From 1bd95ab4adfd3304969e3c84cb035eae60fd43e5 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 20 Aug 2026 23:47:23 +0000
Subject: [PATCH] fix: add package source mapping and pin vulnerable package

Co-authored-by: BenjaminMichaelis <22186029+BenjaminMichaelis@users.noreply.github.com>
---
 Directory.Packages.props | 2 ++
 NuGet.config             | 8 ++++++++
 2 files changed, 10 insertions(+)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index 6cabaa0fb..18a4295c7 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -2,6 +2,7 @@
 <Project xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <PropertyGroup>
     <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
+    <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
   </PropertyGroup>
   <ItemGroup>
     <!-- Azure Monitor OpenTelemetry distro (stable) -->
@@ -29,6 +30,7 @@
     <PackageVersion Include="Serilog" Version="4.4.0" />
     <PackageVersion Include="System.CommandLine" Version="2.0.11" />
     <PackageVersion Include="System.Drawing.Common" Version="10.0.11" />
+    <PackageVersion Include="System.Security.Cryptography.Xml" Version="10.0.11" />
     <PackageVersion Include="System.Reactive" Version="7.0.0" />
     <PackageVersion Include="xunit.runner.visualstudio" Version="3.1.5" />
     <PackageVersion Include="xunit" Version="2.9.3" />
diff --git a/NuGet.config b/NuGet.config
index 9c19a8388..9f595ab60 100644
--- a/NuGet.config
+++ b/NuGet.config
@@ -9,4 +9,12 @@
     <!-- Microsoft.DotNet.Interactive.CSharpProject is not published to nuget.org -->
     <add key="dotnet-tools" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-tools/nuget/v3/index.json" />
   </packageSources>
+  <packageSourceMapping>
+    <packageSource key="nuget.org">
+      <package pattern="*" />
+    </packageSource>
+    <packageSource key="dotnet-tools">
+      <package pattern="Microsoft.DotNet.Interactive*" />
+    </packageSource>
+  </packageSourceMapping>
 </configuration>