dotnet / SqlClient

Microsoft.Data.SqlClient provides database connectivity to SQL Server for .NET applications.
MIT License
859 stars 288 forks source link

Add package vulnerability information #3024

Open MichelZ opened 1 day ago

MichelZ commented 1 day ago

AI Blurp


This pull request includes changes to the NuGet configuration and build properties to improve package source auditing and manage warnings more effectively. The most important changes are as follows:

NuGet Configuration Updates:

Build Properties Enhancements:

Description

Adding new functionality for .NET 9 / VS 17.12 / NuGet 6.12 with Audit Sources. Also adding that the vulnerabilities (currently) are not treated as errors, but this can of course be enabled in the future

The idea is that package vulnerabilities get visibility at least on a warning level everywhere. I'm sure I don't have to remind anyone of this, but I still do 😁 : https://blogs.microsoft.com/blog/2024/05/03/prioritizing-security-above-all-else/

If you’re faced with the tradeoff between security and another priority, your answer is clear: Do security. -- Satya Nadella

codecov[bot] commented 1 day ago

Codecov Report

All modified and coverable lines are covered by tests :white_check_mark:

Project coverage is 72.73%. Comparing base (1b9df10) to head (0213a45).

Additional details and impacted files ```diff @@ Coverage Diff @@ ## main #3024 +/- ## ========================================== + Coverage 72.64% 72.73% +0.08% ========================================== Files 285 285 Lines 59160 59160 ========================================== + Hits 42979 43028 +49 + Misses 16181 16132 -49 ``` | [Flag](https://app.codecov.io/gh/dotnet/SqlClient/pull/3024/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=dotnet) | Coverage Δ | | |---|---|---| | [addons](https://app.codecov.io/gh/dotnet/SqlClient/pull/3024/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=dotnet) | `92.58% <ø> (ø)` | | | [netcore](https://app.codecov.io/gh/dotnet/SqlClient/pull/3024/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=dotnet) | `75.46% <ø> (+0.07%)` | :arrow_up: | | [netfx](https://app.codecov.io/gh/dotnet/SqlClient/pull/3024/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=dotnet) | `71.13% <ø> (+0.04%)` | :arrow_up: | Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=dotnet#carryforward-flags-in-the-pull-request-comment) to find out more.

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.


🚨 Try these New Features:

MichelZ commented 1 day ago

Also related to #2568