From de7e48e5d19fab0c64bdb7c17a99e4a18496c279 Mon Sep 17 00:00:00 2001
From: Marc Gravell <marc.gravell@gmail.com>
Date: Tue, 15 Sep 2026 14:52:42 +0100
Subject: [PATCH] Drop explicit Microsoft.SourceLink.GitHub reference

The .NET SDK has included and enabled Source Link for GitHub-hosted
repos by default since 8.0.100; our pinned SDK (10.0.101+, rollForward
latestMajor) is well past that. Referencing the package explicitly
overrides the SDK's own bundled version, taking on a dependency and
its future CVE/version churn for nothing.

Verified the generated *.sourcelink.json and packed nuspec <repository>
element are unchanged across all target frameworks (net481, netstandard2.0,
net6.0/8.0/10.0).
---
 Directory.Build.props    | 1 -
 Directory.Packages.props | 1 -
 2 files changed, 2 deletions(-)

diff --git a/Directory.Build.props b/Directory.Build.props
index 78812be6..cd678778 100644
--- a/Directory.Build.props
+++ b/Directory.Build.props
@@ -42,7 +42,6 @@
 
     <ItemGroup>
         <PackageReference Include="Microsoft.NETFramework.ReferenceAssemblies" PrivateAssets="All" IncludeAssets="runtime; build; native; contentfiles; analyzers"/>
-        <PackageReference Include="Microsoft.SourceLink.GitHub" PrivateAssets="All"/>
         <!--<PackageReference Include="Nerdbank.GitVersioning" PrivateAssets="all"/>-->
     </ItemGroup>
 </Project>
diff --git a/Directory.Packages.props b/Directory.Packages.props
index 41a3a1c9..eef96110 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -3,7 +3,6 @@
     <!-- core build -->
     <PackageVersion Include="Microsoft.CSharp" Version="4.7.0" />
     <PackageVersion Include="Microsoft.NETFramework.ReferenceAssemblies" Version="1.0.3" />
-    <PackageVersion Include="Microsoft.SourceLink.GitHub" Version="10.0.401" />
     <PackageVersion Include="Nerdbank.GitVersioning" Version="3.7.115" />
     <PackageVersion Include="Microsoft.CodeAnalysis.PublicApiAnalyzers" Version="5.6.0">
       <PrivateAssets>all</PrivateAssets>