[Bug Bash] The checked state of the checkbox ‘Use separate sources for vulnerability audit’ in ‘Options->NuGet Package Manager->Sources’ page should be remembered after clicking the ‘Save All’ button

[v-luzh]

NuGet Product Used

Visual Studio Package Management UI

Product Version

VS Main/11407.71 + NuGet Client Dev/7.3.0.55

Worked before?

It is not a regression since the checkbox ‘Use separate sources for vulnerability audit’ is a new feature.

Impact

It bothers me. A fix would be nice

Repro Steps & Context

Note:

1. Repro rate: 100%.

Repro Steps:

1. Create a C# Console App (.NET 10.0) in VS and open the project-level PM UI.
2. Click the menu ‘Tools->Options->NuGet Package Manager->Sources’ and add a local package source with the package name ‘Local’ in the ‘Package sources’ section.
3. Check the ‘Use separate sources for vulnerability audit’ and click the ‘Save All’ button.
4. Close VS, reload the solution and go to ‘Options->NuGet Package Manager->Sources’ page.

Expected Result:

The checking state of the checkbox ‘Use separate sources for vulnerability audit’ should be remembered.

Actual Result:

The checking state of the checkbox ‘Use separate sources for vulnerability audit’ has not been remembered as the screenshot.

[donnie-msft]

Hi @v-luzh, did you configure an audit source after checking the box? If not, NuGet Audit uses package sources, not separate sources for vulnerability audit.
This checkbox is a little different in that it is not saved - it's just for you to acknowledge that you want separate audit sources and then to set those up. Let me know if you have any questions or concerns around that, or if that doesn't work properly. Thanks!

[v-luzh]

Hi @donnie-msft, I didn't configure an audit source after checking the box. I thought it would be a little confused the state has not been remembered. If you just checked the box and clicked the 'Save all' button to treat with some urgent matter at that moment, when you come back and want to continue to configure an audit source you will find the checkbox was unchecked.

[donnie-msft]

ust checked the box and clicked the 'Save all' button to treat with some urgent matter at that moment, when you come back and want to continue to configure an audit source you will find the checkbox was uncheck

This is correct, because if you don't actually configure an audit source, Restore will not be doing anything different going forward. In other words, there is no new state for NuGet unless you configure at least 1 audit source.