From d9adcadcf092fb08d33502e6d9fcfd0fa4020872 Mon Sep 17 00:00:00 2001 From: Rainer Sigwald Date: Wed, 9 Oct 2024 17:45:39 -0500 Subject: [PATCH] Append warning-behavior properties (#3346) Specifying the current value for the property is a best practice to avoid accidentally overwriting an existing value. --- docs/concepts/Auditing-Packages.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/concepts/Auditing-Packages.md b/docs/concepts/Auditing-Packages.md index d05323ad8..ce53cda68 100644 --- a/docs/concepts/Auditing-Packages.md +++ b/docs/concepts/Auditing-Packages.md @@ -102,8 +102,8 @@ It is available for packages.config from [Visual Studio 17.12 and NuGet 6.12](.. | [NU1905](../reference/errors-and-warnings/NU1905.md) | An audit source does not provide a vulnerability database | You can customize your build to treat these warnings as errors to [treat warnings as errors, or treat warnings not as errors](/dotnet/csharp/language-reference/compiler-options/errors-warnings#warningsaserrors-and-warningsnotaserrors). -For example, if you're already using `` to treat all (C#, NuGet, MSBuild, etc) warnings as errors, you can use `NU1901;NU1902;NU1903;NU1904` to prevent vulnerabilities discovered in the future from breaking your build. -Alternatively, if you want to keep low and moderate vulnerabilities as warnings, but treat high and critical vulnerabilities as errors, and you're not using `TreatWarningsAsErrors`, you can use `NU1903;NU1904`. +For example, if you're already using `` to treat all (C#, NuGet, MSBuild, etc) warnings as errors, you can use `$(WarningsNotAsErrors);NU1901;NU1902;NU1903;NU1904` to prevent vulnerabilities discovered in the future from breaking your build. +Alternatively, if you want to keep low and moderate vulnerabilities as warnings, but treat high and critical vulnerabilities as errors, and you're not using `TreatWarningsAsErrors`, you can use `$(WarningsAsErrors);NU1903;NU1904`. > [!NOTE] > MSBuild properties for message severity such as `NoWarn` and `TreatWarningsAsErrors` are not supported for packages.config projects.