Summary
Sorry about the late notice. We've been so busy implementing, testing, and fixing bugs, this slipped my mind 😞. Anyway, in VS17.8, NuGet is shipping a feature called NuGetAudit: https://learn.microsoft.com/en-us/nuget/concepts/auditing-packages
If it's too late to get project properties added for this in 17.8, that's fine with me, though I didn't actually talk to any managers so I don't know if they share my feeling.
Also, while project properties already has a section for "Package", all the settings there are related to making a package out of the project. NuGetAudit is for referenced packages, and is therefore relevant for all projects, including ones that do not get packed into nupkgs.
Anyway, NuGetAudit has 3 properties that customers can set:
| Property name |
possible values |
description |
NuGetAudit |
true (default), false |
Enables or disables the feature |
NuGetAuditMode |
direct (default), all |
direct checks only directly referenced packages, whereas all will check transitive packages as well |
NuGetAuditLevel |
low (default), moderate, high, critical |
The minimum vulnerability severity level to report when a package has a known vulnerability. Known vulnerabilities with a lower severity level will not be reported. |
I haven't actually looked at project properties in a long time (too used to hand editing the csproj). If it's possible to have a group heading, with a "Learn more" link, I think a link to the docs would be great.
User Impact
Increases discoverability into NuGetAudit, for customers who are unaware. Makes it easier to set and change values avoiding typos.
Summary
Sorry about the late notice. We've been so busy implementing, testing, and fixing bugs, this slipped my mind 😞. Anyway, in VS17.8, NuGet is shipping a feature called NuGetAudit: https://learn.microsoft.com/en-us/nuget/concepts/auditing-packages
If it's too late to get project properties added for this in 17.8, that's fine with me, though I didn't actually talk to any managers so I don't know if they share my feeling.
Also, while project properties already has a section for "Package", all the settings there are related to making a package out of the project. NuGetAudit is for referenced packages, and is therefore relevant for all projects, including ones that do not get packed into nupkgs.
Anyway, NuGetAudit has 3 properties that customers can set:
NuGetAudittrue(default),falseNuGetAuditModedirect(default),allNuGetAuditLevellow(default),moderate,high,criticalI haven't actually looked at project properties in a long time (too used to hand editing the csproj). If it's possible to have a group heading, with a "Learn more" link, I think a link to the docs would be great.
User Impact
Increases discoverability into NuGetAudit, for customers who are unaware. Makes it easier to set and change values avoiding typos.