Skip to content

Added a troubleshooting page for nuget vulnerability warnings#515

Open
ferafiks wants to merge 1 commit into
stride3d:masterfrom
ferafiks:nuget-warnings
Open

Added a troubleshooting page for nuget vulnerability warnings#515
ferafiks wants to merge 1 commit into
stride3d:masterfrom
ferafiks:nuget-warnings

Conversation

@ferafiks
Copy link
Copy Markdown
Contributor

Description

A lot of users have been asking for help relating to package vulnerability warnings in the latest release. This is a part of nuget which we don't have control over and that will continue creating confusion between releases in the future. This PR adds a page about it that we can link users to.

@VaclavElias
Copy link
Copy Markdown
Contributor

VaclavElias commented May 29, 2026

We partially have control over it but don't act fast enough. Many NuGet packages can be updated as soon as there is a new version and with the extensive tests we have now, we might be able to test packages updates. The major packages are resolving their vulnerabilities in a few days or weeks.

Yes, there are also some packages which don't get updated anymore e.g. SharpDX.* and so the transitive warnigns will appear. In SharpDX.* case, I believe this dependency will be removed soon.

Also, there were 3 cases where we nicely nudge a maintainer and the update was released on the packages we depend on.

At this time, I believe if the Avalonia packages are updated to 12.0.4 we will get rid of Tmds.DBus.Protocol warning and in a few weeks we can update Microsoft.Build.* to get rid of System.Security.Cryptography.Xml warning. Although Microsoft.Build.* updatese might break something on our side 🙈🙂.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants