dotnet / dotnet/docfx

Question: Can NuGet vulnerability warnings be turned off?

Open
#10,719 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
4.4k
Forks
890
Avg merge
2h 11m
Merged PRs (30d)
10

Description

I've tried to set the MSBuild property `NuGetAudit` (see below), but it doesn't suppress the warnings.

```json
{
"$schema": "https://raw.githubusercontent.com/dotnet/docfx/main/schemas/docfx.schema.json",
"metadata": [
{
"src": [
{
"files": [
"src/*/src/*/*.csproj"
],
"src": "sources/v4"
}
],
"output": "../docs/api/v4",
"filter": "api-filter-v4.yml",
"properties": {
"ProduceReferenceAssembly": "true",
"RunAnalyzers": "false",
"NuGetAudit": "false",
"TargetFramework": "net8.0"
}
}
]
}
```

Example output when building metadata:

> warning: [Failure] Msbuild failed when processing the file '/home/runner/work/Documentation/Documentation/build/sources/v2/src/Common/src/Common.Http/Steeltoe.Common.Http.csproj' with message: Package 'Newtonsoft.Json' 11.0.2 has a known high severity vulnerability, https://github.com/advisories/GHSA-5crp-9r3c-p9vr

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.