Bump NuGet.Packaging and NuGet.Protocol

[dependabot]

Updated NuGet.Packaging from 6.3.4 to 7.6.0.

Release notes

Sourced from NuGet.Packaging's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated NuGet.Protocol from 6.3.4 to 7.6.0.

Release notes

Sourced from NuGet.Protocol's releases.

No release notes found for this version range.

Commits viewable in compare view.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ cryptohivekeeper
❌ dependabot[bot]
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 6 package(s) with unknown licenses.

See the Details below.

License Issues

tests/Threading.Analyzers/Threading.Analyzers.Tests.csproj

Package	Version	License	Issue Type
NuGet.Common	7.6.0	Null	Unknown License
NuGet.Configuration	7.6.0	Null	Unknown License
NuGet.Frameworks	7.6.0	Null	Unknown License
NuGet.Packaging	7.6.0	Null	Unknown License
NuGet.Protocol	7.6.0	Null	Unknown License
NuGet.Versioning	7.6.0	Null	Unknown License

Denied Licenses:

GPL-3.0, AGPL-3.0, GPL-2.0, LGPL-2.0, LGPL-2.1, LGPL-3.0

Excluded from license check:

pkg:nuget/NUnit.Console, pkg:nuget/OpenGost.Security.Cryptography

OpenSSF Scorecard

Package	Version	Score	Details
nuget/NuGet.Common	7.6.0	Unknown	Unknown
nuget/NuGet.Configuration	7.6.0	Unknown	Unknown
nuget/NuGet.Frameworks	7.6.0	Unknown	Unknown
nuget/NuGet.Packaging	7.6.0	Unknown	Unknown
nuget/NuGet.Protocol	7.6.0	Unknown	Unknown
nuget/NuGet.Versioning	7.6.0	Unknown	Unknown
nuget/System.Security.Cryptography.Pkcs	8.0.1	🟢 6.5	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 21 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 10 all changesets reviewed CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Security-Policy 🟢 10 security policy file detected Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 8 branch protection is not maximal on development and all release branches Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts ⚠️ 0 binaries present in source code SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0 Pinned-Dependencies 🟢 7 dependency not pinned by hash detected -- score normalized to 7 Fuzzing 🟢 10 project is fuzzed
nuget/System.Security.Cryptography.ProtectedData	8.0.0	🟢 6.5	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 21 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 10 all changesets reviewed CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Security-Policy 🟢 10 security policy file detected Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 8 branch protection is not maximal on development and all release branches Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts ⚠️ 0 binaries present in source code SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0 Pinned-Dependencies 🟢 7 dependency not pinned by hash detected -- score normalized to 7 Fuzzing 🟢 10 project is fuzzed
nuget/System.Text.Encodings.Web	8.0.0	🟢 6.5	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 21 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 10 all changesets reviewed CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Security-Policy 🟢 10 security policy file detected Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 8 branch protection is not maximal on development and all release branches Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts ⚠️ 0 binaries present in source code SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0 Pinned-Dependencies 🟢 7 dependency not pinned by hash detected -- score normalized to 7 Fuzzing 🟢 10 project is fuzzed
nuget/System.Text.Json	8.0.5	🟢 6.5	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 21 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 10 all changesets reviewed CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Security-Policy 🟢 10 security policy file detected Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 8 branch protection is not maximal on development and all release branches Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts ⚠️ 0 binaries present in source code SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0 Pinned-Dependencies 🟢 7 dependency not pinned by hash detected -- score normalized to 7 Fuzzing 🟢 10 project is fuzzed

Scanned Files

• tests/Threading.Analyzers/Threading.Analyzers.Tests.csproj

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml