timothy
46e2fbf0f7
.NET 10's NuGet audit promotes vulnerable transitive packages to NU1901-1904 warnings during restore; the app projects set TreatWarningsAsErrors=true, so restore failed on NCalcSync 5.11.0 (moderate) and SQLitePCLRaw 2.1.10 (high). Demote NU1901/NU1902/NU1903 to warnings in Directory.Build.props (NU1904 critical still errors). Also COPY Directory.Build.props/.targets in the Dockerfile before restore so the image build honors the same props as local/CI builds (it previously copied only the .sln). Underlying deps tracked in #8. Refs #4, #8.
15 lines
883 B
XML
15 lines
883 B
XML
<Project>
|
|
<PropertyGroup>
|
|
<InformationalVersion>develop</InformationalVersion>
|
|
<IncludeSourceRevisionInInformationalVersion>false</IncludeSourceRevisionInInformationalVersion>
|
|
<AllowMissingPrunePackageData>true</AllowMissingPrunePackageData>
|
|
<!-- NuGet audit (on by default in .NET 10) reports vulnerable transitive
|
|
packages as NU1901-1904 warnings. Several projects set
|
|
TreatWarningsAsErrors=true, which would otherwise fail `dotnet restore`
|
|
on advisories we can't immediately fix. Demote low/moderate/high audit
|
|
advisories to warnings (still printed in build logs); NU1904 (critical)
|
|
stays an error so criticals still block. Track fixes separately. -->
|
|
<WarningsNotAsErrors>$(WarningsNotAsErrors);NU1901;NU1902;NU1903</WarningsNotAsErrors>
|
|
</PropertyGroup>
|
|
</Project>
|