Bump the microsoft group with 3 updates by dependabot[bot] · Pull Request #482 · KooshaPari/Dino

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps Microsoft.NET.ILLink.Tasks from 11.0.0-preview.7.26381.103 to 11.0.0-rc.1.26425.128 Bumps Microsoft.SourceLink.GitHub from 10.0.400 to 10.0.401 Bumps System.CommandLine from 2.0.11 to 2.0.12 --- updated-dependencies: - dependency-name: Microsoft.NET.ILLink.Tasks dependency-version: 11.0.0-rc.1.26425.128 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: microsoft - dependency-name: Microsoft.SourceLink.GitHub dependency-version: 10.0.401 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: microsoft - dependency-name: System.CommandLine dependency-version: 2.0.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: microsoft ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-09-21T06:54:31Z

Labels

The following labels could not be found: nuget. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

codeant-ai · 2026-09-21T06:54:36Z

Skipping PR review because a bot author is detected.

If you want to trigger CodeAnt AI, comment @codeant-ai review to trigger a manual review.

coderabbitai · 2026-09-21T06:54:55Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: KooshaPari/Dino/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: f831a725-c8fb-49b0-ab8f-0f2a30de5fab

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

socket-security · 2026-09-21T06:55:31Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	nuget/system.text.json@10.0.12
	nuget/microsoft.extensions.logging.abstractions@10.0.11 ⏵ 10.0.12
	nuget/system.io.pipelines@10.0.12
	nuget/system.text.encodings.web@10.0.12
	nuget/microsoft.bcl.asyncinterfaces@10.0.11 ⏵ 10.0.12
	nuget/system.io.hashing@10.0.11 ⏵ 10.0.12
	nuget/microsoft.extensions.dependencyinjection@10.0.11 ⏵ 10.0.12
	nuget/microsoft.extensions.dependencyinjection.abstractions@10.0.11 ⏵ 10.0.12
	nuget/microsoft.extensions.logging@10.0.11 ⏵ 10.0.12
	nuget/microsoft.extensions.options@10.0.11 ⏵ 10.0.12
	nuget/microsoft.extensions.primitives@10.0.11 ⏵ 10.0.12
	nuget/microsoft.net.illink.tasks@11.0.0-preview.7.26381.103 ⏵ 11.0.0-rc.1.26425.128
	nuget/microsoft.extensions.configuration.abstractions@10.0.11 ⏵ 10.0.12
	nuget/microsoft.extensions.configuration.binder@10.0.11 ⏵ 10.0.12
	nuget/microsoft.extensions.diagnostics@10.0.11 ⏵ 10.0.12
	nuget/microsoft.extensions.diagnostics.abstractions@10.0.11 ⏵ 10.0.12
	nuget/microsoft.extensions.http@10.0.11 ⏵ 10.0.12
	nuget/microsoft.extensions.options.configurationextensions@10.0.11 ⏵ 10.0.12
	nuget/system.commandline@2.0.12
	nuget/microsoft.build.tasks.git@10.0.400 ⏵ 10.0.401
	nuget/microsoft.sourcelink.github@10.0.400 ⏵ 10.0.401
	nuget/system.drawing.common@8.0.31
	nuget/microsoft.sourcelink.common@10.0.400 ⏵ 10.0.401
	nuget/microsoft.data.sqlite@10.0.11 ⏵ 10.0.12
	nuget/microsoft.data.sqlite.core@10.0.11 ⏵ 10.0.12

