diff --git a/docs/TOC.md b/docs/TOC.md index 0cf22d01f..a49bb6178 100644 --- a/docs/TOC.md +++ b/docs/TOC.md @@ -18,6 +18,7 @@ ### [Package Manager Console (PowerShell)](consume-packages/install-use-packages-powershell.md) ## Configure NuGet ### [Visual Studio options](consume-packages/nuget-visual-studio-options.md) +### [NuGet HTTPS Everywhere](consume-packages/nuget-https-everywhere.md) ### Package restore options #### [Restore packages](consume-packages/package-restore.md) #### [Troubleshooting](consume-packages/package-restore-troubleshooting.md) diff --git a/docs/concepts/Auditing-Packages.md b/docs/concepts/Auditing-Packages.md index 9ba52e166..72d185b5a 100644 --- a/docs/concepts/Auditing-Packages.md +++ b/docs/concepts/Auditing-Packages.md @@ -16,8 +16,6 @@ This involves identifying vulnerabilities, evaluating risks, and making recommen The audit can include a review of the packages themselves, as well as any dependencies and their associated risks. The goal of the audit is to identify and mitigate any security vulnerabilities that could be exploited by attackers, such as code injection or cross-site scripting attacks. -We also have a [blog post](https://devblogs.microsoft.com/nuget/nugetaudit-2-0-elevating-security-and-trust-in-package-management/) which discusses our recommended method for taking action when a package with a known vulnerability is found to be used by your project, and tools to help get more information. - ### Feature availability | NuGet | .NET SDK | Visual Studio | Feature | @@ -79,11 +77,29 @@ Note that the [V2 protocol is deprecated](../nuget-org/overview-nuget-org.md#api | -------------------------------------------------------------------------------------------- | ------------------------------------------------------------------ | | [NuGet 6.12, .NET 9.0.100 SDK, and Visual Studio 2022 17.12](../release-notes/NuGet-6.12.md) | Restore | | [NuGet 6.14, .NET 9.0.300 SDK](../release-notes/NuGet-6.14.md) | `dotnet package list --vulnerable` | -| Not yet supported | NuGet AuditSources support in the Visual Studio Package Manager UI | +| [NuGet 7.0 and Visual Studio 2026](../release-notes/NuGet-7.0.md) | NuGet AuditSources support in the Visual Studio Package Manager UI | + +### Warning codes + +| Warning Code | Reason | +|--------------|----------| +| [NU1900](../reference/errors-and-warnings/NU1900.md) | Error communicating with package source, while getting vulnerability information. | +| [NU1901](../reference/errors-and-warnings/NU1901-NU1904.md) | Package with low severity detected | +| [NU1902](../reference/errors-and-warnings/NU1901-NU1904.md) | Package with moderate severity detected | +| [NU1903](../reference/errors-and-warnings/NU1901-NU1904.md) | Package with high severity detected | +| [NU1904](../reference/errors-and-warnings/NU1901-NU1904.md) | Package with critical severity detected | +| [NU1905](../reference/errors-and-warnings/NU1905.md) | An audit source does not provide a vulnerability database | + +You can customize your build to treat these warnings as errors to [treat warnings as errors, or treat warnings not as errors](/dotnet/csharp/language-reference/compiler-options/errors-warnings#warningsaserrors-and-warningsnotaserrors). +For example, if you're already using `` to treat all (C#, NuGet, MSBuild, etc) warnings as errors, you can use `$(WarningsNotAsErrors);NU1901;NU1902;NU1903;NU1904` to prevent vulnerabilities discovered in the future from breaking your build. +Alternatively, if you want to keep low and moderate vulnerabilities as warnings, but treat high and critical vulnerabilities as errors, and you're not using `TreatWarningsAsErrors`, you can use `$(WarningsAsErrors);NU1903;NU1904`. + +> [!NOTE] +> MSBuild properties for message severity such as `NoWarn` and `TreatWarningsAsErrors` are not supported for packages.config projects. #### Excluding advisories -You can choose to exclude specific advisories from the audit report by adding a new `NuGetAuditSuppress` MSBuild item for each advisory. +You can exclude advisories by adding a new `NuGetAuditSuppress` MSBuild item for each advisory. Define a `NuGetAuditSuppress` item with the `Include=` metadata set to the advisory URL you wish to suppress. ```xml @@ -97,23 +113,121 @@ Similar to the other NuGet audit configuration properties, `NuGetAuditSuppress` `NuGetAuditSuppress` is available for PackageReference projects starting from [NuGet 6.11, Visual Studio 17.11, and the .NET 8.0.400 SDK](../release-notes/NuGet-6.11.md). It is available for