Add-Migration fails due to AWSSDK.Core 4.0.0.28 NU1901 vulnerability warning

[nazem0]

Is there an existing issue for this?

• I have searched the existing issues

Description

Running Add-Migration from the Visual Studio Package Manager Console fails even though the project build succeeds.

The failure occurs because AWSSDK.Core version 4.0.0.28 produces a NU1901 vulnerability warning, which is treated as a terminating error by the command execution environment.

This appears after upgrading the project to ABP 10.6.0.

GHSA-9cvc-h2w8-phrp

Reproduction Steps

Reproduction Steps
Add latest Volo.Abp.BlobStoring.Aws "current version is 10.6.0"
Open Visual Studio's Package Manager Console.
Run:
Add-Migration WhateverMigrationName
The project builds successfully, but the migration command then fails.

Expected behavior

Add-Migration should complete successfully after the project builds successfully.

A low-severity NuGet vulnerability warning (NU1901) should not cause the EF migration command to terminate, or ABP should depend on a patched version of AWSSDK.Core.

Actual behavior

the migration command stops with the given error

Regression?

The issue is not abp itself, it's AWSSDK.Core version thats inside AWSSDK.S3

Known Workarounds

• Adding latest AWSSDK.S3
  to the project that depends on Volo.Abp.BlobStoring.Aws, which commonly would be the domain.shared

OR

• Suppressing NU1901 or explicitly overriding AWSSDK.Core with a non-vulnerable version can work around the issue.
  However, suppressing the warning is not ideal because it hides a real dependency vulnerability.

Version

10.6.0

User Interface

Common (Default)

Database Provider

EF Core (Default)

Tiered or separate authentication server

None (Default)

Operation System

Windows (Default)

Other information

No response