You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
With PackageReference, some packages can bring in different dependencies per Runtime Identifier (RID). Now that NuGetAudit is available, it's more useful than ever to be able to see the packages that are used by the project, so that I can make it a direct dependency and increase the version to avoid known vulnerabilities.
Consider the scenario where NuGetAudit reports a package with a known vulnerability, so the customer opens PM UI in order to update it to a newer version, but the package ID isn't displayed, even in the transitive packages list.
That other issue about multi-targeting projects, whereas it's possible to have a single targeting project with RID specific packages, which this issue is about. However, the multi-targeting issue will be a prerequisite for being able to install packages with rid-specific conditions. This issue should be scoped to displaying the packages, even if the install scenario requires manual editing of the project file.
The text was updated successfully, but these errors were encountered:
NuGet Product(s) Involved
Visual Studio Package Management UI
The Elevator Pitch
With PackageReference, some packages can bring in different dependencies per Runtime Identifier (RID). Now that NuGetAudit is available, it's more useful than ever to be able to see the packages that are used by the project, so that I can make it a direct dependency and increase the version to avoid known vulnerabilities.
Consider the scenario where NuGetAudit reports a package with a known vulnerability, so the customer opens PM UI in order to update it to a newer version, but the package ID isn't displayed, even in the transitive packages list.
Additional Context and Details
This issue was created while investigating a VS feedback ticket
This issue is not quite the same thing as:
That other issue about multi-targeting projects, whereas it's possible to have a single targeting project with RID specific packages, which this issue is about. However, the multi-targeting issue will be a prerequisite for being able to install packages with rid-specific conditions. This issue should be scoped to displaying the packages, even if the install scenario requires manual editing of the project file.
The text was updated successfully, but these errors were encountered: