Security vulnerabilities in your dependencies are one of those things where I know that I should address them promptly, but the process of hunting down the right package version, understanding the scope of the issue, and making the change without breaking anything can turn a five-minute fix into a frustrating rabbit hole. With the Visual Studio March 2026 update, that workflow just got a whole lot smoother.
GitHub Copilot can now help you fix NuGet package vulnerabilities directly from Solution Explorer, turning what used to be a manual research task into a guided, in-editor experience.
What's new?
When Visual Studio detects a vulnerability in one of your NuGet packages, you'll now see a Fix with GitHub Copilot link alongside the vulnerability notification in Solution Explorer. One click is all it takes to kick off the process: Copilot analyzes the vulnerability, identifies the appropriate dependency updates, and implements them for you — without disrupting the rest of your project.
No more context-switching to security advisories, no more manually cross-referencing package versions, and no more second-guessing whether your fix might break something else. You stay in the editor, and the issue gets resolved right when it's discovered.
The path of least resistance
The biggest barrier to fixing vulnerabilities quickly isn't usually knowledge — it's friction. Developers know a flagged NuGet package needs attention, but when addressing it requires leaving the IDE, researching advisories, figuring out which version resolves the issue, and validating that the update is compatible with the rest of the dependency tree, it's easy for "I'll fix that later" to become the path of least resistance.
Copilot eliminates most of that friction. By surfacing the fix at the exact moment, the vulnerability is detected in the same tool you're already working in. It makes the secure choice the easy choice.
How to use it
- Open your project in Visual Studio 2026 Insiders (the feature is available in the latest Insiders build).
- In Solution Explorer, look for any NuGet package flagged with a vulnerability notification.
- Click the Fix with GitHub Copilot link in the notification.
- Copilot will analyze the vulnerability and recommend targeted dependency updates.
- Review the suggested changes and apply them. Copilot handles the implementation while keeping your other packages stable.
That's it.
Security issues addressed, workflow intact.
Happy (secure) coding!
More information
Visual Studio March Update - Build Your Own Custom Agents - Visual Studio Blog