packages.config from [Visual Studio 17.12 and NuGet 6.12](../release-notes/NuGet-6.12.md). -### Warning codes +##### When to exclude advisories -| Warning Code | Reason | -|--------------|----------| -| [NU1900](../reference/errors-and-warnings/NU1900.md) | Error communicating with package source, while getting vulnerability information. | -| [NU1901](../reference/errors-and-warnings/NU1901-NU1904.md) | Package with low severity detected | -| [NU1902](../reference/errors-and-warnings/NU1901-NU1904.md) | Package with moderate severity detected | -| [NU1903](../reference/errors-and-warnings/NU1901-NU1904.md) | Package with high severity detected | -| [NU1904](../reference/errors-and-warnings/NU1901-NU1904.md) | Package with critical severity detected | -| [NU1905](../reference/errors-and-warnings/NU1905.md) | An audit source does not provide a vulnerability database | +In scenarios where you have analyzed a specific advisory and have determined that it either does not apply to your scenario, or you are comfortable with the risks it imposes, you can choose to exclude specific advisories from the audit report. +Note that this would completely suppress the advisories, even for packages that share the advisory that may not be part of your project. +`NuGetAuditSuppress` should be considered a last resort for managing advisories. -You can customize your build to treat these warnings as errors to [treat warnings as errors, or treat warnings not as errors](/dotnet/csharp/language-reference/compiler-options/errors-warnings#warningsaserrors-and-warningsnotaserrors). -For example, if you're already using `` to treat all (C#, NuGet, MSBuild, etc) warnings as errors, you can use `$(WarningsNotAsErrors);NU1901;NU1902;NU1903;NU1904` to prevent vulnerabilities discovered in the future from breaking your build. -Alternatively, if you want to keep low and moderate vulnerabilities as warnings, but treat high and critical vulnerabilities as errors, and you're not using `TreatWarningsAsErrors`, you can use `$(WarningsAsErrors);NU1903;NU1904`. +## Actions when packages with known vulnerabilities are reported -> [!NOTE] -> MSBuild properties for message severity such as `NoWarn` and `TreatWarningsAsErrors` are not supported for packages.config projects. +Getting a warning about packages with known vulnerabilities is only part of the process. +Once discovered, action needs to be taken to remove the potential vulnerability from your solution. + +The easiest case is when a package you reference directly has the known vulnerability. +In this situation, update the package version to one that fixes the vulnerability. + +Package vulnerabilities may be reported in both direct and transitive package references. +The action you take to resolve may be different because of that. + +### Security vulnerabilities found with updates + +If security vulnerabilities are found and updates are available for the package, you can do one of the following: + +- Edit the `.csproj` or other package version location (`Directory.Packages.props`) with a newer version containing a security fix. +- Use the NuGet package manager user interface in Visual Studio to update the individual package. +- Run the `dotnet package update --vulnerable` command to update all vulnerable packages in a project to the first version without known vulnerabilities. +- Run the `dotnet package update` or `dotnet package add` commands with the respective package ID to update to the latest version. Use [`dotnet add package` when using .NET 9 or earlier](/dotnet/core/whats-new/dotnet-10/sdk#more-consistent-command-order). +- Use the NuGet Model Context Protocol (MCP) server that has the ability to update packages in your project to versions that resolve known vulnerabilities. +See [Fixing package vulnerabilities](NuGet-MCP-Server.md#fixing-package-vulnerabilities) for more information. + +#### Transitive Packages + +Often a vulnerability will be in a transitive dependency. +Our recommendation is to prefer updates to packages "closest" to your direct references. +Though, there's nothing wrong with just upgrading the package with known vulnerability either. + +For example, say your project references package A. +Package A has a dependency on package B, which in turn has a dependency on package C. +In this example, we'll consider that package C version 1.0.0 has a known vulnerability, fixed in version 2.0.0. +Our recommendation is to first try upgrading package A. +If that doesn't resolve the audit warning, then try upgrading package