[fpellet]

Paket kept Argu on 6.1.1 since 2eb8c33, and the restore reported NU1904 on Paket.fsproj and Paket.Tests.fsproj: System.Drawing.Common 4.7.0 has a critical vulnerability (GHSA-rxg9-xrhp-64gj), and the paket tool shipped it. This branch updates Argu to 6.2.5, removes the vulnerable packages, and makes the vulnerability warnings errors again.

Argu

Since 6.1.5, Argu checks the mandatory arguments of the subcommands while it parses the command line. Before, only GetResult failed, when a command read a missing argument. Paket marks as ExactlyOnce both an argument and its hidden _Legacy syntax, NuGet and NuGet_Legacy for example, when only one of them is needed. With 6.2.5, paket add Foo failed as well as paket update, on the missing nuget argument.

• Parsing: ParseCommandLine(ignoreMissing = true, ...). The commands already report the missing argument themselves, with legacyOption, then require and GetResult. This keeps the behaviour of 6.1.1: paket add without a package still fails with missing argument '<package ID>' and exit code 1.
• Help: the package ID of paket update, the search text of paket find-packages and the output of paket generate-nuspec are optional, so they are Unique instead of ExactlyOnce. The help shows them in brackets. The other arguments keep ExactlyOnce, so the help still shows them as required.
• Version: the < 6.1.2 cap goes, and the lock takes Argu 6.2.5. The minimum is 6.2.3, as 6.1.2 to 6.2.2 carry regressions of Added post processing checking of sub command mandatory flag Argu#127 in the parsing of subcommands.

System.Drawing.Common

Only Argu brings System.Configuration.ConfigurationManager, and no project references it. It was locked on 4.7, which brought System.Security.Permissions, System.Windows.Extensions, System.Drawing.Common and Microsoft.Win32.SystemEvents. From 8.0, ConfigurationManager only depends on System.Security.Cryptography.ProtectedData, plus System.Diagnostics.EventLog on net8.0 and later. The main group update takes 10.0.14, and the four packages leave the lock and the tool.

The update also brings newer transitive packages, mostly for the tests: Microsoft.TestPlatform.* and Microsoft.CodeCoverage from 16.7.1 to 18.11, Microsoft.NETCore.Platforms from 5.0.2 to 7.0.4, System.Threading.Tasks.Extensions from 4.5.4 to 4.6.3 and System.Xml.XPath.XmlDocument from 4.3 to 4.7.

With no vulnerable package left, Directory.Build.props no longer lists NU1902, NU1903 and NU1904 in WarningsNotAsErrors, and only NU1510 stays there. The integration test scenarios inherit these settings, and some reproduce issues with old vulnerable packages, so their restore failed (#2496, #3608, #3000-a, #4002, #4003). A new integrationtests/scenarios/Directory.Build.props turns off NuGetAudit for the scenarios only.