So you've only got that one package defined in your csproj and everything else is pulled in through the runtime? Are you seeing a security update trying to add an explicit reference to a runtime package?

Also, hello 👋 guess who works on Dependabot now 😁