B. +If that doesn't resolve the audit warning, then upgrade C directly. +To aid with this, you'll [need to find the transitive package path](#finding-the-transitive-package-path). + +In summary, if a known vulnerability exists in a top-level package's transitive dependencies, you have these options: + +- Check if the top-level package contains an update that does not have a transitive vulnerability and update that instead. +- Update the closest package to your direct references that does not reference a vulnerability. +- Add the fixed package version as a direct package reference. **Note:** Be sure to remove this reference when a new package version update becomes available and be sure to maintain the defined attributes for the expected behavior. +- Use [Central Package Management with the transitive pinning functionality](../consume-packages/Central-Package-Management.md#transitive-pinning). + Note that if you pack your project into your own package to share with others, [CPM with transitive pinning will cause packages to become dependencies](../consume-packages/Central-Package-Management.md#transitive-pinning-and-pack), even if your project doesn't directly call APIs on that package. +- [Suppress the advisory](#excluding-advisories) until it can be addressed. +- File an issue in the top-level package's tracker to request an update. + +##### Finding the transitive package path + +There are several ways to find the package path. +Which method you prefer depends on what tools you normally use during your development. + +###### dotnet nuget why + +On the command line, you can use the [`dotnet nuget why` command](/dotnet/core/tools/dotnet-nuget-why) to understand why transitive packages are being included in your project's package graph. + +![dotnet nuget why example](media/dotnet-nuget-why-1.png) + +###### Visual Studio Solution Explorer + +SDK style projects also provide the full package graph under the project's Dependency node. +It's also searchable! +Expand search options and enable “search external files”. + +![Visual Studio Solution Explorer Search Options](media/vs-solution-explorer-search-options-1.png) + +Search the package name, and it will show you all instances under each project's Dependencies node. + +![Visual Studio Solution Explorer Search Results](media/vs-solution-explorer-search-results-1.png) + +###### Visual Studio NuGet Package Manager UI + +When you look at the Installed tab in Visual Studio's package manager UI, when the project uses PackageReference for package management, it will show both direct and transitive packages. +Currently, this only happens when you manage packages for a project, not for the solution. + +If you mouse hover over a package in the package list, the tooltip will include the name of one direct package that has caused that transitive package to be included in the project. + +![Visual Studio Package Manager UI tooltip](media/pm-ui-transitive-tooltip-1.png) + +### Security vulnerabilities found with no updates + +In the case that a known vulnerability exists in a package without a security fix, you can do the following. + +- Check for any mitigating factors outlined in the advisory report. +- Use a suggested package if the package is marked deprecated or is abandoned. +- If the package is open source, consider contributing a fix. +- Open an issue in the package's issue tracker. + +#### Check for mitigating factors + +Review the security advisor for any mitigating factors that may allow you to continue using the package with the vulnerability. +The vulnerability may only exist when the code is used on a specific framework, operating system, or a special function is called. + +#### Use a suggested package + +In the case that a security advisory is reported for the package you're using and the package is marked deprecated or seems abandoned, consider using any suggested alternate package the package author has declared or a package comprising of similar functionality that is maintained. + +#### Contribute a fix + +If a fix does not exist for the security advisory, you may want to suggest changes that addresses the vulnerability in a pull request on package's open source repository or contact the author through the `Contact owners` section on the NuGet.org package detail page. + +#### Open an issue + +If you do not want to fix the vulnerability or are unable to update or replace the package, open an issue in the package's issue tracker or preferred contact method. +On NuGet.org, you can navigate to the package