From c9fcb787cc699c685136e542f2dfa6fed24bdb3e Mon Sep 17 00:00:00 2001
From: ahall <ahall@cloudflare.com>
Date: Tue, 7 Jul 2026 12:19:54 +0100
Subject: [PATCH] fix: resolve NU1903 for Tmds.DBus.Protocol in Avalonia sample
 by bumping to 11.3.18

Avalonia.FreeDesktop (pulled in transitively by Avalonia.Desktop) floors
Tmds.DBus.Protocol at 0.21.2, which is vulnerable per GHSA-xrw6-gwf8-vvr9 /
CVE-2026-39959. Avalonia.FreeDesktop 11.3.18 (the latest 11.x patch) already
bumps this dependency to 0.21.3, the patched version, so no major-version
bump or explicit Tmds.DBus.Protocol override is needed.

- Bump the shared AvaloniaVersion property in Directory.Build.props from
  11.2.3 (unused/stale) to 11.3.18.
- Wire up all 4 Avalonia.* PackageReferences (TodoApp.Avalonia,
  .Desktop, .Android, .iOS) to consume $(AvaloniaVersion) instead of
  hardcoding the version per project, so this stays in sync going forward.

Verified via project.assets.json that Tmds.DBus.Protocol now resolves to
0.21.3 and the NU1903 restore warning is gone for the Desktop head.

Fixes #499
---
 samples/todoapp/TodoApp.Avalonia/Directory.Build.props    | 5 ++++-
 .../TodoApp.Avalonia.Android.csproj                       | 2 +-
 .../TodoApp.Avalonia.Desktop.csproj                       | 4 ++--
 .../TodoApp.Avalonia.iOS/TodoApp.Avalonia.iOS.csproj      | 2 +-
 .../TodoApp.Avalonia/TodoApp.Avalonia.csproj              | 8 ++++----
 5 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/samples/todoapp/TodoApp.Avalonia/Directory.Build.props b/samples/todoapp/TodoApp.Avalonia/Directory.Build.props
index f904c1fc..5732b26f 100644
--- a/samples/todoapp/TodoApp.Avalonia/Directory.Build.props
+++ b/samples/todoapp/TodoApp.Avalonia/Directory.Build.props
@@ -1,6 +1,9 @@
 <Project>
   <PropertyGroup>
     <Nullable>enable</Nullable>
-    <AvaloniaVersion>11.2.3</AvaloniaVersion>
+    <!-- Keep in sync across all Avalonia.* PackageReferences in this sample tree. -->
+    <!-- Bumped to resolve NU1903 (GHSA-xrw6-gwf8-vvr9 / CVE-2026-39959) for Tmds.DBus.Protocol,
+         pulled in transitively via Avalonia.FreeDesktop -> Avalonia.Desktop. See #499. -->
+    <AvaloniaVersion>11.3.18</AvaloniaVersion>
   </PropertyGroup>
 </Project>
diff --git a/samples/todoapp/TodoApp.Avalonia/TodoApp.Avalonia.Android/TodoApp.Avalonia.Android.csproj b/samples/todoapp/TodoApp.Avalonia/TodoApp.Avalonia.Android/TodoApp.Avalonia.Android.csproj
index 7a30a576..dbd8391f 100644
--- a/samples/todoapp/TodoApp.Avalonia/TodoApp.Avalonia.Android/TodoApp.Avalonia.Android.csproj
+++ b/samples/todoapp/TodoApp.Avalonia/TodoApp.Avalonia.Android/TodoApp.Avalonia.Android.csproj
@@ -18,7 +18,7 @@
     </ItemGroup>
 
