---

This section details on the original issue you should resolve

<issue_title>[BUG] 2.9.0 added Microsoft.SourceLink.GitHub as a runtime dependency</issue_title>
<issue_description>### Describe the bug

2.8.0:

2.9.0:

This is not only a deployment issue, it also breaks builds.

In PR #890, the migration to Central Package Management moved PrivateAssets="All" from the PackageReference in src/OpenAI.csproj to the PackageVersion in Directory.Packages.props. However, NuGet does not honor PrivateAssets on PackageVersion when generating the nuspec for packing — it must be on the PackageReference itself.

As a result, Microsoft.SourceLink.GitHub 10.0.102 (and its transitive dependencies Microsoft.SourceLink.Common and Microsoft.Build.Tasks.Git) appear as regular dependencies of the OpenAI package. Any project that consumes OpenAI 2.9.0 gets SourceLink's MSBuild targets injected into its build. These targets attempt to generate source link metadata and fail with:

error : Source control information is not available - the generated source link is empty.

cc: @jsquire, @joseharriaga

Steps to reproduce

Use the OpenAI library as a dependency.

Code snippets

OS

All

.NET version

Any

Library version

2.9.0</issue_description>

<agent_instructions>- Be sure to add a change log entry to accompany any changes, following existing patterns

• Validate all assumptions and conclusions with data from an authoritative source
• Do research within the local context and on the internet to collect data
• If you lack data to validate, tell me what you don't know.
• IMPORTANT: Do not speculate
• IMPORTANT: Do not hallucinate
• IMPORTANT: Follow all repository instructions and conventions rigidly</agent_instructions>

Comments on the Issue (you are @copilot in this section)