Closed zivkan closed 1 day ago
Hello.
I am using Microsoft Visual Studio Professional 2022 (64-bit) - Preview Version 17.11.0 Preview 4.0 and the latest .NET 8.0.7 and .NET 9 Preview 6 SDK. Attached is also my dotnet --info output for your reference.
I am running into an issue that Solution Explorer (1) warns about a vulnerable package, then I navigate to the NuGet Package Manager and click "Show only vulnerable" (2), but it shows nothing. It is a confusing experience, because the original warning is non-actionable. I can only see the actual vulnerable packages in the Error List (3) only if I build the solution and enable "Treat warnings as errors" under the project Build settings, but not every developer enables these settings by default.
Alternatively, I can manually expand every package and its dependencies until I find the problematic transitive dependencies, which is far from optimal (System.Security.Cryptography.Pkcs > System.Formats.Asn1):
Thank you for your consideration.
@dennis-garavsky Your comment doesn't have any similarities with the initial comment in this issue. You should have created a new issue instead of commenting here. That said, most of your points are addressed in https://devblogs.microsoft.com/nuget/nugetaudit-2-0-elevating-security-and-trust-in-package-management/
@zivkan Your issue seems to be a duplicate of #13141
Closing as duplicate
NuGet Product(s) Involved
Visual Studio Package Management UI
The Elevator Pitch
When installing packages in Visual Studio's package manager UI, (unless disabled) it will pop up a preview window telling you the list of packages that will be installed/upgraded. If this list contains packages with known vulnerabilities, it should tell you, before clicking the OK button to actually install the packages in the project.
Additional Context and Details
No response