Skip to content

Conversation

@filzrev
Copy link
Contributor

@filzrev filzrev commented May 23, 2025

This PR intended to fix nightly build CI failure.

Background
Following warnings are raised, when running build with .NET 10 SDK preview.4 or later.

NU1903: Package 'Microsoft.Build.Tasks.Core' 17.7.2 has a known high severity vulnerability

It seems be caused by NuGetAuditMode default value is changed from direct to all on latest SDK.
And vulnerable package Microsoft.Build.Tasks.Core is transitively referenced by Microsoft.CodeAnalysis.Workspaces.MSBuild.

This PR add setting to overwrite NuGetAuditMode to direct for .NET 10 as a temporary workaround.
This settings will be removed when Microsoft.CodeAnalysis.Workspaces.MSBuild package is updated.

Additional changes
Update Microsoft.NET.Test.Sdk version to 17.14.0

@yufeih yufeih merged commit 163bc36 into dotnet:main May 27, 2025
9 checks passed
This was referenced Oct 24, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants