Drop explicit Microsoft.SourceLink.GitHub reference - #3222
Merged
Merged
Conversation
The .NET SDK has included and enabled Source Link for GitHub-hosted repos by default since 8.0.100; our pinned SDK is well past that. Referencing the package explicitly overrides the SDK's own version with ours, which is why we had to hand-bump it for a CVE in Microsoft.Build.Tasks.Git (#3210) - a class of maintenance the SDK now handles for us if we get out of its way. Verified the generated *.sourcelink.json and the packed nuspec <repository> element are unchanged across all six TFMs. Closes #3218
This was referenced Sep 16, 2026
mgravell
added a commit
to protobuf-net/protobuf-net
that referenced
this pull request
Sep 16, 2026
The SDK has included Source Link by default since 8.0.100, so an explicit reference only overrides the SDK's version with a hand-managed one — a standing maintenance cost, and somewhere a transitive advisory has to be chased by hand. Verified rather than assumed, since this repo is multi-TFM: building `protobuf-net.Core` with and without produces a **byte-identical `*.sourcelink.json` on all four target frameworks** — `net462`, `netstandard2.0`, `netstandard2.1`, `net8.0` — and the same nuspec `<repository>` element, commit and all. Following [StackExchange.Redis#3222](StackExchange/StackExchange.Redis#3222). The same change is open as protobuf-net.Grpc#398 and is already in protobuf-net.Connect's 1.0 branch.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Microsoft.SourceLink.GitHubreference insrc/Directory.Build.props(and its version pin inDirectory.Packages.props) is redundant.Microsoft.Build.Tasks.Git, Bump SourceLink past CVE-2026-62900, and System.IO.Hashing with it #3210) required a manual bump. Dropping the reference hands that maintenance back to the SDK.Test plan
dotnet build Build.csproj -c Release /p:CI=true- 0 warnings, 0 errors, all TFMs*.sourcelink.jsonis still generated correctly (mapping to the built commit) for bothStackExchange.RedisandRESPiteacross every target framework, including net461/netstandard2.0dotnet packonStackExchange.Redis- confirmed the packed nuspec still carries the correct<repository>element with commit metadataCloses #3218