Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Working on #57560 lead me to NuGet/docs.microsoft.com-nuget#3336 which in turn pointed me to https://learn.microsoft.com/en-us/nuget/concepts/auditing-packages#audit-sources which talks about NuGet
<auditSources>
. This seems like it might be a better alternative to manually callingdotnet list package --vulnerable --include-transitive --source https://api.nuget.org/v3/index.json
in projects created by our templates in an XUnit test like I'm doing in #57560.@ViktorHofer I see that this is currently on your plate as part of dotnet/arcade#15019. Feel free to take this over if you want. I plan to add something like
<WarningsNotAsErrors Condition="'$(OfficialBuildId)' != ''">$(WarningsNotAsErrors);NU1901;NU1902;NU1903;NU1904</WarningsNotAsErrors>
to theDirectory.Build.props
before undrafting this, but first I want to see what fails in the normal PR builds.