[afscrome]

Linked issue: None supplied; prior issue approval has not been verified.

Remove only <package pattern="*" /> from the dotnet9-transport package source mapping in root nuget.config. Keep its explicit Microsoft.DotNet.GenAPI.Task mapping and all other configuration unchanged.

PR Checklist

• Created a feature/dev branch in your fork (vs. submitting directly from a commit on main)
• Based off latest main branch of toolkit
• PR doesn't include merge commits (always rebase on top of our main, if needed)
• New integration (N/A)
  • Docs are written (N/A)
  • Added description of major feature to project description for NuGet package (4000 total character limit, so don't push entire description over that) (N/A)
• Tests for the changes have been added (for bug fixes / features) (if applicable) (N/A: configuration-only change; focused validation below)
• Contains NO breaking changes
• Every new API (including internal ones) has full XML docs (N/A: no new APIs)
• Code follows all style conventions

Other information

The investigated Dependabot job ran for 55 minutes before cancellation, expanded 279 projects, performed 494 restores, and logged 4,443 HTTP 404 responses from the transport feed, many cached. Removing the wildcard avoids unnecessary transport-feed lookups for packages without a more specific mapping. It does not address repeated solution-wide analysis, and no runtime improvement has been measured.

Created in a clean isolated worktree after fetching upstream main; the base was f89a8f8bfe91ae70ce0e7726d97b89ee86e03825. No registry-access changes or unrelated parent-worktree changes are included.

Validation:

• git diff --check — passed before committing.
• [xml]$config = Get-Content .\nuget.config -Raw — passed: valid XML.
• PowerShell assertions — passed: the transport mapping contains only Microsoft.DotNet.GenAPI.Task, and the complete configuration matches origin/main:nuget.config except for the requested wildcard deletion.
• Build, restore, and integration tests were not run: this change only narrows NuGet source mapping; no package references or application code changed.

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/CommunityToolkit/Aspire/main/eng/scripts/dogfood-pr.sh | bash -s -- 2293

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/CommunityToolkit/Aspire/main/eng/scripts/dogfood-pr.ps1) } 2293"

[Copilot]

🟢 Approval recommended

The single-line deletion matches the stated scope, preserves explicit package routing, and has no identified blocking issues.

No open issues 🎉

What changed in this PR

This PR narrows NuGet source routing to avoid unnecessary lookups against the dotnet9-transport feed.

Changes:

• Removes the transport feed’s wildcard package mapping.
• Preserves the explicit Microsoft.DotNet.GenAPI.Task mapping and leaves all other configuration unchanged.

File	Description
nuget.config	Restricts the transport feed to its explicitly mapped build-tool package.

_{Review effort: Balanced}