C#: Do not manually add public feed when private registries are used

mbg · mbg · commit 4d3b0246b5c2 · 2025-03-25T10:14:03.000Z
diff --git a/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetPackageRestorer.cs b/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetPackageRestorer.cs
@@ -274,7 +274,6 @@ private void RestoreProjects(IEnumerable<string> projects, HashSet<string>? conf
                 // to `dotnet` ignores other feeds that may be configured, we also need to add the feeds
                 // we have discovered from analysing `nuget.config` files.
                 var sources = configuredSources ?? new();
-                sources.Add(PublicNugetOrgFeed);
                 this.dependabotProxy.RegistryURLs.ForEach(url => sources.Add(url));
 
                 // Add package sources. If any are present, they override all sources specified in
