[afscrome]

Closes # (no issue number was provided)

Declare the NuGet feeds configured in nuget.config as anonymous registries in dependabot.yml and make them available to the NuGet update job. This allows Dependabot to access the feeds when resolving vulnerable package updates, which in turn hopefully allows dependabot to open the security fix PRs.

PR Checklist

• Created a feature/dev branch in your fork (vs. submitting directly from a commit on main)
• Based off latest main branch of toolkit
• PR doesn't include merge commits (always rebase on top of our main, if needed)
• New integration
  • Docs are written
  • Added description of major feature to project description for NuGet package (4000 total character limit, so don't push entire description over that)
• Tests for the changes have been added (for bug fixes / features) (if applicable)
• Contains NO breaking changes
• Every new API (including internal ones) has full XML docs
• Code follows all style conventions

Other information

The Dependabot configuration YAML parses successfully. No code tests apply to this configuration-only change. The repository template requires an issue link; no issue number was provided.

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/CommunityToolkit/Aspire/main/eng/scripts/dogfood-pr.sh | bash -s -- 2267

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/CommunityToolkit/Aspire/main/eng/scripts/dogfood-pr.ps1) } 2267"

[Copilot]

🟢 Approval recommended

The focused configuration change has matching registry references and no unresolved findings.

No open issues 🎉

What changed in this PR

Updates Dependabot’s NuGet configuration to make repository feeds available when resolving vulnerable package updates.

Changes:

• Declares three anonymous NuGet registries matching nuget.config.
• Enables those registries for the NuGet update job.

File	Description
.github/​dependabot.yml	Declares NuGet feeds and references them in the update job.

_{Review effort: Balanced}

[Copilot]

One or more custom setup steps configured for this repository failed during this Copilot code review run:

Restore .NET dependencies

Setup steps run before each review. If the review above is missing context, or no review was posted at all, the failing step above may be the cause. See the workflow run for failure details, fix your setup steps configuration, and re-request a review.

Note

You can configure setup steps for Copilot code review separately from Copilot cloud agent with a copilot-code-review.yml file. Read the docs for details.