Yes! .NET 10 is out and not only does it come with a new SDK and runtime version, but it is accompanied by a new NuGet version. With this version, Microsoft has significantly strengthened NuGet's security capabilities to help build more secure applications. These enhancements focus on improved vulnerability detection, automated package management, and better tooling for managing your dependency tree.
Let's explore what's new and how these features can help protect your projects.
Transitive dependency auditing
The change with probably the biggest impact is the NuGet Audit's default behavior. For projects targeting .NET 10 or higher, the NuGetAuditMode property now defaults to all instead of direct. This means that NuGet will automatically scan not just your direct package references, but also all transitive dependencies for known security vulnerabilities.
That’s good news as a a majority of vulnerabilities are often found in indirect dependencies. In a typical .NET project with around 50 total dependencies, you might have only 6-10 direct dependencies but 20-70 transitive dependencies. Previously, these transitive vulnerabilities could go unnoticed unless you explicitly opted in to scan them.
During dotnet restore, NuGet checks all packages against the GitHub Advisory Database for known CVEs (Common Vulnerabilities and Exposures) and GHSAs (GitHub Security Advisories). When a vulnerability is detected, you'll see warnings like:
warning NU1902: Package 'Example.Package' 5.0.0 has a known moderate severity vulnerability, https://github.com/advisories/GHSA-xxxx-xxxx-xxxxConfiguring Audit Behavior
If you need to adjust this behavior, you can configure it in your project file or in a separate Directory.Build.props file:
Vulnerability remediation
When you discover a vulnerability, follow these recommended steps:
- Try upgrading the top-level package first: Often, updating the direct dependency will pull in a fixed version of the transitive package.
- Upgrade intermediate packages: If updating the top-level package doesn't help, try upgrading packages in the middle of the dependency chain.
- Promote the transitive package: As a last resort, add an explicit
PackageReferencefor the vulnerable transitive package at a fixed version.
The good news is that with .NET 10, you can simplify this process by executing the dotnet package update --vulnerable command. This will update all vulnerable packages in a project to the first version without known vulnerabilities:
More information
Auditing package dependencies for security vulnerabilities
What's new in the SDK and tooling for .NET 10
Breaking change: 'dotnet restore' audits transitive packages - .NET | Microsoft Learn