[All] Pin transitive dependencies in Fable.Cli to avoid CVE warnings

[dbrattli]

Pin Microsoft.Build transitive dependencies for now to fix CVE-2025-55247 and avoid warnings, or should we instead do it in the Buildalyzer 8.0.0-fable-001? Not sure where that package comes from?

Fable/src/Fable.Cli/Fable.Cli.fsproj : warning NU1903: Package 'Microsoft.Build' 17.10.4 has a known high severity vulnerability, https://github.com/advisories/GHSA-w3q9-fxm7-j8fq
Fable/src/Fable.Cli/Fable.Cli.fsproj : warning NU1903: Package 'Microsoft.Build.Tasks.Core' 17.10.29 has a known high severity vulnerability, https://github.com/advisories/GHSA-w3q9-fxm7-j8fq
Fable/src/Fable.Cli/Fable.Cli.fsproj : warning NU1903: Package 'Microsoft.Build.Utilities.Core' 17.10.29 has a known high severity vulnerability, https://github.com/advisories/GHSA-w3q9-fxm7-j8fq
Fable/src/Fable.Cli/Fable.Cli.fsproj : warning NU1903: Package 'Microsoft.Build' 17.10.4 has a known high severity vulnerability, https://github.com/advisories/GHSA-w3q9-fxm7-j8fq
Fable/src/Fable.Cli/Fable.Cli.fsproj : warning NU1903: Package 'Microsoft.Build.Tasks.Core' 17.10.29 has a known high severity vulnerability, https://github.com/advisories/GHSA-w3q9-fxm7-j8fq
Fable/src/Fable.Cli/Fable.Cli.fsproj : warning NU1903: Package 'Microsoft.Build.Utilities.Core' 17.10.29 has a known high severity vulnerability, https://github.com/advisories/GHSA-w3q9-fxm7-j8fq

[ncave]

@dbrattli It's from the Buildalyzer, unfortunately their latest release 8.0.0 is still vulnerable.

[dbrattli]

Ok, but should we then just pin them for now?

[ncave]

@dbrattli Sure, perhaps we can do it as local package Buildalyzer 8.0.0-fable-002

[ncave]

@dbrattli I wonder if we can eventually drop Buildalyzer altogether as legacy. The less dependencies, the better.