Nugetauditsuppress -
| Behavior | NuGetAudit=false | NuGetAuditSuppress=true | |----------|--------------------|----------------------------| | Audit data fetched from API | No | Yes (but hidden) | | Warnings shown | No | No | | Performance overhead | None | Slight (network + analysis) | | MSBuild logs contain warnings? | No | No | | Recommended for security audits | No | No (use NuGetAuditLevel=critical instead) |
Let's say you are using System.Text.Json version 7.0.0, and a vulnerability is flagged (hypothetically) as CVE-2023-12345 . You cannot upgrade immediately because a third-party library depends on that specific version. You decide to accept the risk for the current sprint. nugetauditsuppress
dotnet list package --vulnerable
Implementing suppression is straightforward. You add a item to your project file ( .csproj ) or a shared properties file like Directory.Build.props . Example Syntax You decide to accept the risk for the current sprint