From 4ca4e80e6a879c78f1aeca24baac2fa791413e6d Mon Sep 17 00:00:00 2001
From: Shay Rojansky <roji@roji.org>
Date: Wed, 9 Sep 2026 15:19:50 +0200
Subject: [PATCH] Fix vulnerable SourceLink dependency in .NET SDK

Update Microsoft.SourceLink.GitHub to 10.0.111 to pull in the patched Microsoft.Build.Tasks.Git dependency for CVE-2026-62900.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 dotnet/Directory.Packages.props | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dotnet/Directory.Packages.props b/dotnet/Directory.Packages.props
index 7d79a6a2e9..a7a5611c5e 100644
--- a/dotnet/Directory.Packages.props
+++ b/dotnet/Directory.Packages.props
@@ -11,7 +11,7 @@
     <PackageVersion Include="Microsoft.Extensions.AI.Abstractions" Version="10.2.0" />
     <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.2" />
     <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.3.0" />
-    <PackageVersion Include="Microsoft.SourceLink.GitHub" Version="10.0.102" />
+    <PackageVersion Include="Microsoft.SourceLink.GitHub" Version="10.0.111" />
     <PackageVersion Include="Microsoft.Bcl.Memory" Version="10.0.8" />
     <PackageVersion Include="System.Collections.Immutable" Version="10.0.2" />
     <PackageVersion Include="System.Net.Http.Json" Version="10.0.2" />