From 8ef999d917080b7d194a84af5ce52d60d7220de7 Mon Sep 17 00:00:00 2001 From: Bjorn Vandenbussche Date: Tue, 15 Sep 2026 21:33:53 +0200 Subject: [PATCH] fix(deps): bump Microsoft.SourceLink.GitHub to 10.0.401 to resolve NU1902 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Microsoft.SourceLink.GitHub 8.0.0 transitively pulls Microsoft.Build.Tasks.Git 8.0.0, which carries GHSA-23fw-v26w-5fgq (moderate, CVE-2026-62900). With TreatWarningsAsErrors=true across /src, the resulting NU1902 audit warning fails CI for every packable project (20 failures in run 34856779084 on main @ 239adb6). This is an environmental break, not a code regression: nothing in the affected files changed between the last green run and this one — the advisory was published in the interim (2026-09-08). Per the advisory, Microsoft.Build.Tasks.Git 8.0.0 has no patched version in its own line, and the 10.0.2xx band is unpatched/ unserviced, so bumping within 8.x isn't an option. Version 10.0.401 sits outside every vulnerable range and its nuspec confirms it pulls Microsoft.Build.Tasks.Git 10.0.401, an exact match. Chose a version bump over dropping the explicit SourceLink reference: Alberto.Commands.Analyzers.csproj documents IsPackable=false as deliberately excluding it from the SourceLink item group, i.e. the reference is load-bearing for packable projects, and switching to implicit SDK-provided SourceLink wasn't verified as equivalent. Also chose it over suppressing the audit (NoWarn/NuGetAuditLevel), which would silence future advisories too. No API-surface risk: Microsoft.SourceLink.GitHub is a build-time-only MSBuild tasks package. Verified locally: - dotnet restore --force-evaluate: no NU1902 for this package anywhere - dotnet list package --include-transitive across all 10 packable /src projects: Microsoft.Build.Tasks.Git now resolves to 10.0.401 everywhere, no 8.0.0 remaining - dotnet build (solution-wide): 0 errors, 103 warnings, none of them related to SourceLink or Build.Tasks.Git Co-Authored-By: Claude Sonnet 5 --- Directory.Packages.props | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Directory.Packages.props b/Directory.Packages.props index ac3cdf50..7d8a3809 100644 --- a/Directory.Packages.props +++ b/Directory.Packages.props @@ -74,7 +74,7 @@ - +