Bug

Fixes: NuGet/Home#13372

Description

Adds --vulnerable to dotnet package update.

This PR deviates from the feature spec because during implementation it was a bit easier (and therefore quicker). But I was also thinking one of the primary use cases for this command will be to fix warnings reported during restore. So, instead of having a --mode or similar, it looks at the restore results, and fixes the packages reported by restore. This has the benefit of respecting the project's direct only or direct + transitive NuGetAuditMode setting.

I created this issue to track supporting updating vulnerable packages when audit is disabled: NuGet/Home#14526

Here's sample output when the command works successfully:

Here's an example where attempting to upgrade introduces a restore error:

We can see it output all the packages, and versions, that it attempted to upgrade, as well as the restore error message. This gives the customer enough information to upgrade packages one by one, and know which versions no longer have any security advisories.

Additionally, some changes to the code shared with dotnet package add was modified so that when a transitive package specific to a subset of project TFMs needs to be added, it puts the correct condition on the package reference.

PR Checklist

• Meaningful title, helpful description and a linked NuGet/Home issue
• Added tests not enough time at the moment, but a tracking issue is created: Improve tests for dotnet package update --vulnerable Home#14525
• Link to an issue or pull request to update docs if this PR changes settings, environment variables, new feature, etc. Document dotnet package update command Home#14354