fix(deps): bump Microsoft.SourceLink.GitHub to 10.0.401 to resolve NU1902 CI failure

[VDBBjorn]

Problem

CI on main fails with NU1902: Warning As Error: Package 'Microsoft.Build.Tasks.Git' 8.0.0 has a known moderate severity vulnerability (advisory GHSA-23fw-v26w-5fgq / CVE-2026-62900), 20 times in run 34856779084 (main @ 239adb6). TreatWarningsAsErrors=true in every /src/*.csproj escalates the audit warning to a hard build error.

This is an environmental break, not a code regression — nothing in the affected files changed between the last green run and this one; the advisory was published on 2026-09-08, after the last green run. It blocks #171 and #173, since the main branch ruleset requires PR branches to be up to date with main before merging, which re-runs CI against the now-failing baseline.

Causal chain:

1. Directory.Build.props adds <PackageReference Include="Microsoft.SourceLink.GitHub" PrivateAssets="All" /> to every packable project.
2. Directory.Packages.props pinned Microsoft.SourceLink.GitHub at 8.0.0.
3. SourceLink 8.0.0 transitively pulls Microsoft.Build.Tasks.Git 8.0.0, which carries the advisory.
4. TreatWarningsAsErrors=true turns the resulting NU1902 warning into a build failure.

Impact is limited to the build pipeline: PrivateAssets="All" keeps SourceLink dev-time-only, so the vulnerable transitive package never flows to consumers of the published Alberto NuGet packages.

Fix

Bump the central Microsoft.SourceLink.GitHub pin from 8.0.0 to 10.0.401.

Per the advisory: Microsoft.Build.Tasks.Git 8.0.0 has no patched version in its own line, and the 10.0.2xx band is unpatched/unserviced, so a bump within 8.x isn't possible. 10.0.401 sits outside every vulnerable range listed in the advisory, and its nuspec confirms it pulls Microsoft.Build.Tasks.Git 10.0.401 — an exact match.

Alternatives considered and rejected:

• Drop the explicit SourceLink reference (relying on .NET 10 SDK's bundled SourceLink) — Alberto.Commands.Analyzers.csproj's own IsPackable=false comment documents the reference as deliberately load-bearing for packable projects, and switching to implicit SDK-provided SourceLink wasn't verified as producing equivalent metadata.
• Suppress the audit (NoWarn/NuGetAuditLevel) — silences future advisories too; not needed since a real patched version exists.

No API-surface risk: Microsoft.SourceLink.GitHub is a build-time-only MSBuild tasks package with no C# API surface.

Verification

• dotnet restore --force-evaluate: no NU1902 for Microsoft.Build.Tasks.Git/Microsoft.SourceLink.GitHub anywhere.
• dotnet list package --include-transitive across all 10 packable /src projects: Microsoft.Build.Tasks.Git now resolves to 10.0.401 everywhere, zero 8.0.0 remaining. The 3 non-packable projects correctly show no SourceLink reference at all.
• Solution-wide dotnet build: 0 errors, 103 warnings (all pre-existing and unrelated — xUnit analyzer suggestions and MessagePack/SSH.NET NU1902/NU1903 in projects that don't set TreatWarningsAsErrors).
• CI: build-test (the check that was failing) now passes on this PR.

Once this is green on main, #171 and #173 can be updated and merged.

Closes #175

🤖 Generated with Claude Code