- Notifications
You must be signed in to change notification settings - Fork311
Add package vulnerability information#3024
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
Uh oh!
There was an error while loading.Please reload this page.
Conversation
codecovbot commentedNov 20, 2024 • edited
Loading Uh oh!
There was an error while loading.Please reload this page.
edited
Uh oh!
There was an error while loading.Please reload this page.
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@## main #3024 +/- ##==========================================+ Coverage 72.64% 72.73% +0.08%========================================== Files 285 285 Lines 59160 59160 ==========================================+ Hits 42979 43028 +49+ Misses 16181 16132 -49
Flags with carried forward coverage won't be shown.Click here to find out more. ☔ View full report in Codecov by Sentry. |
Also related to#2568 |
88c5ada
intodotnet:mainUh oh!
There was an error while loading.Please reload this page.
AI Blurp
This pull request includes changes to the NuGet configuration and build properties to improve package source auditing and manage warnings more effectively. The most important changes are as follows:
NuGet Configuration Updates:
NuGet.config
: Added anauditSources
section to specify sources for auditing, includingnuget.org
as an audit source.Build Properties Enhancements:
src/Directory.Build.props
: Introduced aWarningsNotAsErrors
property to exclude specific warnings from being treated as errors.src/Directory.Build.props
: Added aNuGetAuditMode
property to enable auditing for all package sources.Description
Adding new functionality for .NET 9 / VS 17.12 / NuGet 6.12 with Audit Sources.
Also adding that the vulnerabilities (currently) are not treated as errors, but this can of course be enabled in the future
The idea is that package vulnerabilities get visibility at least on a warning level everywhere.
I'm sure I don't have to remind anyone of this, but I still do 😁 :
https://blogs.microsoft.com/blog/2024/05/03/prioritizing-security-above-all-else/