Eliminiate Microsoft.CodeAnalysis from builds?

The reason for moving from Dynamic LINQ to Roslyn was highlighted here:

We will not risk another similar event where some of our dependencies or our own library to be marked as vulnerable.