View full report

socket-security · 2026-09-21T06:55:33Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		License policy violation: nuget `microsoft.bcl.asyncinterfaces` under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: NIST-Software - The applicable license policy does not permit this license (5) (THIRD-PARTY-NOTICES.TXT) From: src/Bridge/Client/packages.lock.json → `nuget/microsoft.bcl.asyncinterfaces@10.0.12` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore nuget/microsoft.bcl.asyncinterfaces@10.0.12`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: nuget `microsoft.extensions.configuration.abstractions` under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: NIST-Software - The applicable license policy does not permit this license (5) (THIRD-PARTY-NOTICES.TXT) From: src/Tools/Cli/packages.lock.json → `nuget/microsoft.extensions.configuration.abstractions@10.0.12` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore nuget/microsoft.extensions.configuration.abstractions@10.0.12`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: nuget `microsoft.extensions.configuration.binder` under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: NIST-Software - The applicable license policy does not permit this license (5) (THIRD-PARTY-NOTICES.TXT) From: src/Tools/Cli/packages.lock.json → `nuget/microsoft.extensions.configuration.binder@10.0.12` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore nuget/microsoft.extensions.configuration.binder@10.0.12`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: nuget `microsoft.extensions.dependencyinjection.abstractions` under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: NIST-Software - The applicable license policy does not permit this license (5) (THIRD-PARTY-NOTICES.TXT) From: src/Tools/Cli/packages.lock.json → `nuget/microsoft.extensions.dependencyinjection.abstractions@10.0.12` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore nuget/microsoft.extensions.dependencyinjection.abstractions@10.0.12`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: nuget `microsoft.extensions.dependencyinjection` under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: NIST-Software - The applicable license policy does not permit this license (5) (THIRD-PARTY-NOTICES.TXT) From: src/Tools/Cli/packages.lock.json → `nuget/microsoft.extensions.dependencyinjection@10.0.12` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore nuget/microsoft.extensions.dependencyinjection@10.0.12`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: nuget `microsoft.extensions.diagnostics.abstractions` under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: NIST-Software - The applicable license policy does not permit this license (5) (THIRD-PARTY-NOTICES.TXT) From: src/Tools/Cli/packages.lock.json → `nuget/microsoft.extensions.diagnostics.abstractions@10.0.12` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore nuget/microsoft.extensions.diagnostics.abstractions@10.0.12`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: nuget `microsoft.extensions.diagnostics` under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: NIST-Software - The applicable license policy does not permit this license (5) (THIRD-PARTY-NOTICES.TXT) From: src/Tools/Cli/packages.lock.json → `nuget/microsoft.extensions.diagnostics@10.0.12` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore nuget/microsoft.extensions.diagnostics@10.0.12`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: nuget `microsoft.extensions.http` under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: NIST-Software - The applicable license policy does not permit this license (5) (THIRD-PARTY-NOTICES.TXT) From: src/Tools/Cli/packages.lock.json → `nuget/microsoft.extensions.http@10.0.12` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore nuget/microsoft.extensions.http@10.0.12`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: nuget `microsoft.extensions.logging.abstractions` under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: NIST-Software - The applicable license policy does not permit this license (5) (THIRD-PARTY-NOTICES.TXT) From: src/Tools/Cli/packages.lock.json → `nuget/microsoft.extensions.logging.abstractions@10.0.12` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore nuget/microsoft.extensions.logging.abstractions@10.0.12`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: nuget `microsoft.extensions.logging` under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: NIST-Software - The applicable license policy does not permit this license (5) (THIRD-PARTY-NOTICES.TXT) From: src/Tools/Cli/packages.lock.json → `nuget/microsoft.extensions.logging@10.0.12` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore nuget/microsoft.extensions.logging@10.0.12`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: nuget `microsoft.extensions.options.configurationextensions` under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: NIST-Software - The applicable license policy does not permit this license (5) (THIRD-PARTY-NOTICES.TXT) From: src/Tools/Cli/packages.lock.json → `nuget/microsoft.extensions.options.configurationextensions@10.0.12` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore nuget/microsoft.extensions.options.configurationextensions@10.0.12`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: nuget `microsoft.extensions.options` under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: NIST-Software - The applicable license policy does not permit this license (5) (THIRD-PARTY-NOTICES.TXT) From: src/Tools/Cli/packages.lock.json → `nuget/microsoft.extensions.options@10.0.12` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore nuget/microsoft.extensions.options@10.0.12`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: nuget `microsoft.extensions.primitives` under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: NIST-Software - The applicable license policy does not permit this license (5) (THIRD-PARTY-NOTICES.TXT) From: src/Tools/Cli/packages.lock.json → `nuget/microsoft.extensions.primitives@10.0.12` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore nuget/microsoft.extensions.primitives@10.0.12`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: nuget `microsoft.net.illink.tasks` under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: NIST-Software - The applicable license policy does not permit this license (5) (THIRD-PARTY-NOTICES.TXT) From: src/Tools/PackCompiler/packages.lock.json → `nuget/microsoft.net.illink.tasks@11.0.0-rc.1.26425.128` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore nuget/microsoft.net.illink.tasks@11.0.0-rc.1.26425.128`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: nuget `system.diagnostics.diagnosticsource` under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: NIST-Software - The applicable license policy does not permit this license (5) (THIRD-PARTY-NOTICES.TXT) From: src/Tools/Cli/packages.lock.json → `nuget/microsoft.extensions.diagnostics.abstractions@10.0.12` → `nuget/microsoft.extensions.logging.abstractions@10.0.12` → `nuget/system.diagnostics.diagnosticsource@10.0.12` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore nuget/system.diagnostics.diagnosticsource@10.0.12`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: nuget `system.io.hashing` under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: NIST-Software - The applicable license policy does not permit this license (5) (THIRD-PARTY-NOTICES.TXT) From: src/Analyzers/packages.lock.json → `nuget/system.io.hashing@10.0.12` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore nuget/system.io.hashing@10.0.12`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: nuget `system.io.pipelines` under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: NIST-Software - The applicable license policy does not permit this license (5) (THIRD-PARTY-NOTICES.TXT) From: src/Bridge/Client/packages.lock.json → `nuget/system.io.pipelines@10.0.12` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore nuget/system.io.pipelines@10.0.12`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: nuget `system.text.encodings.web` under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: NIST-Software - The applicable license policy does not permit this license (5) (THIRD-PARTY-NOTICES.TXT) From: src/Bridge/Client/packages.lock.json → `nuget/system.text.encodings.web@10.0.12` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore nuget/system.text.encodings.web@10.0.12`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: nuget `system.text.json` under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (THIRD-PARTY-NOTICES.TXT) License: NIST-Software - The applicable license policy does not permit this license (5) (THIRD-PARTY-NOTICES.TXT) From: src/Bridge/Client/packages.lock.json → `nuget/system.text.json@10.0.12` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore nuget/system.text.json@10.0.12`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

