From f3b9bbe70b68fa865cb60436d8878d6dd248e5d6 Mon Sep 17 00:00:00 2001 From: David Pine Date: Wed, 15 Jul 2026 08:34:12 -0500 Subject: [PATCH 1/4] ci: add NuGet ecosystem to Dependabot configuration The repo has a .NET solution (Aspire.Dev.slnx) with NuGet packages across AppHost, StaticHost, tools, and test projects. Two NuGet security advisories (OpenTelemetry.Exporter.OpenTelemetryProtocol CVE-2026-40891 / CVE-2026-40182) were fixed manually but no automated NuGet scanning was configured. This adds weekly NuGet scanning via Dependabot so future vulnerabilities in NuGet packages are caught automatically. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/dependabot.yml | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 02905917b..fd92c3b02 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,4 +1,4 @@ -version: 2 +version: 2 updates: - package-ecosystem: "npm" directories: @@ -10,3 +10,12 @@ updates: npm-all: patterns: - "*" + # nuget: AppHost, StaticHost, tools, and test projects + - package-ecosystem: "nuget" + directory: "/" + schedule: + interval: "weekly" + groups: + nuget-all: + patterns: + - "*" From 2f93776bc421e2dc536480f60116640490a7cf78 Mon Sep 17 00:00:00 2001 From: David Pine Date: Thu, 16 Jul 2026 06:58:14 -0500 Subject: [PATCH 2/4] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .github/dependabot.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index fd92c3b02..0f89d3ad5 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,4 +1,4 @@ -version: 2 +version: 2 updates: - package-ecosystem: "npm" directories: From 8b7da16e872fbeef44288544cdc2e0c5e6a0f38c Mon Sep 17 00:00:00 2001 From: David Pine Date: Fri, 17 Jul 2026 08:05:34 -0500 Subject: [PATCH 3/4] ci: limit NuGet Dependabot updates Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/dependabot.yml | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 0f89d3ad5..b894eb41b 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -10,12 +10,19 @@ updates: npm-all: patterns: - "*" - # nuget: AppHost, StaticHost, tools, and test projects + # NuGet updates are limited to third-party dependencies. Microsoft-owned + # packages are updated through dependency flow or require manual testing. - package-ecosystem: "nuget" directory: "/" schedule: interval: "weekly" + allow: + - dependency-name: "OpenTelemetry.*" + - dependency-name: "xunit" + - dependency-name: "xunit.*" groups: - nuget-all: + nuget-third-party: patterns: - - "*" + - "OpenTelemetry.*" + - "xunit" + - "xunit.*" From 656f30b663dcbb31c9560d6a84c2d59d8db53cc7 Mon Sep 17 00:00:00 2001 From: David Pine Date: Fri, 17 Jul 2026 08:30:44 -0500 Subject: [PATCH 4/4] ci: include test and tool NuGet packages Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/dependabot.yml | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index b894eb41b..4d78ae236 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -10,19 +10,28 @@ updates: npm-all: patterns: - "*" - # NuGet updates are limited to third-party dependencies. Microsoft-owned - # packages are updated through dependency flow or require manual testing. + # NuGet updates are limited to third-party dependencies and selected test + # and tool packages. Other Microsoft-owned packages use dependency flow or + # require manual testing. - package-ecosystem: "nuget" directory: "/" schedule: interval: "weekly" allow: + - dependency-name: "Microsoft.AspNetCore.TestHost" + - dependency-name: "Microsoft.CodeAnalysis.CSharp.Workspaces" + - dependency-name: "Microsoft.NET.Test.Sdk" - dependency-name: "OpenTelemetry.*" + - dependency-name: "System.CommandLine" - dependency-name: "xunit" - dependency-name: "xunit.*" groups: - nuget-third-party: + nuget-selected: patterns: + - "Microsoft.AspNetCore.TestHost" + - "Microsoft.CodeAnalysis.CSharp.Workspaces" + - "Microsoft.NET.Test.Sdk" - "OpenTelemetry.*" + - "System.CommandLine" - "xunit" - "xunit.*"