     <ItemGroup>
-        <PackageReference Include="Avalonia.Android" Version="11.3.0" />
+        <PackageReference Include="Avalonia.Android" Version="$(AvaloniaVersion)" />
         <PackageReference Include="Xamarin.AndroidX.Core.SplashScreen" Version="1.0.1.15" />
     </ItemGroup>
 
diff --git a/samples/todoapp/TodoApp.Avalonia/TodoApp.Avalonia.Desktop/TodoApp.Avalonia.Desktop.csproj b/samples/todoapp/TodoApp.Avalonia/TodoApp.Avalonia.Desktop/TodoApp.Avalonia.Desktop.csproj
index 8a276f49..719c5fbd 100644
--- a/samples/todoapp/TodoApp.Avalonia/TodoApp.Avalonia.Desktop/TodoApp.Avalonia.Desktop.csproj
+++ b/samples/todoapp/TodoApp.Avalonia/TodoApp.Avalonia.Desktop/TodoApp.Avalonia.Desktop.csproj
@@ -13,9 +13,9 @@
     </PropertyGroup>
 
     <ItemGroup>
-        <PackageReference Include="Avalonia.Desktop" Version="11.3.0" />
+        <PackageReference Include="Avalonia.Desktop" Version="$(AvaloniaVersion)" />
         <!--Condition below is needed to remove Avalonia.Diagnostics package from build output in Release configuration.-->
-        <PackageReference Condition="'$(Configuration)' == 'Debug'" Include="Avalonia.Diagnostics" Version="11.3.0" />
+        <PackageReference Condition="'$(Configuration)' == 'Debug'" Include="Avalonia.Diagnostics" Version="$(AvaloniaVersion)" />
     </ItemGroup>
 
     <ItemGroup>
diff --git a/samples/todoapp/TodoApp.Avalonia/TodoApp.Avalonia.iOS/TodoApp.Avalonia.iOS.csproj b/samples/todoapp/TodoApp.Avalonia/TodoApp.Avalonia.iOS/TodoApp.Avalonia.iOS.csproj
index b10f8e5f..9533f4d8 100644
--- a/samples/todoapp/TodoApp.Avalonia/TodoApp.Avalonia.iOS/TodoApp.Avalonia.iOS.csproj
+++ b/samples/todoapp/TodoApp.Avalonia/TodoApp.Avalonia.iOS/TodoApp.Avalonia.iOS.csproj
@@ -7,7 +7,7 @@
     </PropertyGroup>
 
     <ItemGroup>
-        <PackageReference Include="Avalonia.iOS" Version="11.3.0" />
+        <PackageReference Include="Avalonia.iOS" Version="$(AvaloniaVersion)" />
     </ItemGroup>
 
     <ItemGroup>
diff --git a/samples/todoapp/TodoApp.Avalonia/TodoApp.Avalonia/TodoApp.Avalonia.csproj b/samples/todoapp/TodoApp.Avalonia/TodoApp.Avalonia/TodoApp.Avalonia.csproj
index 3824f904..93253b0e 100644
--- a/samples/todoapp/TodoApp.Avalonia/TodoApp.Avalonia/TodoApp.Avalonia.csproj
+++ b/samples/todoapp/TodoApp.Avalonia/TodoApp.Avalonia/TodoApp.Avalonia.csproj
@@ -11,11 +11,11 @@
     </ItemGroup>
 
     <ItemGroup>
-        <PackageReference Include="Avalonia" Version="11.3.0" />
-        <PackageReference Include="Avalonia.Themes.Fluent" Version="11.3.0" />
-        <PackageReference Include="Avalonia.Fonts.Inter" Version="11.3.0" />
+        <PackageReference Include="Avalonia" Version="$(AvaloniaVersion)" />
+        <PackageReference Include="Avalonia.Themes.Fluent" Version="$(AvaloniaVersion)" />
+        <PackageReference Include="Avalonia.Fonts.Inter" Version="$(AvaloniaVersion)" />
         <!--Condition below is needed to remove Avalonia.Diagnostics package from build output in Release configuration.-->
-        <PackageReference Condition="'$(Configuration)' == 'Debug'" Include="Avalonia.Diagnostics" Version="11.3.0" />
+        <PackageReference Condition="'$(Configuration)' == 'Debug'" Include="Avalonia.Diagnostics" Version="$(AvaloniaVersion)" />
         <PackageReference Include="CommunityToolkit.Datasync.Client" Version="10.1.0" />
         <PackageReference Include="CommunityToolkit.Mvvm" Version="8.4.0" />
         <PackageReference Include="Microsoft.EntityFrameworkCore" Version="10.0.9" />