From 21ca246fac0d5ec0b5f9cfb52fad2ff15fe4c21e Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 11 Jul 2026 08:23:23 +0000 Subject: [PATCH] build: unblock Scorecard's Central Package Management detection MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The v5.3.0 Scorecard run after enabling CPM still reported Pinned-Dependencies at 7 ("0/2 nugetCommand dependencies pinned") with only the base remediation text — so its NuGet check evaluated CPM as disabled (IsCPMEnabled=false) and never entered the fixed-version branch. The likely trip-up: the Directory.Packages.props header comment spelled out FloorCheck's opt-out as the literal string "ManagePackageVersionsCentrally=false" above the real true element, so a first-match parser reads "false". Move the property to the top of the file and drop that token from the comment, leaving the genuine "true" as the only occurrence. MSBuild behaviour is unchanged (restore + build + 598 tests green). Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_014W1zrcBNy3jEs8ngAQKwZg --- Directory.Packages.props | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/Directory.Packages.props b/Directory.Packages.props index ff2be35..91bb243 100644 --- a/Directory.Packages.props +++ b/Directory.Packages.props @@ -1,5 +1,12 @@ + + + true + + - - true -