Seems like there is no possible way to enforce/overwrite a package version (or transitive package version).
My project is hosted in Azure app service with .NET 8 and props file in the root to enforce the latest of a few packages, After updating the projects in the solution to .NET 9, I started getting the prompt for a security vulnerability (these packages mostly have the circular dependencies hence can't directly update their version).
I couldn't find much of he release note of .NET 9 or MSDN documentation.
Thanks