Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Be explicit about recommended actions #44411

Merged
merged 2 commits into from
Jan 30, 2025
Merged

Be explicit about recommended actions #44411

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c010288
Update dotnet-restore-audit.md
gewarren Jan 16, 2025
2c2ac2c
Add TreatWarningsAsErrors property in documentation
gewarren Jan 16, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 32 additions & 1 deletion docs/core/compatibility/sdk/8.0/dotnet-restore-audit.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,14 +29,45 @@ Many users want to know whether the packages they restore contain any known secu

## Recommended action

- To explicitly reduce the probability of this breaking your build due to warnings, you can consider your usage of `<TreatWarningsAsErrors>` and use `<WarningsNotAsErrors>NU1901;NU1902;NU1903;NU1904</WarningsNotAsErrors>` to ensure known security vulnerabilities are still allowed in your environment.
The properties mentioned in the recommended actions can be set either in your project file (for example, \*.csproj or \*.fsproj file) or *Directory.Build.props* file.

- To explicitly reduce the probability of this breaking your build due to warnings, you can consider your usage of `<TreatWarningsAsErrors>` and set `<WarningsNotAsErrors>NU1901;NU1902;NU1903;NU1904</WarningsNotAsErrors>` to ensure known security vulnerabilities are still allowed in your environment.

```xml
<PropertyGroup>
...
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
<WarningsNotAsErrors>NU1901;NU1902;NU1903;NU1904</WarningsNotAsErrors>
</PropertyGroup>
```

- If you want to set a different security audit level, add the `<NuGetAuditLevel>` property to your project file with possible values of `low`, `moderate`, `high`, and `critical`.

```xml
<PropertyGroup>
...
<NuGetAuditLevel>low</NuGetAuditLevel>
</PropertyGroup>
```

- If you want to ignore these warnings, you can use `<NoWarn>` to suppress `NU1901-NU1904` warnings.

```xml
<PropertyGroup>
...
<NoWarn>$(NoWarn);NU1901-NU1904</NoWarn>
</PropertyGroup>
```

- To disable the new behavior entirely, you can set the `<NuGetAudit>` project property to `false`.

```xml
<PropertyGroup>
...
<NuGetAudit>false</NuGetAudit>
</PropertyGroup>
```

## See also

- [Audit for security vulnerabilities (`dotnet restore`)](../../../tools/dotnet-restore.md#audit-for-security-vulnerabilities)
Expand Down
Loading