Labels

The following labels could not be found: dependencies, nuget. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

🔍 Cisco mcp-scanner result

=== MCP Scanner Results Summary ===

Scan Target: stdio:dotnet run --project src/maf-autopilot --framework net10.0 --no-build
Total tools scanned: 28
No results match the specified filters.

_{Scan covers prompt-injection, tool-poisoning, credential-harvesting,
code-execution, parameter-injection, cross-origin-escalation, and rug-pull
patterns. See docs/security.md for the canonical interpretation. This
check is a required gate — see the "Run mcp-scanner" step above for the
exact pass/fail evaluation.}

Closing: the Roslyn analyzer package must keep a low Microsoft.CodeAnalysis floor so it loads in older SDKs/VS. Moving the analyzer to 5.6 would silently stop it loading for those users. The plan (ROADMAP R-03) is to move the tool's scanner to Roslyn 5.x while pinning the analyzer to 4.x via VersionOverride; a Dependabot ignore rule for Roslyn majors follows.

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.