[NETSDKE2E][ARM64 Only] NET10.0.301 throw "warning NU1903: Package 'Microsoft.OpenApi' 2.0.0 has a known high severity vulnerability" in C# Web API project

[v-huiwong]

Regression Info

Reproduce on 10.0.400-preview.0.26312.103

Install steps

Clean machine: Windows 11 25H2 arm64
Install .NET 10.0.301 (June Update)

Steps to reproduce

1. Create a C# Web API project
2. Build and run the projects

Expected behavior

Build and run the projects without warning.

Actual behavior

Shows warning NU1903: Package 'Microsoft.OpenApi' 2.0.0 has a known high severity vulnerability, https://github.com/advisories/GHSA-v5pm-xwqc-g5wc

dotnet --info output

.NET SDK:
 Version:           10.0.301
 Commit:            96856fd726
 Workload version:  10.0.300-manifests.b0c14421
 MSBuild version:   18.6.4+96856fd72

Runtime Environment:
 OS Name:     Windows
 OS Version:  10.0.26200
 OS Platform: Windows
 RID:         win-x64
 Base Path:   C:\Program Files\dotnet\sdk\10.0.301\

.NET workloads installed:
There are no installed workloads to display.
Configured to use workload sets when installing new manifests.
No workload sets are installed. Run "dotnet workload restore" to install a workload set.

Host:
  Version:      10.0.9
  Architecture: x64
  Commit:       901ca94124

.NET SDKs installed:
  10.0.301 [C:\Program Files\dotnet\sdk]

.NET runtimes installed:
  Microsoft.AspNetCore.App 10.0.9 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.NETCore.App 10.0.9 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.WindowsDesktop.App 10.0.9 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]

Other architectures found:
  None

Environment variables:
  Not set

global.json file:
  Not found

Learn more:
  https://aka.ms/dotnet/info

Download .NET:
  https://aka.ms/dotnet/download

NOTE

Works well on 10.0.400-preview.0.26322.102-win-x64.exe on Win11 (25H2) x64 machine
Works well on F# WebAPI project

[NicoleWang001]

This should be nuget package issue because we also met this issue with .NET SDK 10.0.302(July Update), 10.0.301(June Update) today.

[jeroenhabets]

@v-huiwong , @balachir I highly suspect this (#67543) is a duplicate of #67505 or am I mistaken?

See @martincostello 's recommendation for how to resolve it now: #67505 (comment)

[martincostello]

It is a dupe, and it's also unrelated to the specific version of the SDK, it would happen in any SDK that includes a version of NuGet that has the audit feature.

[vdanche]

This issue not repro on NET 10.0.303 and 10.0.400 SDK