Remove explicit Source Link package

[afscrome]

Why

Microsoft.SourceLink.GitHub 8.0.0 transitively restores Microsoft.Build.Tasks.Git 8.0.0, which is affected by GHSA-23fw-v26w-5fgq. The .NET SDK has included and enabled Source Link providers for GitHub-hosted SDK-style projects since .NET 8, so this explicit package reference is redundant and overrides the SDK-provided implementation.

Removing the reference lets projects use the SDK-provided Source Link implementation and removes the vulnerable NuGet dependency from restore.

Fixes failures in #1583, #1584 + more

Changes

• remove the redundant Microsoft.SourceLink.GitHub package reference and central version
• remove the now-default EmbedUntrackedSources property
• retain the existing shared PublishRepositoryUrl setting

Validation

Ran:

ext dotnet pack src/CommunityToolkit.Aspire.Hosting.Adminer/CommunityToolkit.Aspire.Hosting.Adminer.csproj --configuration Release --output <temp>

The package built successfully for
et8.0,
et9.0, and
et10.0. Inspected the resulting .nupkg and confirmed its nuspec still contains the Git repository URL, branch, and commit. Also confirmed the built
et10.0 assembly contains the GitHub Source Link mapping.

[Copilot]

🟢 Approval recommended

No unresolved review issues were identified.

Pull request overview

Removes redundant explicit Source Link configuration and relies on .NET SDK defaults.

Changes:

• Removed the Microsoft.SourceLink.GitHub package reference and central version.
• Removed the explicit EmbedUntrackedSources property.

File summaries

File	Description
src/Directory.Build.props	Removes Source Link package and property configuration.
Directory.Packages.props	Removes the centralized Source Link version.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.