Skip to content

Clarify requirements for security auditing in dotnet restore #50271

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
meaghanlewis merged 3 commits into from
Dec 5, 2025
Merged

Clarify requirements for security auditing in dotnet restore #50271

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
5e0a547
Clarify requirements for security auditing in dotnet restore
meaghanlewis Dec 2, 2025
bb6c98e
update audit section
meaghanlewis Dec 2, 2025
0fff58c
Update docs/core/tools/dotnet-restore.md
meaghanlewis Dec 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion docs/core/tools/dotnet-restore.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -199,14 +199,16 @@ Starting in .NET 8, `dotnet restore` includes NuGet security auditing. This audi

To opt out of the security auditing, set the `<NuGetAudit>` MSBuild property to `false` in your project file.

To retrieve the known vulnerability dataset, ensure that you have the NuGet.org central registry defined as one of your package sources:
To retrieve the known vulnerability dataset from the NuGet.org central registry, define the following in the *nuget.config* file:
Copy link
Member

@zivkan zivkan Dec 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When NuGetAudit was added in .NET 8, using a NuGet feed with vulnerability data (like nuget.org) as a package source was the only way to get it to work. But in .NET 9 we added auditSources, so customers can avoid nuget.org as a package source for supply chain security reasons, but still use audit. NuGet's docs on auditing packages explains the differences between audit sources and package sources, along with other configuration options.

IMO this makes it sound like using nuget.org as a package source is the only way to use NuGetAudit, which I'm concerned will discourage people who don't use nuget.org for security reasons.


```xml
<packageSources>
<add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
</packageSources>
```

NuGet.org is the only package source that provides a vulnerability dataset for NuGet auditing. However, NuGet audits any source as long as the source provides the [`VulnerabilityInfo` resource](/nuget/api/vulnerability-info).
Copy link
Member

@zivkan zivkan Dec 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unless the first sentence accidentally missed a "not", I feel like the first sentence contradicts the second.

Anyway, to clarify, nuget.org is not the only NuGet feed that supports vulnerability data. Azure Artifacts has the capability now (although still through a preview feature, I believe), and I've heard from customers that Artifactory also support it.

Copy link
Contributor Author

@meaghanlewis meaghanlewis Dec 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@zivkan thanks for the feedback. I'll modify and have you review.


You can configure the level at which auditing will fail by setting the `<NuGetAuditLevel>` MSBuild property. Possible values are `low`, `moderate`, `high`, and `critical`. For example if you only want to see moderate, high, and critical advisories, you can set the property to `moderate`.

In .NET 8 and .NET 9, only *direct* package references are audited by default. Starting in .NET 10, NuGet audits both *direct* and *transitive* package references by default. You can change the mode by setting the `<NuGetAuditMode>` MSBuild property to `direct` or `all`.
Expand Down