C#: Address Copilots review comments.

Author: michaelnebel

csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetPackageRestorer.cs

@@ -352,7 +352,7 @@ private IEnumerable<string> RestoreSolutions(string? nugetSources, out Dependenc
             var feedArgs = new StringBuilder();
             foreach (var feed in feeds)
             {
-                feedArgs.Append($" -s {feed}");
+                feedArgs.Append($" -s \"{feed}\"");
             }
 
             return feedArgs.ToString();
@@ -692,7 +692,7 @@ private void TryChangeProjectFile(DirectoryInfo projectDir, Regex pattern, strin
 
         private static async Task<HttpResponseMessage> ExecuteGetRequest(string address, HttpClient httpClient, CancellationToken cancellationToken)
         {
-            return await httpClient.GetAsync(address, cancellationToken);
+            return await httpClient.GetAsync(address, HttpCompletionOption.ResponseHeadersRead, cancellationToken);
         }
 
         private bool IsFeedReachable(string feed, int timeoutMilliSeconds, int tryCount, out bool isTimeout)
@@ -737,7 +737,7 @@ private bool IsFeedReachable(string feed, int timeoutMilliSeconds, int tryCount,
                 try
                 {
                     logger.LogInfo($"Attempt {i + 1}/{tryCount} to reach NuGet feed '{feed}'.");
-                    var response = ExecuteGetRequest(feed, client, cts.Token).GetAwaiter().GetResult();
+                    using var response = ExecuteGetRequest(feed, client, cts.Token).GetAwaiter().GetResult();
                     response.EnsureSuccessStatusCode();
                     logger.LogInfo($"Querying NuGet feed '{feed}' succeeded.");
                     return true;
@@ -824,9 +824,12 @@ private bool CheckSpecifiedFeeds(HashSet<string> feeds, out HashSet<string> reac
             }).ToHashSet();
 
             reachableFeeds = GetReachableNuGetFeeds(feedsToCheck, isFallback: false, out var isTimeout).ToHashSet();
-
             var allReachable = reachableFeeds.Count == feedsToCheck.Count;
             EmitUnreachableFeedsDiagnostics(allReachable);
+
+            // Always consider feeds excluded for the reachability check as reachable.
+            reachableFeeds.UnionWith(feeds.Where(feed => excludedFeeds.Contains(feed)));
+
             return !isTimeout;
         }
 

csharp/ql/lib/change-notes/2026-04-10-nuget-feed-usage-in-bmn.md

@@ -1,4 +1,4 @@
 ---
 category: majorAnalysis
 ---
-* When resolving dependencies in `build-mode: none`, `dotnet restore` now always receives the NuGet feeds configured in `nuget.config` (if reachable) and any private registries directly, improving reliability when default feeds are unavailable or restricted.
+* When resolving dependencies in `build-mode: none`, `dotnet restore` now explicitly receives reachable NuGet feeds configured in `nuget.config` when feed responsiveness checking is enabled (the default), and any private registries directly, improving reliability when default feeds are unavailable or restricted.