NuGet Audit docs: https://devblogs.microsoft.com/nuget/nugetaudit-2-0-elevating-security-and-trust-in-package-management/ & https://learn.microsoft.com/en-us/nuget/concepts/auditing-packages

NuGet Audit flags vulnerable dependencies at restore and build time so that we don’t have to exclusively rely on post-build scanners like Component Governance. NuGet Audit is part of the .NET 8 and .NET 9 SDKs and now enabled by default.

NuGetAuditMode defaulted to direct when it was introduced in the .NET 8.0.100 SDK and VS 17.8. In .NET 9.0.100 SDK and VS 17.12 the default changed to all.

Our .NET repositories need to opt into that security feature as we don’t use nuget.org as our package repository. Aside from resolving potential vulnerable packages in the build, all that's needed to turn it on is: #15018

Requirement

This depends on a NuGet feature that got added with the .NET 9 Preview 7 SDK. If your repository doesn't yet use that, that's fine and enabling NuGetAudit can be revisited at a later point.

Status

List below are repositories that are part of the VMR. The list can be extended.

• arcade: Enable NuGet Audit #15018
• aspire: Enable NuGet Audit aspire#6303
• aspnetcore
• cecil
• command-line-api
• deployment-tools: Enable Central Package Management and NuGetAudit deployment-tools#390
• diagnostics: Enable TSA, nuget auditing, and necessary cleanup diagnostics#4958
• efcore Enable NuGetAudit efcore#34650
• emsdk
• fsharp
• msbuild: Enable NuGetAudit msbuild#10734
• nuget-client: Update packages used by repo NuGet/NuGet.Client#5939
• razor
• roslyn-analyzers
• roslyn Enable NuGet audit roslyn#75049
• runtime Enable NuGet Audit and fix issues runtime#107639
• scenario-tests
• sdk
• source-build-externals
• source-build-reference-packages: Enable NuGetAudit in SBRP source-build-reference-packages#1016
• sourcelink
• symreader: Enable Central Package Management and NuGetAudit symreader#325
• templating: Enable NuGetAudit templating#8318
• test-templates
• vstest
• windowsdesktop: Enable NuGetAudit in NuGet.config windowsdesktop#4605
• winforms Enable NuGet Audit and Fix Errors winforms#12120
• wpf Enable NuGet Audit wpf#9854
• xdt: Enable NuGetAudit and perform clean-up xdt#604

cc @zivkan @ericstj @JonDouglas