.NET: Bump Microsoft.SourceLink.GitHub to 10.0.401

[Roger Barreto (rogerbarreto)]

Motivation & Context

Restore .NET builds that fail with NU1902 when the shared SourceLink reference resolves Microsoft.Build.Tasks.Git 8.0.0.

Description & Review Guide

• What are the major changes? Bump Microsoft.SourceLink.GitHub from 8.0.0 to 10.0.401 in dotnet/Directory.Packages.props.
• What is the impact of these changes? Its transitive dependency Microsoft.Build.Tasks.Git also resolves to 10.0.401. NuGet auditing remains enabled, with no runtime API changes.
• What do you want reviewers to focus on? The shared build dependency version. This is a one-line change.

Related Issue

Not applicable. This is a trivial dependency update, for which the Contribution Guidelines allow skipping a tracking issue. No matching open issue or PR was found.

Contribution Checklist

• The code builds clean without any errors or warnings (validated with scoped Debug builds and warnings as errors).
• All unit tests pass, and I have added new tests where possible (all 651 tests in Generators and Abstractions passed; the full solution test suite was not run). Scoped Docker formatting checks also passed without changes or workspace-loading errors.
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above). A tracking issue is not applicable to this trivial update.
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix). A workflow keeps the label and title prefix in sync automatically.

[Copilot]

🟢 Approval recommended

The change is a straightforward, consistent central package version bump with no additional code or API surface impact introduced in this PR.

Pull request overview

Updates the central .NET package version for SourceLink to restore builds failing NuGet auditing (NU1902) due to an older transitive Microsoft.Build.Tasks.Git resolution.

Changes:

• Bumped Microsoft.SourceLink.GitHub from 8.0.0 to 10.0.401 in dotnet/Directory.Packages.props (central package management).

File summaries

File	Description
dotnet/Directory.Packages.props	Updates the centrally managed SourceLink package version to a newer toolset line to avoid the audited transitive dependency issue.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[Roger Barreto (rogerbarreto)]

Closed as a duplicated of #8179

[github-actions]

MAF Automated Review — Iteration 1

Result: No findings
Scope: full PR (1 commit(s)): 970559d5ffa0
Model: gpt-5.6-sol-fast

Overview

This PR updates the centrally managed SourceLink build dependency so its transitive Git build task no longer resolves the vulnerable 8.0.0 version. The reference remains build-only and private to the repository's packaging projects, while NuGet auditing and the multi-framework build/pack workflow provide concrete guardrails. No publishable correctness, compatibility, architectural, or security risk was established.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.