release/10.0 is not building due to a MsQuic Schannel dependency warning-as-error. #136232

Build Information

Build: https://dev.azure.com/dnceng-public/cbb18261-c48f-4abb-8651-8cdcb5474649/_build/results?buildId=1644118&view=logs&j=d2b92d58-337d-5541-2ecb-d35f35f29352
Build error leg or test failing: Build / windows-arm64 Debug AllSubsets_CoreCLR_ReleaseRuntimeLibs / Build product (also affects windows-x86 checked CoreCLR_ReleaseLibraries and other Windows build legs)
Pull request: #136230
Build analysis: https://github.com/dotnet/runtime/pull/136230/checks?check_run_id=119387553156

Error Message

src\libraries\System.Net.Quic\src\System.Net.Quic.csproj(0,0): error NU1902: (NETCORE_ENGINEERING_TELEMETRY=Restore) Warning As Error: Package 'Microsoft.Native.Quic.MsQuic.Schannel' 2.5.11 has a known moderate severity vulnerability, https://github.com/advisories/GHSA-2mxg-prvg-9jfg

The NuGet vulnerability warning for Microsoft.Native.Quic.MsQuic.Schannel 2.5.11 is treated as an error, blocking release/10.0 builds.

Related: #135880 and #135879 tracked MsQuic Schannel dependency warnings-as-errors on release/9.0 and release/8.0, respectively. Those failures were missing-package/version-fallback warnings (NU1603); this recurrence on release/10.0 is a vulnerability warning (NU1902). #135545 previously tracked a different MsQuic vulnerability warning on release/10.0.

The separate System.Security.Cryptography.Pkcs warnings in the same PR are tracked in #136231.

Report

Summary