fix(deps): keep compatibility builds secure

[yordis]

• Client compatibility must reject vulnerable build dependencies without disabling repository-wide security enforcement.
• Release artifacts need current source-link tooling so downstream compatibility gates remain trustworthy.

[cursor]

PR Summary

Low Risk
Single private build-time package version bump with no runtime or application logic changes.

Overview
Updates the repository-wide Microsoft.SourceLink.GitHub build package from 8.0.0 to 10.0.401 in Directory.Build.props, so NuGet packages produced from this client repo embed current GitHub source-link metadata during pack/build.

This aligns release artifacts with newer Source Link tooling, which supports keeping dependency/security compatibility checks trustworthy without turning off repo-wide enforcement on vulnerable build dependencies.

^{Reviewed by Cursor Bugbot for commit 5620a29. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: ad33a4de-5bb3-4939-90a6-c77a069f8244

📥 Commits

Reviewing files that changed from the base of the PR and between 2eac1a6 and 5620a29.

📒 Files selected for processing (1)

• src/Directory.Build.props

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

The build configuration updates Microsoft.SourceLink.GitHub from version 8.0.0 to 10.0.401.

Changes

SourceLink package update

Layer / File(s)	Summary
SourceLink package version update src/Directory.Build.props	The Microsoft.SourceLink.GitHub package reference changes from 8.0.0 to 10.0.401.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 5620a

This updates SourceLink tooling without an identified build, packaging, or security regression.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies a dependency security update for compatibility builds. This matches the primary objective and the package version change.
Description check	✅ Passed	The description directly explains the security goal and the source-link tooling update. It relates to the changeset and objectives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch yordis/fix-sourcelink-vulnerability

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the build file bright
SourceLink hops to a newer height
From eight to ten, the version grows
The project follows where it goes
One small change, and off it flows}

_{Comment @coderabbitai help to get the list of available commands.}