Configure NuGet audit sources and non-fatal vulnerability warnings

[Jose Perez Rodriguez (joperezr)]

Description

Use public NuGet vulnerability metadata during developer and CI restores without adding nuget.org as a package download source or changing the existing package-source mappings.

• Add an auditSources section to NuGet.config, clearing inherited audit sources and selecting https://data.nuget.org/v3/index.json.
• Add NU1901–NU1904 to WarningsNotAsErrors while retaining TreatWarningsAsErrors=true, preserving existing exemptions, and respecting the TreatNuGetAuditWarningsAsErrors=true opt-in.
• Include a comment to remove the temporary exemption after upgrading to Arcade 11, which supplies it.

The pinned Microsoft.DotNet.Arcade.Sdk version, 10.0.0-beta.26423.1, already sets NuGetAuditMode=all and disables auditing when OfficialBuild=true, but does not include the vulnerability-warning exemption. No SDK update or duplicated audit-mode/official-build settings are needed. The exemption follows the newer Arcade policy. The existing official-build safeguard remains in place for dotnet/msbuild#10801.

Validation

• Existing Infrastructure.Tests.NuGetConfigTests passed (1 test).
• Evaluated effective MSBuild properties for normal and official builds: normal builds retain auditing, transitive coverage, and warnings-as-errors with the four audit exemptions; official builds retain NuGetAudit=false.
• Confirmed the audit-error opt-in omits the temporary exemptions and that an existing CS1591 exemption is preserved.
• Inspected restored NuGet warning properties: all warnings remain errors except NU1901–NU1904.
• Confirmed package sources and mappings are unchanged and the configured public endpoint advertises vulnerability data.
• The existing test-trigger map already routes both changed files to ALL.

Security considerations

NuGet will retrieve public vulnerability metadata from data.nuget.org for developer/CI restores. This is an audit-only source, not a package source; package downloads continue using the existing approved feeds. Vulnerability findings remain visible as warnings rather than being suppressed. Official-build auditing behavior is unchanged.

Fixes # (issue)

Checklist

• Is this feature complete?
  • Yes. Ready to ship.
  • No. Follow-up changes expected.
• Are you including unit tests for the changes and scenario tests if relevant?
  • Yes
  • No
• Did you add public API?
  • Yes
    • If yes, did you have an API Review for it?
      • Yes
      • No
    • Did you add <remarks /> and <code /> elements on your triple slash comments?
      • Yes
      • No
  • No
• Does the change make any security assumptions or guarantees?
  • Yes
    • If yes, have you done a threat model and had a security review?
      • Yes
      • No
  • No

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 20052

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 20052"

[github-actions]

Tests selector

Selects the full PR test matrix + all PR-gated jobs (ALL) — a rule matching 'Directory.Build.props' selects ALL

Advisory workflow impact (4)

• Aspire.Deployment.EndToEnd.Tests (deployment workflow-only)
• Aspire.EndToEnd.Tests (outerloop-only)
• Aspire.Oracle.EntityFrameworkCore.Tests (outerloop-only)
• deployment-e2e (schedule/dispatch-only)

---

Selection computed for commit e107fb5.

[Copilot]

Copilot review overview

🟡 Changes recommended

The new audit source and conditional warning policy need automated regression coverage.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Balanced
Findings: 2

New issues introduced by this change (2)

Severity	Finding
	Directory.Build.props — Automate the warning-policy validation
	NuGet.config — Add regression coverage for the audit source

What changed in this PR

Configures NuGet vulnerability auditing without enabling public package downloads.

Changes:

• Adds the vulnerability-only NuGet audit source.
• Keeps NU1901–NU1904 visible but non-fatal unless explicitly opted in.

File	Description
NuGet.config	Configures the audit-only NuGet endpoint.
Directory.Build.props	Exempts audit findings from warnings-as-errors.

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

[Jose Perez Rodriguez (joperezr)]

Damian Edwards (@DamianEdwards) tagging you on this change: it adds data.nuget.org as an audit source and the NU1901–NU1904 warning exemption missing from our current Arcade version, with a comment to remove the exemption after upgrading to Arcade 11.