From a3705ee0fce7215bc24c91f6bd444b80476af76f Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 14 Oct 2026 04:20:13 +0000
Subject: [PATCH 1/2] Initial plan


From 181182213f45bf3b90e15c80216bf3cb479125ed Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 14 Oct 2026 04:23:52 +0000
Subject: [PATCH 2/2] Remove vulnerable legacy SourceLink package override

Co-authored-by: robgruen <25374553+robgruen@users.noreply.github.com>
---
 Directory.Packages.props | 1 -
 README.md                | 4 ++++
 src/package/nuget.props  | 7 +------
 3 files changed, 5 insertions(+), 7 deletions(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index d0b055ab..8ac71779 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -31,7 +31,6 @@
     <PackageVersion Include="coverlet.collector" Version="3.2.0" />
     <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="5.0.0" />
     <PackageVersion Include="Microsoft.CSharp" Version="4.7.0" />
-    <PackageVersion Include="Microsoft.SourceLink.GitHub" Version="8.0.0" />
     <!--
       Microsoft.Bcl.Memory is pinned via central transitive pinning to
       remediate GHSA-73j8-2gch-69rq (CVE-2026-26127, .NET DoS in
diff --git a/README.md b/README.md
index e487857b..662e10d5 100644
--- a/README.md
+++ b/README.md
@@ -86,6 +86,10 @@ Prior versions of TypeChat.NET used the pre-release programming model of Semanti
 
 ## Building
 
+Use a serviced .NET SDK 8 or newer, including when building from Visual Studio.
+[Source Link is included in .NET SDK 8+](https://github.com/dotnet/sourcelink#using-source-link-in-net-projects),
+so the projects use its SDK-provided implementation rather than overriding it with legacy NuGet packages.
+
 * Visual Studio 2022. 
   * Load **typechat.sln** from the root directory. 
   * Restore packages
diff --git a/src/package/nuget.props b/src/package/nuget.props
index 77e5782b..b522a0ac 100644
--- a/src/package/nuget.props
+++ b/src/package/nuget.props
@@ -20,6 +20,7 @@
     <PackageReadmeFile>NUGET.md</PackageReadmeFile>
 
     <!-- Build symbol package (.snupkg) to distribute the PDB containing Source Link -->
+    <!-- .NET SDK 8+ supplies Source Link; legacy package references override its serviced version. -->
     <IncludeSymbols>true</IncludeSymbols>
     <SymbolPackageFormat>snupkg</SymbolPackageFormat>
 
@@ -28,12 +29,6 @@
     <DocumentationFile>bin\$(Configuration)\$(TargetFramework)\$(AssemblyName).xml</DocumentationFile>
   </PropertyGroup>
 
-  <ItemGroup>
-    <!-- SourceLink allows step-through debugging for source hosted on GitHub. -->
-    <!-- https://github.com/dotnet/sourcelink -->
-    <PackageReference Include="Microsoft.SourceLink.GitHub" PrivateAssets="All" />
-  </ItemGroup>
-
   <ItemGroup>
     <!-- Include icon.png and NUGET.md in the project. -->
     <None Include="../package/icon.png" Link="icon.png" Pack="true" PackagePath="." />