Direct-only NuGet audit vs scheduled vulnerability listing for CI noise control
A design goal is to keep vulnerability alerts actionable in .NET SDK projects without flooding CI with transitive advisory noise. Two documented approaches are available. Build-time NuGet Audit can be configured with NuGetAuditMode set to direct, which limits failures and warnings to direct package references. An alternative is on-demand vulnerability listin
nuget