Update Argu to 6.2.5 and stop shipping System.Drawing.Common 4.7

Directory.Build.props

@@ -3,11 +3,8 @@
     <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
     <!--
     NU1510: PackageReference 'xxx' will not be pruned. Raised by the .NET 10 SDK for framework-provided packages; here they come from Paket's transitive resolution of NETStandard.Library, not from hand-written references.
-    NU1902: Package 'xxx' X.Y.Z has a known moderate severity vulnerability, https://URI
-    NU1903: Package 'xxx' X.Y.Z has a known high severity vulnerability, https://URI
-    NU1904: Package 'xxx' X.Y.Z has a known critical severity vulnerability, https://URI
     -->
-   <WarningsNotAsErrors>$(WarningsNotAsErrors);NU1510;NU1902;NU1903;NU1904</WarningsNotAsErrors>
+   <WarningsNotAsErrors>$(WarningsNotAsErrors);NU1510</WarningsNotAsErrors>
     <!-- FS3370: the deprecated ref cell operators !, :=, incr and decr, only an informational message by default -->
     <WarnOn>$(WarnOn);3370</WarnOn>
   </PropertyGroup>

RELEASE_NOTES.md

@@ -5,6 +5,7 @@
 * BREAKING: Paket no longer looks for projects and `paket.template` files in the folders whose name starts with a dot, like `.devenv`, nor in the folders that are links, as `paket convert-from-nuget` already did for the solutions and NuGet files: the projects there are left out of install, restore, update, remove and pack. Until now only `.git` and `.fable` were skipped. A cyclic link, as in a Nix `.devenv` profile, no longer makes the search run forever - https://github.com/fsprojects/Paket/pull/4421
 * BREAKING: The obsolete `InstallModel.CreateFromLibs` and `InstallModel.createFromLibs`, `InstallModel.GetLibReferences` and `PlatformMatching.getFrameworkPathPenalty` of Paket.Core are removed: use `InstallModel.CreateFromContent` and `createFromContent`, `GetLegacyReferences` or `GetCompileReferences`, and `PlatformMatching.getPathPenalty`. So is the `Fake.Globbing` module that Paket.Core carried from FAKE 4: use `Fake.IO.Globbing.Glob` of the Fake.IO.FileSystem package. So are `NuGetCache.NuGetConfig.writeNuGetConfig` and `Constants.NuGetConfigFile`, unused since the end of the project.json support
 * The warning about the FSharp.Core binding redirects of F# projects links to an existing section of the documentation
+* Update Argu from 6.1.1 to 6.2.5, and System.Configuration.ConfigurationManager from 4.7 to 10.0, so the `paket` tool no longer ships System.Drawing.Common 4.7 and its critical vulnerability (GHSA-rxg9-xrhp-64gj). The help of `paket update`, `paket find-packages` and `paket generate-nuspec` no longer shows their optional package ID, search text and `output` directory as required
 
 #### 12.0.0-alpha003 - 2026-10-26
 

integrationtests/scenarios/Directory.Build.props

@@ -0,0 +1,8 @@
+<Project>
+  <!-- MSBuild only includes the first Directory.Build.props, so we need to manually include the parent one -->
+  <Import Project="$(MSBuildThisFileDirectory)..\Directory.Build.props" />
+  <PropertyGroup>
+    <!-- The scenarios reproduce issues with old packages, some of which have known vulnerabilities -->
+    <NuGetAudit>false</NuGetAudit>
+  </PropertyGroup>
+</Project>

paket.dependencies

@@ -7,9 +7,8 @@ content: none
 framework: net10.0, netstandard2.0, net461
 
 nuget Newtonsoft.Json >= 10.0.3 redirects: force
-# Argu 6.1.5 enforces the ExactlyOnce of the main commands of subcommands, which Paket declares on
-# optional ones, e.g. the package id of paket update; 6.1.2 to 6.1.4 break the parsing of #127
-nuget Argu >= 5.1.0 < 6.1.2
+# Argu 6.1.2 to 6.2.2 carry regressions of fsprojects/Argu#127 in the parsing of subcommands
+nuget Argu >= 6.2.3
 nuget FSharp.Core >= 6.0.3
 nuget Chessie >= 0.6
 nuget Mono.Cecil ~> 0.11.1