details page and click `Report package` which will guide you to get in contact with the author. + +### No security vulnerabilities found + +If no security vulnerabilities are found, this means that packages with known vulnerabilities were not found in your package graph at the present moment of time you checked. +Since the advisory database can be updated at any time, we recommend regularly checking your `dotnet restore` output and ensuring the same in your continuous integration process. ## Running NuGet Audit in CI @@ -177,68 +291,5 @@ Viewing [MSBuild's metaproj](/visualstudio/msbuild/how-to-build-specific-targets ## `dotnet list package --vulnerable` -Once a project is successfully restored, [`dotnet list package`](/dotnet/core/tools/dotnet-list-package) has a `--vulnerable` argument to filter the packages based on which packages have known vulnerabilities. +[`dotnet list package`](/dotnet/core/tools/dotnet-list-package) has a `--vulnerable` argument to filter the packages based on which packages have known vulnerabilities. Note that `--include-transitive` is not default, so should be included. - -## Actions when packages with known vulnerabilities are reported - -We also have a [blog post](https://devblogs.microsoft.com/nuget/nugetaudit-2-0-elevating-security-and-trust-in-package-management/) which discusses our recommended method for taking action when a package with a known vulnerability is found to be used by your project, and tools to help get more information. - -### Security vulnerabilities found with updates - -If security vulnerabilities are found and updates are available for the package, you can either: - -- Edit the `.csproj` or other package version location (`Directory.Packages.props`) with a newer version containing a security fix. -- Use the NuGet package manager user interface in Visual Studio to update the individual package. -- Run the `dotnet package update --vulnerable` command to update all vulnerable packages in a project to the first version without known vulnerabilities. -- Run the `dotnet package update` or `dotnet package add` commands with the respective package ID to update to the latest version. Use [`dotnet add package` when using .NET 9 or earlier](/dotnet/core/whats-new/dotnet-10/sdk#more-consistent-command-order). - -#### Transitive Packages - -If a known vulnerability exists in a top-level package's transitive dependencies, you have these options: - -- Add the fixed package version as a direct package reference. **Note:** Be sure to remove this reference when a new package version update becomes available and be sure to maintain the defined attributes for the expected behavior. -- Use [Central Package Management with the transitive pinning functionality](../consume-packages/Central-Package-Management.md#transitive-pinning). -- [Suppress the advisory](#excluding-advisories) until it can be addressed. -- File an issue in the top-level package's tracker to request an update. - -### Use Copilot to update packages -NuGet has released a Model Context Protocol (MCP) server that has the ability to update packages in your project to versions that resolve known vulnerabilities. -See [Fixing package vulnerabilities](NuGet-MCP-Server.md#fixing-package-vulnerabilities) for more information. - -### Security vulnerabilities found with no updates - -In the case that a known vulnerability exists in a package without a security fix, you can do the following. - -- Check for any mitigating factors outlined in the advisory report. -- Use a suggested package if the package is marked deprecated or is abandoned. -- If the package is open source, consider contributing a fix. -- Open an issue in the package's issue tracker. - -#### Check for mitigating factors - -Review the security advisor for any mitigating factors that may allow you to continue using the package with the vulnerability. -The vulnerability may only exist when the code is used on a specific framework, operating system, or a special function is called. - -#### Use a suggested package - -In the case that a security advisory is reported for the package you're using and the package is marked deprecated or seems abandoned, consider using any suggested alternate package the package author has declared or a package comprising of similar functionality that is maintained. - -#### Contribute a fix - -If a fix does not exist for the security advisory, you may want to suggest changes that addresses the vulnerability in a pull request on package's open source repository or contact