Investigate resolving NU1903 for Tmds.DBus.Protocol in Avalonia desktop sample

[adrianhall]

Summary

Discovered while verifying #498 (the SQLitePCLRaw NU1903 fix for #492). Restoring the Avalonia and Uno desktop-head samples on Linux/macOS surfaces a separate, unrelated NU1903 high-severity restore warning:

warning NU1903: Package 'Tmds.DBus.Protocol' 0.21.2 has a known high severity vulnerability, https://github.com/advisories/GHSA-xrw6-gwf8-vvr9

and (for Uno's desktop head):

warning NU1903: Package 'Tmds.DBus' 0.16.0 has a known high severity vulnerability, https://github.com/advisories/GHSA-xrw6-gwf8-vvr9

What's known so far

• Advisory: GHSA-xrw6-gwf8-vvr9 / CVE-2026-39959 — "malicious D-Bus peers can spoof signals, exhaust file descriptor resources, and cause denial of service". Patched versions: Tmds.DBus.Protocol 0.21.3 (fixes < 0.21.3 and >= 0.22.0, < 0.92.0), Tmds.DBus 0.92.0 (fixes < 0.92.0). Unlike Investigate resolving NU1903 for SQLitePCLRaw.lib.e_sqlite3 (no patched version exists) #492, a drop-in patched version genuinely exists here for both packages.
• Confirmed dependency chain for the Avalonia desktop sample via project.assets.json: Avalonia.FreeDesktop/11.3.0 → Tmds.DBus.Protocol 2.1.2 (floor), used for Linux D-Bus integration (system tray, clipboard, etc. via the FreeDesktop backend pulled in by Avalonia.Desktop).
• Reproduced on:
  • samples/todoapp/TodoApp.Avalonia/TodoApp.Avalonia.Desktop/TodoApp.Avalonia.Desktop.csproj — dotnet restore floats Tmds.DBus.Protocol 0.21.2.
  • samples/todoapp/TodoApp.Uno/TodoApp.Uno/TodoApp.Uno.csproj (net10.0-desktop head) — floats Tmds.DBus 0.16.0. This restore attempt hit an unrelated, pre-existing NU1605 package-downgrade error (Uno.WinUI 5.5.87 vs 5.4.22, driven by a mismatch between global.json's Uno.Sdk version and CommunityToolkit.WinUI.Behaviors' floor), so the full dependency chain for the Tmds.DBus 0.16.0 floor wasn't confirmed — worth investigating together with, or ahead of, this NU1903.
• Both samples use ManagePackageVersionsCentrally=false (or a per-sample local catalog for Uno), same as the SQLitePCLRaw samples fixed in fix: resolve NU1903 for SQLitePCLRaw.lib.e_sqlite3 by pinning SQLitePCLRaw 3.x #498, so the same explicit-PackageReference-override pattern should apply here if no newer Avalonia/Avalonia.FreeDesktop release already bumps the floor.

Ask

Investigate one of:

1. Whether a newer Avalonia/Avalonia.Desktop/Avalonia.FreeDesktop release (past 11.3.0) already bumps its Tmds.DBus.Protocol dependency to >= 0.21.3, and bump the sample's Avalonia.* package versions if so.
2. If not, add an explicit <PackageReference Include="Tmds.DBus.Protocol" Version="0.21.3" /> (or later) override to TodoApp.Avalonia.Desktop.csproj, mirroring the SQLitePCLRaw.bundle_e_sqlite3 override pattern used in fix: resolve NU1903 for SQLitePCLRaw.lib.e_sqlite3 by pinning SQLitePCLRaw 3.x #498.
3. Resolve the pre-existing Uno.WinUI NU1605 package-downgrade issue on TodoApp.Uno's desktop head first (unrelated to this advisory but currently blocks confirming the Tmds.DBus 0.16.0 dependency chain there), then apply the equivalent Tmds.DBus >= 0.92.0 override if still needed.
4. Confirm whether Tmds.DBus/Tmds.DBus.Protocol is reachable code (Linux D-Bus paths) in these samples at all before deciding this is worth a version bump vs. just documenting/suppressing.

Related

• Investigate resolving NU1903 for SQLitePCLRaw.lib.e_sqlite3 (no patched version exists) #492 / fix: resolve NU1903 for SQLitePCLRaw.lib.e_sqlite3 by pinning SQLitePCLRaw 3.x #498 — sibling NU1903 investigation (SQLitePCLRaw.lib.e_sqlite3) where this was discovered as an out-of-scope side finding.

[adrianhall]

Scoping this issue to the Avalonia sample only. The Uno-specific findings (Tmds.DBus 0.16.0, blocked by the pre-existing Uno.WinUI NU1605) have been split out to #506.

Resolution for the Avalonia side: confirmed via NuGet that Avalonia.FreeDesktop 11.3.18 (the latest 11.x patch) already bumps its Tmds.DBus.Protocol dependency to 0.21.3 — the patched version per the advisory. No explicit Tmds.DBus.Protocol PackageReference override is needed (Ask option 1 confirmed true; option 2 not required).

Avalonia.FreeDesktop/11.3.0  -> Tmds.DBus.Protocol 0.21.2  (vulnerable)
Avalonia.FreeDesktop/11.3.18 -> Tmds.DBus.Protocol 0.21.3  (patched)

Fix: bump the shared AvaloniaVersion in samples/todoapp/TodoApp.Avalonia/Directory.Build.props from the stale/unused 11.2.3 to 11.3.18, and wire up all 4 TodoApp.Avalonia* csproj files to consume $(AvaloniaVersion) instead of hardcoding 11.3.0 per project. Verified via project.assets.json that Tmds.DBus.Protocol now resolves to 0.21.3 and the NU1903 restore warning is gone for the Desktop head.

A separate major-version bump to Avalonia 12 was investigated as a possible fix too, but isn't needed here — tracked instead as its own follow-up in #507 since it's a much larger, breaking change.

Will be closed by the PR carrying this fix.