toolkit > New release: Version 8.2

[Spiritreader]

That is potentially due to an old package dependency we might no longer need?

I've hopefully upped the SDK target to Net9 on all projects, so I'm not entirely sure why it's asking for NET7

[Jay-o-Way]

When opening a fresh clone, Visual Studio gives the suggestion.

Also, see a security warning for System.Drawing.Common under AutoDarkModeSvc.

[ChenYiLins]

I tried to remove. NET 7 from VSInstaller. When I entered the solution, I was still prompted to install. NET 7. I guess there should be some outdated nuget package.

[Spiritreader]

I've updated the dependency in question to a non-vulnerable version. Not sure why Visual Studio asks for NET7. I don't have this dependency installed.

Please also note that a fresh clone on the master branch will result in the old dependencies to be loaded. And they indeed might have backrefs to .NET7. But it shouldn't happen on a clean version of the winui3 branch.

[Spiritreader]

@Jay-o-Way Do you still see the security warning on the winui3 branch? If not, we can close.

[Jay-o-Way]

Do you still see the security warning on the winui3 branch?

Nope. Just an update available.

If not, we can close.

Unfortunately not:

fresh clone a few minutes ago

[Jay-o-Way]

Please also note that a fresh clone on the master branch will result in the old dependencies to be loaded. And they indeed might have backrefs to .NET7. But it shouldn't happen on a clean version of the winui3 branch.

I don't think it's possible to clone a branch, only a repository? 🤔

[Spiritreader]

Please also note that a fresh clone on the master branch will result in the old dependencies to be loaded. And they indeed might have backrefs to .NET7. But it shouldn't happen on a clean version of the winui3 branch.

I don't think it's possible to clone a branch, only a repository? 🤔

Yes, but the question is "is it fixed on the winui3 branch"

You clone, then check out winui3, then open visual studio. If everything is fine then, the issue is resolved because it will eventually be merged to master.

I don't have .net7 installed and I don't get any warnings. So I wonder where yours come from.

[ChenYiLins]

Just now, I tried to install a new VS2026. When I opened the project, the system gave me some tips because the installation components were incomplete, which still contained. NET 7.

But I did not choose to install. NET 7. I opened the solution again and didn't receive any warning.

[Jay-o-Way]

I think I found it

// file: .vsconfig
{
  "version": "1.0",
  "components": [
    "Microsoft.Component.MSBuild",
    "Microsoft.NetCore.Component.Runtime.7.0",