the author through the `Contact owners` section on the NuGet.org package detail page. - -#### Open an issue - -If you do not want to fix the vulnerability or are unable to update or replace the package, open an issue in the package's issue tracker or preferred contact method. -On NuGet.org, you can navigate to the package details page and click `Report package` which will guide you to get in contact with the author. - -### No security vulnerabilities found - -If no security vulnerabilities are found, this means that packages with known vulnerabilities were not found in your package graph at the present moment of time you checked. -Since the advisory database can be updated at any time, we recommend regularly checking your `dotnet restore` output and ensuring the same in your continuous integration process. - -## Summary - -Security auditing features are crucial for maintaining the security and integrity of software projects. -These features provide you with an additional layer of protection against security vulnerabilities and ensures that you can use open source packages with confidence. diff --git a/docs/concepts/NuGet-MCP-Server.md b/docs/concepts/NuGet-MCP-Server.md index 9a51f1d89..ccbd97e63 100644 --- a/docs/concepts/NuGet-MCP-Server.md +++ b/docs/concepts/NuGet-MCP-Server.md @@ -73,6 +73,84 @@ To verify that the MCP server is working correctly, open the GitHub Copilot Chat Then click the Tools icon in the bottom toolbar to bring up the Tools menu. You should see the MCP server named "nuget" in the list of available servers. +## Getting started in GitHub Copilot Agent + +You can also configure the MCP Server to work with GitHub Copilot as a Coding Agent in your repositories. +Ensure that you configured your repository to use [GitHub Copilot Coding Agents](https://github.com/settings/copilot/coding_agent). + +Browse to your repository and click the Settings tab. +Expand the Copilot section and click on Coding Agents. + +![GitHub Copilot coding agent settings](./media/github-copilot-agent-settings.png) + +Scroll down to the **Model Context Protocol (MCP)** section and add the following JSON snippet to your `mcpServers` configuration: + +```json +{ + "mcpServers": { + "NuGet": { + "type": "local", + "command": "dnx", + "args": ["NuGet.Mcp.Server", "--yes"], + "tools": ["*"], + "env": {} + } + } +} +``` + +This will make all of NuGet's MCP server tools available. If you want specific tools, you can list them in the `"tools"` parameter array. + +Finally, click the **Save MCP configuration** button to save your changes. + +Now that the NuGet MCP is configured, you will also need to create a GitHub Actions workflow to install .NET 10 Preview 6 or higher so that the `dnx` command is available to run the MCP server. +You can do this by creating the following workflow file in your repository at + +`.github/workflows/copilot-setup-steps.yml` + +The contents of this workflow file should be as follows: + +```yml +name: "Copilot Setup Steps" + +# Automatically run the setup steps when they are changed to allow for easy validation, and +# allow manual testing through the repository's "Actions" tab +on: + workflow_dispatch: + push: + paths: + - .github/workflows/copilot-setup-steps.yml + pull_request: + paths: + - .github/workflows/copilot-setup-steps.yml + +jobs: + # The job MUST be called `copilot-setup-steps` or it will not be picked up by Copilot. + copilot-setup-steps: + runs-on: ubuntu-latest + + # Set the permissions to the lowest permissions possible needed for your steps. + # Copilot will be given its own token for its operations. + permissions: + # If you want to clone the repository as part of your setup steps, for example to install dependencies, you'll need the `contents: read` permission. If you don't clone the repository in your setup steps, Copilot will do this for you automatically after the steps complete. + contents: read + + # You can define any steps you want, and they will run before the agent starts. + # If you do not check out your code, Copilot will do this for you. + steps: + - name: Install .NET 10.x + uses: actions/setup-dotnet@v5 + with: + dotnet-version: | + 10.x + dotnet-quality: preview + + - name: dotnet --info + run: dotnet --info +``` + +This will ensure that the `dnx` command is available to run the NuGet MCP server when GitHub Copilot runs as a coding agent in your repository. + ## Fixing package vulnerabilities The NuGet MCP server can help you identify and fix package vulnerabilities in your project. diff --git