Fix SourceLink advisory and pin patched .NET SDK - #98
Open
Tamir Dresher (tamirdresher) wants to merge 1 commit into
Open
Fix SourceLink advisory and pin patched .NET SDK#98Tamir Dresher (tamirdresher) wants to merge 1 commit into
Tamir Dresher (tamirdresher) wants to merge 1 commit into
Conversation
Update SourceLink GitHub to the smallest patched stable upgrade and move the declared SDK to the patched 10.0.303 release in its existing feature band. Keep transitive auditing and warnings-as-errors enabled. Validated with exact SDK 10.0.303 through Microsoft CFS and accepted by independent gpt-5.6-sol formal review before commit. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 532fe4f5-939b-4962-989d-a1883dccd283 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot started reviewing on behalf of
Tamir Dresher (tamirdresher)
September 11, 2026 21:01
View session
Contributor
There was a problem hiding this comment.
Copilot review overview
🟢 Approval recommended
No unresolved review findings remain.
Review tier: Lite
Findings: None
What changed in this PR
Updates build tooling to address the SourceLink advisory without changing production code.
Changes:
- Pins the .NET SDK to
10.0.303. - Upgrades
Microsoft.SourceLink.GitHubto10.0.111.
| File | Description |
|---|---|
dotnet/global.json |
Updates the declared SDK version. |
dotnet/Directory.Packages.props |
Updates the centrally managed SourceLink package. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Tamir Dresher (tamirdresher)
marked this pull request as ready for review
September 12, 2026 10:21
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fix the baseline .NET restore failure caused by GHSA-23fw-v26w-5fgq / CVE-2026-62900.
Changes
Microsoft.SourceLink.GitHubfrom8.0.0to10.0.111.10.0.301to10.0.303.No production code, public API, runtime dependency, audit policy, warning suppression, or workflow behavior is changed.
Why both updates are needed
Microsoft.SourceLink.GitHub 8.0.0brings in the affectedMicrosoft.Build.Tasks.Git 8.0.0. Updating only the NuGet package is not sufficient because the .NET SDK also bundles SourceLink and Git build tasks that can take precedence during execution.10.0.111is the first stable SourceLink version available through Microsoft CFS with the patched Git and Common task packages. SDK10.0.303contains the corresponding patched SDK task set in the existing10.0.3xxfeature band.Validation
Validation used exact SDK
10.0.303and Microsoft CFS only:NU1902warnings-as-errors restore failure with the previous versions..nupkgand.snupkgpackage pairs were produced successfully.dotnet format --verify-no-changespassed for all 359 files.Scope
This is an independent build-tooling and security update. It does not depend on or modify the durable-history feature stack.