sonarqubecloud · 2026-09-21T07:01:47Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

dependabot Bot added automated Automated changes dependencies Pull requests updating dependencies labels Sep 21, 2026

dependabot Bot requested a review from KooshaPari as a code owner September 21, 2026 06:54

dependabot Bot added dependencies Pull requests updating dependencies automated Automated changes labels Sep 21, 2026

Navigation Menu

Bump the microsoft group with 3 updates - #482

Bump the microsoft group with 3 updates#482
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/microsoft-e776b312d5

dependabot Bot commented on behalf of github Sep 21, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 21, 2026

Uh oh!

codeant-ai Bot commented Sep 21, 2026

Uh oh!

coderabbitai Bot commented Sep 21, 2026

Review skipped

Uh oh!

socket-security Bot commented Sep 21, 2026

Uh oh!

socket-security Bot commented Sep 21, 2026

Uh oh!

sonarqubecloud Bot commented Sep 21, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 21, 2026

10.0.401

What's Changed

Uh oh!

dependabot Bot commented on behalf of github Sep 21, 2026

Labels

Uh oh!

codeant-ai Bot commented Sep 21, 2026

Uh oh!

coderabbitai Bot commented Sep 21, 2026

Review skipped

Uh oh!

socket-security Bot commented Sep 21, 2026

Uh oh!

socket-security Bot commented Sep 21, 2026

Uh oh!

sonarqubecloud Bot commented Sep 21, 2026

Quality Gate passed

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants