Major-version bump: Uno Platform 5 -> 6 (TodoApp.Uno sample)

[adrianhall]

Summary

Split out from #506. Fixing #506's NU1605 restore blocker required bumping Uno.Sdk in samples/todoapp/TodoApp.Uno/global.json from 5.4.5 to 5.6.54 (the latest stable 5.x release), which resolves Uno.WinUI to 5.6.99. However, this does not resolve the original NU1903 finding #506 was filed for:

warning NU1903: Package 'Tmds.DBus' 0.16.0 has a known high severity vulnerability, https://github.com/advisories/GHSA-xrw6-gwf8-vvr9

What's known

• Advisory: GHSA-xrw6-gwf8-vvr9 / CVE-2026-39959. Patched version: Tmds.DBus 0.92.0 (fixes < 0.92.0).
• Uno.WinUI.Runtime.Skia.X11 (pulled in on the desktop head via Uno.WinUI.Skia.X11) floors Tmds.DBus at 0.16.0 unchanged across the entire 5.x line - confirmed via nuspec inspection at Uno.WinUI 5.4.22, 5.5.87, 5.5.94, 5.5.95, 5.6.27, and 5.6.99 (all still Tmds.DBus 0.16.0).
• Uno only switches Uno.WinUI.Runtime.Skia.X11 to the patched Tmds.DBus.Protocol package (0.21.2, later 0.21.3) starting at Uno.WinUI 6.0.465 (Uno.Sdk 6.x line) - a major-version bump.
• This mirrors the Avalonia sample's equivalent finding (Investigate resolving NU1903 for Tmds.DBus.Protocol in Avalonia desktop sample #499), except Avalonia was able to resolve it with a same-major patch bump (11.2.3 -> 11.3.18, see PR fix: resolve NU1903 for Tmds.DBus.Protocol in Avalonia sample by bumping to 11.3.18 #508); Uno does not have that option within its 5.x line.

Ask

Investigate bumping Uno.Sdk in samples/todoapp/TodoApp.Uno/global.json from 5.6.54 to a 6.x release (confirm the minimum 6.x version needed, and check for breaking API changes across all heads: android, ios, maccatalyst, windows, browserwasm, desktop) to pick up the patched Tmds.DBus.Protocol dependency and fully resolve the NU1903 finding.

Related

• Investigate resolving NU1903 for Tmds.DBus in Uno desktop sample #506 - fixed the NU1605 restore blocker that was masking this finding (Uno.Sdk 5.4.5 -> 5.6.54).
• Investigate resolving NU1903 for Tmds.DBus.Protocol in Avalonia desktop sample #499 / PR fix: resolve NU1903 for Tmds.DBus.Protocol in Avalonia sample by bumping to 11.3.18 #508 - sibling issue for the Avalonia sample's equivalent Tmds.DBus.Protocol finding (resolved via a same-major patch bump).
• Major-version bump: Avalonia 11 → 12 (TodoApp.Avalonia sample) #507 - sibling major-version-bump effort for the Avalonia sample (11 -> 12).