The VMR doesn't swallow warnings anymore and they get promoted from each inner build to AzDO. That is great! NuGet Audit is now also correctly configured in .NET repos to not promote NU1901-1904 warnings to errors. All other warnings keep getting promoted to errors due to warnAsError:true (intentional). All repos except two are are warning clean.
Example VMR PR build: https://dev.azure.com/dnceng-public/public/_build/results?buildId=1553090&view=logs&j=879e79ff-d5e4-564a-9322-bee9d0a651ca&t=512fd98d-6a8d-5205-38b5-10d6853cd045&l=871
- aspnetcore
__w/1/s/src/aspnetcore/eng/tools/RepoTasks/RepoTasks.csproj : warning NU1903: Package 'System.Security.Cryptography.Xml' 8.0.0 has a known high severity vulnerability, https://github.com/advisories/GHSA-23rf-6693-g89p [/__w/1/s/repo-projects/aspnetcore.proj]
/__w/1/s/src/aspnetcore/eng/tools/RepoTasks/RepoTasks.csproj : warning NU1903: Package 'System.Security.Cryptography.Xml' 8.0.0 has a known high severity vulnerability, https://github.com/advisories/GHSA-37gx-xxp4-5rgx [/__w/1/s/repo-projects/aspnetcore.proj]
/__w/1/s/src/aspnetcore/eng/tools/RepoTasks/RepoTasks.csproj : warning NU1903: Package 'System.Security.Cryptography.Xml' 8.0.0 has a known high severity vulnerability, https://github.com/advisories/GHSA-6588-8gv4-xfgh [/__w/1/s/repo-projects/aspnetcore.proj]
/__w/1/s/src/aspnetcore/eng/tools/RepoTasks/RepoTasks.csproj : warning NU1903: Package 'System.Security.Cryptography.Xml' 8.0.0 has a known high severity vulnerability, https://github.com/advisories/GHSA-8q5v-6pqq-x66h [/__w/1/s/repo-projects/aspnetcore.proj]
/__w/1/s/src/aspnetcore/eng/tools/RepoTasks/RepoTasks.csproj : warning NU1903: Package 'System.Security.Cryptography.Xml' 8.0.0 has a known high severity vulnerability, https://github.com/advisories/GHSA-cvvh-rhrc-wg4q [/__w/1/s/repo-projects/aspnetcore.proj]
/__w/1/s/src/aspnetcore/eng/tools/RepoTasks/RepoTasks.csproj : warning NU1903: Package 'System.Security.Cryptography.Xml' 8.0.0 has a known high severity vulnerability, https://github.com/advisories/GHSA-g8r8-53c2-pm3f [/__w/1/s/repo-projects/aspnetcore.proj]
/__w/1/s/src/aspnetcore/eng/tools/RepoTasks/RepoTasks.csproj : warning NU1903: Package 'System.Security.Cryptography.Xml' 8.0.0 has a known high severity vulnerability, https://github.com/advisories/GHSA-mmjf-rqrv-855v [/__w/1/s/repo-projects/aspnetcore.proj]
/__w/1/s/src/aspnetcore/eng/tools/RepoTasks/RepoTasks.csproj : warning NU1903: Package 'System.Security.Cryptography.Xml' 8.0.0 has a known high severity vulnerability, https://github.com/advisories/GHSA-w3x6-4m5h-cxqf [/__w/1/s/repo-projects/aspnetcore.proj]
These are getting resolved via dotnet/aspnetcore#68514 - unnecessary dependency, cc @wtgodbe
- roslyn
dotnet/roslyn#84885
The VMR doesn't swallow warnings anymore and they get promoted from each inner build to AzDO. That is great! NuGet Audit is now also correctly configured in .NET repos to not promote NU1901-1904 warnings to errors. All other warnings keep getting promoted to errors due to warnAsError:true (intentional). All repos except two are are warning clean.
Example VMR PR build: https://dev.azure.com/dnceng-public/public/_build/results?buildId=1553090&view=logs&j=879e79ff-d5e4-564a-9322-bee9d0a651ca&t=512fd98d-6a8d-5205-38b5-10d6853cd045&l=871
These are getting resolved via dotnet/aspnetcore#68514 - unnecessary dependency, cc @wtgodbe
dotnet/roslyn#84885