Checking your solution for NuGet vulnerabilities or deprecated packages

[giscus[bot]]

Checking your solution for NuGet vulnerabilities or deprecated packages

While your software might be the best in the world, it's only as good as the libraries it uses. In this small blog post, we will discover how to check your solution for NuGet vulnerabilities or deprecated packages.

https://steven-giesel.com/blogPost/a825c041-26dc-4488-8707-17697871d08e

[ThomasArdal]

This is an excellent post. I will roll this out to my repositories! One thing, though. Wouldn't grepping for 'Vulnerable' also trigger when no vulnerable packages are found?

The given project `ConsoleApp22` has no vulnerable packages given the current sources.

[ThomasArdal]

My idea was to simply wrap your code in an Action. Then fail the build if there is a vulnerable package. Just to be able to add this as two lines to all of my build files instead of 13. I will create the action if it's not something you want to do. Will make sure to reference your blog post and you as the author of the code, of course 👍🏻

[linkdotnet]

Oh sure - you are more than welcome to do so (even though it is very nice to credit me/my blog, don't feel forced to do so).
Given also that my initial take had an issue :D

But great initiative @ThomasArdal

[ThomasArdal]

Here's an initial version that I'll start playing around with: https://github.com/marketplace/actions/check-vulnerable-nuget-packages

[linkdotnet]

Oh, really nice @ThomasArdal !
And thanks for crediting. Could you add a small example in the README.md on how to use it?

[ThomasArdal]

That's a great idea. Will add that now 👍🏻 Would be nice with some kind of configuration of which path(s) to check. But will add that if anyone is interested.

[dlavysh]

Thanks for the post Steven!
For deprecated\outdated packages you can also check this open source tool: https://github.com/dotnet-outdated/dotnet-outdated

[linkdotnet]

Thanks for the link @dlavysh.
One question - I only noticed that outdated packages can leave an error - but it might be absolutely fine to use an non up-to-date version. Many dotnet package from Microsoft itself are available in many version (depending on the SDK version):

<PackageReference Include="Microsoft.EntityFrameworkCore" Version="8.0.4" />
<PackageReference Include="Microsoft.EntityFrameworkCore" Version="7.0.18" />

Both are still supported so I wouldn't like to receive an error if I use 7.0.18. Does the library support this case?