Update NU1901-1904 #3446
Update NU1901-1904 #3446
Conversation
There was a problem hiding this comment.
Pull Request Overview
This PR updates the NuGet documentation for NU1901 error to reflect changes in default audit mode behavior for .NET 10. The update clarifies that the default NuGetAuditMode setting changes to all when targeting .NET 10 framework, replacing the previous .NET 9 default behavior.
- Updates the default
NuGetAuditModebehavior documentation for .NET 10 targeting - Revises the reversion instructions to reference .NET 9's default instead of .NET 8
- Updates the
SdkAnalysisLevelversion reference from8.0.400to9.0.300
|
Learn Build status updates of commit f059159: ✅ Validation status: passed
For more details, please refer to the build report. |
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
|
Learn Build status updates of commit bf7ee86: ✅ Validation status: passed
For more details, please refer to the build report. |
…docs.microsoft.com-nuget into dev-nkolev92-updatenu1901
|
Learn Build status updates of commit 01844ad: ✅ Validation status: passed
For more details, please refer to the build report. |
| The value can be explicitly set to `direct` to revert back to .NET 8's default. Alternatively, [the property `SdkAnalysisLevel`](/dotnet/core/project-sdk/msbuild-props#sdkanalysislevel) can be set to `8.0.400` to temporarily disable all new warnings and errors introduced in newer versions of the SDK. Specifically in this case, the default value of `NuGetAuditMode` is changed back to `direct`. | ||
| For projects targeting the .NET 10 framework, the default setting for `NuGetAuditMode` is `all`. | ||
| This means that NuGet will report on transitive packages with known vulnerabilities for all frameworks in the project. | ||
| The value can be explicitly set to `direct` to revert back to .NET 9's default. |
There was a problem hiding this comment.
The default for .NET 9 isn't mentioned anywhere any longer which makes this statement a bit less clear than it could be.
Fixes: NuGet/Home#14422
The new default is tied to .NET 10 tfm being one of the targeted frameworks.