GitHub repository: stephen-vakil/dependabot-nuget-no-cpm
Primary language: C#
Description: demo of dependabot correctly identifying vulnerable top-level nuget package references