From 5d9aff0f020642e33a74ccabfa4dc373b66f5f22 Mon Sep 17 00:00:00 2001
From: "dotnet-maestro[bot]" <dotnet-maestro[bot]@users.noreply.github.com>
Date: Wed, 1 Jul 2026 02:08:10 +0000
Subject: [PATCH 1/4] Backflow from https://github.com/dotnet/dotnet / a9679a8
 build 320973

Diff: https://github.com/dotnet/dotnet/compare/2dc99e9fbda76d5f7d01a932367e709dda184973..a9679a8de87742e170318ea39f7f0e2874bcd441

From: https://github.com/dotnet/dotnet/commit/2dc99e9fbda76d5f7d01a932367e709dda184973
To: https://github.com/dotnet/dotnet/commit/a9679a8de87742e170318ea39f7f0e2874bcd441

[[ commit created by automation ]]
---
 NuGet.config | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/NuGet.config b/NuGet.config
index 527f95b5c87..a6df74bb15e 100644
--- a/NuGet.config
+++ b/NuGet.config
@@ -35,4 +35,8 @@
   <fallbackPackageFolders>
     <clear />
   </fallbackPackageFolders>
+  <auditSources>
+    <clear />
+    <add key="nuget.org" value="https://data.nuget.org/v3/index.json" />
+  </auditSources>
 </configuration>

From 7f2beb785e3519df0592a4025e919bcebd3a5a27 Mon Sep 17 00:00:00 2001
From: "dotnet-maestro[bot]" <dotnet-maestro[bot]@users.noreply.github.com>
Date: Wed, 1 Jul 2026 02:08:22 +0000
Subject: [PATCH 2/4] Update dependencies from build 320973 No dependency
 updates to commit [[ commit created by automation ]]

---
 eng/Version.Details.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml
index cde651c444d..2347e50d3e4 100644
--- a/eng/Version.Details.xml
+++ b/eng/Version.Details.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <Dependencies>
-  <Source Uri="https://github.com/dotnet/dotnet" Mapping="fsharp" Sha="1358fe9202089df7bdb79282a191c9dbbb773a06" BarId="320196" />
+  <Source Uri="https://github.com/dotnet/dotnet" Mapping="fsharp" Sha="a9679a8de87742e170318ea39f7f0e2874bcd441" BarId="320973" />
   <ProductDependencies>
     <Dependency Name="Microsoft.Build" Version="18.9.0-preview-26329-05">
       <Uri>https://github.com/dotnet/msbuild</Uri>

From 18cd7ae96772211047fd7c038bdefab88e3ed6c3 Mon Sep 17 00:00:00 2001
From: Copilot <copilot@github.com>
Date: Sun, 5 Jul 2026 21:37:40 +0200
Subject: [PATCH 3/4] Suppress NuGet audit advisories for transitive test-only
 dependencies

The codeflow update enabled a NuGet audit source, surfacing pre-existing
NU1903 advisories for transitive test dependencies (System.Net.Http 4.3.0
and System.Text.RegularExpressions 4.3.0). Their implementations ship in
the shared framework, so suppress the advisories for test projects.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 tests/Directory.Build.props | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/tests/Directory.Build.props b/tests/Directory.Build.props
index ccc7e44ffa3..20af58ef340 100644
--- a/tests/Directory.Build.props
+++ b/tests/Directory.Build.props
@@ -7,6 +7,15 @@
     <DebugType>portable</DebugType>
   </PropertyGroup>
 
+  <!-- Suppress NuGet audit advisories for old transitive test-only dependencies. These reference
+       packages (System.Net.Http 4.3.0, System.Text.RegularExpressions 4.3.0) are pulled in
+       transitively by test tooling; the actual implementations ship in the shared framework, so
+       the advisories are not exploitable here. -->
+  <ItemGroup>
+    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-7jgj-8wvc-jh57" />
+    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-cmhx-cq75-c4mj" />
+  </ItemGroup>
+
   <!-- xUnit3 packages for all test projects (except Test.Utilities which is a library) -->
   <ItemGroup Condition="($(MSBuildProjectName.EndsWith('.Tests')) OR $(MSBuildProjectName.EndsWith('.ComponentTests')) OR $(MSBuildProjectName.EndsWith('.UnitTests'))) AND '$(ExcludeFromTestPackageReferences)' != 'true'">
     <PackageReference Include="xunit.v3.mtp-v2" Version="$(XunitVersion)" />

From 633eb095473103f51748dcc365ff90ced5e2f799 Mon Sep 17 00:00:00 2001
From: Copilot <copilot@github.com>
Date: Sun, 5 Jul 2026 23:03:55 +0200
Subject: [PATCH 4/4] Restrict NuGet audit to direct dependencies for test
 projects

The per-advisory suppression was brittle: each restore graph resolves
transitive packages (System.Net.Http, System.Text.RegularExpressions,
MessagePack) to different versions with different advisory sets, causing
whack-a-mole NU1902/NU1903 failures. Since none of these packages are
referenced directly and their implementations ship in the shared
framework, restrict auditing to direct dependencies for test projects.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 tests/Directory.Build.props | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/tests/Directory.Build.props b/tests/Directory.Build.props
index 20af58ef340..d71dd6c6669 100644
--- a/tests/Directory.Build.props
+++ b/tests/Directory.Build.props
@@ -7,14 +7,14 @@
     <DebugType>portable</DebugType>
   </PropertyGroup>
 
-  <!-- Suppress NuGet audit advisories for old transitive test-only dependencies. These reference
-       packages (System.Net.Http 4.3.0, System.Text.RegularExpressions 4.3.0) are pulled in
-       transitively by test tooling; the actual implementations ship in the shared framework, so
-       the advisories are not exploitable here. -->
-  <ItemGroup>
-    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-7jgj-8wvc-jh57" />
-    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-cmhx-cq75-c4mj" />
-  </ItemGroup>
+  <!-- The codeflow update enabled a NuGet audit source, which surfaces advisories for old
+       transitive test-only dependencies (e.g. System.Net.Http, System.Text.RegularExpressions,
+       MessagePack). Their implementations ship in the shared framework and none are referenced
+       directly here, so restrict auditing to direct dependencies for test projects rather than
+       chasing individual transitive advisories. -->
+  <PropertyGroup>
+    <NuGetAuditMode>direct</NuGetAuditMode>
+  </PropertyGroup>
 
   <!-- xUnit3 packages for all test projects (except Test.Utilities which is a library) -->
   <ItemGroup Condition="($(MSBuildProjectName.EndsWith('.Tests')) OR $(MSBuildProjectName.EndsWith('.ComponentTests')) OR $(MSBuildProjectName.EndsWith('.UnitTests'))) AND '$(ExcludeFromTestPackageReferences)' != 'true'">