[Maintenance] Monthly Dependency Audit

[iwizsophy]

Summary

Maintain a single recurring place to record monthly and pre-release transitive dependency audits.

Scope

• run dotnet list package --include-transitive
• review Dependabot PRs
• review GitHub security advisories and Dependabot alerts
• create follow-up issues for significant license or security findings
• use comments on this issue for each monthly audit instead of opening a new issue every month

Goal

Keep dependency-audit history in one tracked issue and ensure transitive dependency, license, and security reviews happen monthly and before each release.

Comment template

## YYYY-MM Dependency Audit

- Checked transitive dependencies with `dotnet list package --include-transitive`
- Reviewed Dependabot PRs
- Reviewed GitHub security advisories / Dependabot alerts
- Findings:
  - none

Related issues:
- none

[iwizsophy]

2026-03 Dependency Audit

• Checked transitive dependencies with dotnet list DependencyContractAnalyzer.slnx package --include-transitive
• Checked known package vulnerabilities with dotnet list DependencyContractAnalyzer.slnx package --include-transitive --vulnerable
• Reviewed Dependabot PRs
• Reviewed GitHub security advisories / Dependabot alerts as far as repository settings allow
• Findings:
  • No vulnerable NuGet packages were reported by the local vulnerability check.
  • No Dependabot PRs were present at the time of the audit.
  • Dependabot alerts could not be reviewed through the GitHub API because alerts are disabled for this repository (HTTP 403).

Related issues:

• [Governance] Finalize governance workflow enforcement and GitHub repo settings #73