[Mpdreamz]

Removes the Microsoft.SourceLink.GitHub package reference. The .NET SDK includes Source Link since .NET 8, so the package adds nothing, and Microsoft.Build.Tasks.Git leaves the dependency graph with it.

Prompt summary: Drop the explicit Source Link package from the .NET repositories, because the SDK provides Source Link and the pinned 8.0.0 version now fails restore with NU1902 (breaking change note).

Why

Since .NET 8 the SDK enables Source Link by default for GitHub remotes. The explicit package only keeps a dependency, and its transitive Microsoft.Build.Tasks.Git is the package behind the NU1902 advisory (GHSA-23fw-v26w-5fgq). Removing the reference ends the whole class of problem instead of chasing patched versions. This repo pins SDK 10.0.100.

What

Source Link

Directory.Packages.props and src/Directory.Build.props no longer reference Microsoft.SourceLink.GitHub. The SDK still embeds the Source Link mapping in each PDB and writes the repository element with the commit into each nuspec, so debugging into the shipped packages works as before.

Verify

dotnet restore
find . -name project.assets.json | xargs grep -l "Microsoft.Build.Tasks.Git"
# no output: the package is gone from every project

[github-actions]

🤖 GitHub comments

Just comment with:

• run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)