[ViveliDuCh]

Fixes #136231

main PR: Not available; this addresses the release/10.0 build dependency graph.

Description

Pin System.Security.Cryptography.Pkcs to 9.0.21 in Crossgen2Tasks, installer.tasks, and Microsoft.DotNet.CoreSetup.Packaging.Tests through a shared version property in eng/Versions.props.

These projects currently resolve Pkcs 9.0.6 transitively through NuGet.Packaging/7.0.3-rc.46203. Direct package references select the patched version without changing the NuGet toolset or suppressing vulnerability auditing.

Version 9.0.21 is the patched 9.x release listed in GHSA-846f-f764-76mx and GHSA-2fmv-rv2c-59x7.

This PR is separate from the MsQuic update in #136233.

Customer Impact

Release/10.0 builds fail package restore with NU1902 and NU1903 because the existing Pkcs dependency is affected by denial-of-service vulnerabilities. This blocks Windows and Linux build legs before tests can run.

Regression

Published advisories against the existing transitive dependency trigger the existing warnings-as-errors policy. This is not a product-code regression.

Testing

Windows x64, SDK 10.0.111:

• All three projects restore Pkcs 9.0.21 without audit errors; both task projects and the isolated packaging test assembly compile.
• Packaging tests: 3 ran, 3 failed because required product .nupkg files are missing.
• No full product build; the main-branch baseline was waived.

Exact commands and results

Command	Result
.\dotnet.cmd restore .\src\tasks\Crossgen2Tasks\Crossgen2Tasks.csproj /p:TargetOS=windows /p:TargetArchitecture=x64 --no-cache -v:quiet	Failed before; passed after
.\dotnet.cmd restore .\src\tasks\installer.tasks\installer.tasks.csproj /p:TargetOS=windows /p:TargetArchitecture=x64 --no-cache -v:quiet	Failed before; passed after
.\dotnet.cmd restore .\src\installer\tests\Microsoft.DotNet.CoreSetup.Packaging.Tests\Microsoft.DotNet.CoreSetup.Packaging.Tests.csproj /p:TargetOS=windows /p:TargetArchitecture=x64 --no-cache -v:quiet	Failed before; passed after
.\dotnet.cmd build .\src\tasks\Crossgen2Tasks\Crossgen2Tasks.csproj /p:TargetOS=windows /p:TargetArchitecture=x64 -v:quiet	Passed
.\dotnet.cmd build .\src\tasks\installer.tasks\installer.tasks.csproj /p:TargetOS=windows /p:TargetArchitecture=x64 -v:quiet	Passed
.\dotnet.cmd build .\src\installer\tests\Microsoft.DotNet.CoreSetup.Packaging.Tests\Microsoft.DotNet.CoreSetup.Packaging.Tests.csproj /p:TargetOS=windows /p:TargetArchitecture=x64 -v:quiet	Failed: unbuilt packaging dependency (NETSDK1004)
.\dotnet.cmd build .\src\installer\tests\Microsoft.DotNet.CoreSetup.Packaging.Tests\Microsoft.DotNet.CoreSetup.Packaging.Tests.csproj /p:TargetOS=windows /p:TargetArchitecture=x64 /p:SkipBuildingSharedFrameworkTestDependencies=true -v:quiet	Passed
.\dotnet.cmd test .\artifacts\bin\Microsoft.DotNet.CoreSetup.Packaging.Tests\Debug\net10.0\Microsoft.DotNet.CoreSetup.Packaging.Tests.dll --filter "category!=failing" --logger "console;verbosity=normal"	Failed: 3/3 missing product packages

Risk

Low: a servicing patch update to a build/test dependency, with no product source changes or audit suppressions. All affected dependency graphs restore successfully and the task and test assemblies compile. Full package-dependent tests remain unverified because their product artifacts are missing locally.

Package authoring no longer needed in .NET 9

IMPORTANT: Starting with .NET 9, you no longer need to edit a NuGet package's csproj to enable building and bump the version.
Keep in mind that we still need package authoring in .NET 8 and older versions.

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).
13 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-infrastructure-libraries
See info in area-owners.md if you want to be subscribed.

[ViveliDuCh]

/ba-g unrelated failure tracked in #136232

[ViveliDuCh]

Tactics approved via email, adding the servicing-approved label