Remove obsolete transitive NuGet overrides from typespec-vs

[Copilot]

The Visual Studio extension was carrying explicit NuGet references that were only needed to suppress older transitive vulnerability and NU1603 issues. Those overrides are no longer necessary with the currently resolved Visual Studio package set.

• Dependency cleanup

  • Remove explicit PackageReferences for:
    • MessagePack
    • Microsoft.VisualStudio.Composition
    • Microsoft.VisualStudio.Shell.15.0

• Project file simplification

  • Drop the associated explanatory/TODO comments tied to those temporary overrides.
  • Keep the direct Visual Studio SDK/workspace dependencies unchanged so the extension continues to pick up these packages transitively.

• Result

  • typespec-vs now relies on the Visual Studio packages to supply these dependencies instead of pinning them redundantly in the project file.

<!-- removed -->
<PackageReference Include="MessagePack" Version="2.5.192" />
<PackageReference Include="Microsoft.VisualStudio.Composition" Version="17.13.41" />
<PackageReference Include="Microsoft.VisualStudio.Shell.15.0" Version="17.14.40264" />

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/typespec-vs@10824

commit: fc0d818

[timotheeguerin]

@copilot add changelog

[Copilot]

@copilot add changelog

Addressed in 4d6e325.

[github-actions]

All changed packages have been documented.

• ✅ typespec-vs

Show changes

typespec-vs - fix ✏️

Remove obsolete explicit Visual Studio transitive NuGet package overrides.

[RodgeFu]

but I don't see change to these nuget packages using the removed ones. They should be upgrade to a new version to use a security issue free dependency, shouldn't it?

[timotheeguerin]

wouldn't that fail the CI if it did? did we maybe upgrade those version separately but never cleaned up?
@copilot can you investigate and check if that is the case, do we also need to upgrade the other packages?

[timotheeguerin]

@copilot can you answer the question

[Copilot]

I checked the resolved graph with dotnet restore Microsoft.TypeSpec.VS.sln, dotnet list src/Microsoft.TypeSpec.VS.csproj package --include-transitive, and --vulnerable. The removed packages are still brought in transitively at the same resolved versions (MessagePack 2.5.192, Microsoft.VisualStudio.Composition 17.13.41, Microsoft.VisualStudio.Shell.15.0 17.14.40264), and NuGet reports no vulnerable packages for this project. So this looks like a cleanup of old explicit overrides after the upstream Visual Studio package set had already been updated, not a missing upgrade in this PR.