From db0e92b06a19d99ea9d79f4021453221ec11e0c5 Mon Sep 17 00:00:00 2001
From: Andrei Errapart <a.errapart@trenz-electronic.de>
Date: Sun, 13 Sep 2026 17:23:04 +0200
Subject: [PATCH] Build: SourceLink 10.0.401 - Microsoft.Build.Tasks.Git 8.0.0
 is flagged by GHSA-23fw-v26w-5fgq

NuGet audit runs at level low with NU1901-NU1904 as errors, so since the
advisory (CVE-2026-62900, published 2026-09-08) every restore of
OriginalCircuit.Altium and the generator fails with NU1902 on
Microsoft.Build.Tasks.Git 8.0.0, pulled in by Microsoft.SourceLink.GitHub
8.0.0. No 8.x is patched; 10.0.401 is the current stable release outside the
vulnerable ranges.
---
 Directory.Build.props | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Directory.Build.props b/Directory.Build.props
index 08468d6..d9e3715 100644
--- a/Directory.Build.props
+++ b/Directory.Build.props
@@ -51,7 +51,7 @@
 
   <!-- SourceLink for GitHub -->
   <ItemGroup>
-    <PackageReference Include="Microsoft.SourceLink.GitHub" Version="8.0.0" PrivateAssets="All" />
+    <PackageReference Include="Microsoft.SourceLink.GitHub" Version="10.0.401" PrivateAssets="All" />
   </ItemGroup>
 
   <ItemGroup Condition="'$(IsPackable)' != 'false' and '$(DevelopmentDependency)' != 'true'">