Beamable.Tooling.Common carries an unused System.ServiceModel.Primitives reference that pulls 8 high-severity System.Security.Cryptography.Xml advisories into every C#MS

[mhijaziB]

Problem

Beamable.Tooling.Common references System.ServiceModel.Primitives 8.1.2 and nothing uses it. There is no System.ServiceModel usage anywhere in cli/ or microservice/. The reference came over in the 2021 Perforce import and got version-bumped in #4283 without anyone asking whether it was still needed.

That one dead line drags System.Security.Cryptography.Xml 8.0.2 into every customer microservice, and that package currently carries eight high-severity advisories:

GHSA-37gx-xxp4-5rgx, GHSA-w3x6-4m5h-cxqf, GHSA-g8r8-53c2-pm3f, GHSA-8q5v-6pqq-x66h, GHSA-cvvh-rhrc-wg4q, GHSA-23rf-6693-g89p, GHSA-mmjf-rqrv-855v, GHSA-6588-8gv4-xfgh (all .NET DoS or security-feature-bypass, published April to July 2026).

Dependency chain as resolved in a customer service:

Beamable.Microservice.Runtime
└── Beamable.Tooling.Common
    └── System.ServiceModel.Primitives 8.1.2
        └── System.Security.Cryptography.Xml 8.0.2

Impact

Customers on Rider or with NuGet audit enabled see eight red "contains vulnerabilities" entries for code we never execute. Barnstorm reported it in beam-shared-barnstorm on 2 Sep 2026. The XML crypto code path is not reachable from a microservice, so this is noise, but it is noise we ship.

Fix

Delete the PackageReference from microservice/beamable.tooling.common/beamable.tooling.common.csproj. Bumping the version is the wrong fix; removing an unused dependency is the right one.

Proof to close

• grep -rn "System.ServiceModel" cli microservice --include=*.cs still returns nothing.
• dotnet nuget why <service>.csproj System.Security.Cryptography.Xml reports no dependency on a service referencing the rebuilt Beamable.Microservice.Runtime.
• CLI and microservice test projects still build.