System.Private.Uri issue

[kiminuo]

There is a denial of service vulnerability in System.Private.Uri in version 4.3.0 and CodeFactor reports it¹. This PR bumps it to 4.3.2.

To be warned about vulnerabilities during dotnet restore (shorter feedback loop), I enabled in Directory.Build.props:

<!-- Audit both top-level and transitive dependencies for vulnerabilities in NuGet packages. -->
<!-- https://learn.microsoft.com/en-us/nuget/concepts/auditing-packages#setting-a-security-audit-mode -->
<NuGetAuditMode>all</NuGetAuditMode>
<NuGetAuditLevel>low</NuGetAuditLevel>

This makes sure that not only CodeFactor warns us about vulnerabilities but even .NET during a restore/build. The output is then as follows:

6>Z:\WalletWasabi\WalletWasabi.Fluent\WalletWasabi.Fluent.csproj : warning NU1903: Package 'System.Private.Uri' 4.3.0 has a known high severity vulnerability, https://github.com/advisories/GHSA-5f2m-466j-3848
6>Z:\WalletWasabi\WalletWasabi.Fluent\WalletWasabi.Fluent.csproj : warning NU1902: Package 'System.Private.Uri' 4.3.0 has a known moderate severity vulnerability, https://github.com/advisories/GHSA-x5qj-9vmx-7g6g
6>Z:\WalletWasabi\WalletWasabi.Fluent\WalletWasabi.Fluent.csproj : warning NU1903: Package 'System.Private.Uri' 4.3.0 has a known high severity vulnerability, https://github.com/advisories/GHSA-xhfc-gr8f-ffwc

Similar vulnerability in other projects

• Can we get a version of SqlCLient released that doesnt have CVEs dotnet/SqlClient#2426

Footnotes

1. Whenever we would try to upgrade a dependency at this point. ↩

[molnard]

tACK. Good catch.