Recent searches
Search options
This is getting in the way. So much noise now with transitive package dependencies that could be vulnerable. NuGet package manager in Visual Studio is trying to implement features from 3rd parties like Snyk. Good goal, poorly implemented.
https://devblogs.microsoft.com/nuget/introducing-transitive-dependencies-in-visual-studio/
@allennewton I agree it's difficult to manage, but I note that the transitive packages were always there and weren't shown in UI.
To help manage this, I plan to try using Central Package Management with Transitive Pinning enabled. This way, I only need to declare a package upgrade once for all package references and transitive references in the repo.
See https://learn.microsoft.com/en-us/nuget/consume-packages/Central-Package-Management
@Arlodottxt Will investigate that idea. Sounds good. System.Private.Uri (in my specific case) is one that is going to need fixing. No help on how to mitigate that one from the NuGet package manager. Will have to work through each reported vulnerability to see if they can be fixed/patched, or not.
@allennewton .Net 9 could have been a simple upgrade but turns out to be a hell ... #dotnet
@tomap Upgraded my solution, as an experiment, to .net9 from .net8 LTS. Most of the transitive vulnerabilities went away. Except one. This hints to me, being on LTS is less stable than being on latest version for dotnet.