Build: Removes System.Net.Http and System.Text.RegularExpressions package references

[Copilot]

Removes explicit package references to System.Net.Http and System.Text.RegularExpressions from the Microsoft.Azure.Cosmos project to resolve security vulnerability warnings when using NuGet audit mode.

Resolves github issue: #5216

Problem

The Microsoft.Azure.Cosmos package was explicitly referencing System.Net.Http (v4.3.4) and System.Text.RegularExpressions (v4.3.1) even though it targets .NET Standard 2.0. According to Microsoft's official guidelines, these packages should not be directly referenced for .NET Standard 2.0 projects because:

1. The functionality is already included in the .NET Standard 2.0 base class libraries
2. Explicit references bring in a chain of legacy System.* packages (like System.Private.Uri 4.3.0) that have known security vulnerabilities
3. These references cause false positive security warnings when using NuGetAuditMode=all

Users experienced build failures like:

error NU1903: Warning As Error: Package 'System.Private.Uri' 4.3.0 has a known high severity vulnerability

Solution

• Removed <PackageReference Include="System.Net.Http" Version="4.3.4" /> from Microsoft.Azure.Cosmos.csproj
• Removed <PackageReference Include="System.Text.RegularExpressions" Version="4.3.1" /> from Microsoft.Azure.Cosmos.csproj
• Updated the dependency validation test baseline in DirectContractTests.cs to reflect the removal

Verification

• ✅ Project builds successfully without warnings or errors
• ✅ HttpClient and Regex functionality preserved through .NET Standard 2.0 APIs
• ✅ Test scenario with NuGetAuditMode=all and TreatWarningsAsErrors=true passes
• ✅ No security vulnerability warnings reported
• ✅ All existing code using these APIs continues to work unchanged

The changes are minimal and surgical - only removing unnecessary package references while maintaining full API compatibility.

Fixes #5216.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Copilot]

@ananth7592 👋 This repository doesn't have Copilot instructions. With Copilot instructions, I can understand the repository better, work faster and produce higher quality PRs.

I can generate a .github/copilot-instructions.md file for you automatically. Click here to open a pre-filled issue and assign it to me. I'll write the instructions, and then tag you for review.

[github-actions]

All good!

[ananth7592]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).