a/docs/concepts/media/dotnet-nuget-why-1.png b/docs/concepts/media/dotnet-nuget-why-1.png new file mode 100644 index 000000000..b8422c44e Binary files /dev/null and b/docs/concepts/media/dotnet-nuget-why-1.png differ diff --git a/docs/concepts/media/github-copilot-agent-settings.png b/docs/concepts/media/github-copilot-agent-settings.png new file mode 100644 index 000000000..2b998ee35 Binary files /dev/null and b/docs/concepts/media/github-copilot-agent-settings.png differ diff --git a/docs/concepts/media/pm-ui-transitive-tooltip-1.png b/docs/concepts/media/pm-ui-transitive-tooltip-1.png new file mode 100644 index 000000000..d83e6bced Binary files /dev/null and b/docs/concepts/media/pm-ui-transitive-tooltip-1.png differ diff --git a/docs/concepts/media/vs-solution-explorer-search-options-1.png b/docs/concepts/media/vs-solution-explorer-search-options-1.png new file mode 100644 index 000000000..870c39a8a Binary files /dev/null and b/docs/concepts/media/vs-solution-explorer-search-options-1.png differ diff --git a/docs/concepts/media/vs-solution-explorer-search-results-1.png b/docs/concepts/media/vs-solution-explorer-search-results-1.png new file mode 100644 index 000000000..00e30fedd Binary files /dev/null and b/docs/concepts/media/vs-solution-explorer-search-results-1.png differ diff --git a/docs/consume-packages/nuget-https-everywhere.md b/docs/consume-packages/nuget-https-everywhere.md new file mode 100644 index 000000000..47c97e01d --- /dev/null +++ b/docs/consume-packages/nuget-https-everywhere.md @@ -0,0 +1,97 @@ +--- +title: NuGet HTTPS Everywhere +description: Learn why NuGet enforces HTTPS connections for package sources, what errors like NU1302 mean, and how to safely allow HTTP feeds when necessary. +author: Nigusu-Allehu +ms.author: nyenework +ms.date: 10/28/2025 +ms.topic: conceptual +ai-usage: ai-generated +--- + +# NuGet HTTPS Everywhere + +NuGet requires all package sources to use **HTTPS** instead of **HTTP**. +This enforcement protects the software supply chain by preventing tampering and interception during package restore and related operations. +NuGet enforces this requirement by producing an error and stopping the operation when an HTTP source is used. + +## Understanding the HTTP Error + +This error occurs when one or more package sources in your configuration use an **HTTP** URL instead of **HTTPS**. + +In earlier NuGet versions, this scenario produced a **warning** ([`NU1803`](../reference/errors-and-warnings/nu1803.md)). +Beginning with [**NuGet 6.12**](../release-notes/NuGet-6.12.md) and later, it now results in an **error** unless the use of HTTP sources is explicitly permitted. + +### Recommended Resolution + +Before allowing HTTP connections, confirm whether your package source supports HTTPS. +If it does, update the feed URL to use the secure protocol: + +```xml + +``` + +Switching to HTTPS ensures end-to-end encryption and is the recommended and more secure approach. + +### Allowing Insecure HTTP Feeds (Opt-Out) + +If HTTPS is not available and you operate in a trusted or isolated environment, you can explicitly allow HTTP sources. + +#### Option 1: Set allowInsecureConnections in your `NuGet.Config` + +* **Use Visual Studio** + + Enable or disable allowing insecure HTTP connections with the [Package Sources settings](/nuget/consume-packages/nuget-visual-studio-options#allow-insecure-connections) under the Visual Studio options > **NuGet Package Manager**. + +* **Edit `NuGet.Config` manually** + + Add the `allowInsecureConnections="true"` attribute to the affected source: + + ```xml + + + + + + + ``` + +#### Option 2: Use the Command-Line Parameter + +For commands that support it, include the following flag to temporarily permit HTTP connections: + +For **dotnet** commands: + +```bash +--allow-insecure-connections +``` + +For **NuGet.exe** commands, use: + +```powershell +-AllowInsecureConnections +``` + +#### Commands that support opt-out options + +| Tool | Commands | Support for Allow Insecure Connection | +| -------------- | ------------------------- | ------------------------------------- | +| **nuget.exe** | `push` | NuGet **7.0** | +| **dotnet CLI** | `dotnet nuget push` | .NET **10.0.1xx** and newer | +| **dotnet CLI** | `dotnet nuget add source` | .NET **9.0.1xx** and newer | + +## HTTPS Enforcement Rollout Across Tools + +NuGet’s HTTPS enforcement was introduced gradually across releases. +The following table summarizes the progression from [**warnings (NU1803)**](../reference/errors-and-warnings/nu1803.md) to [**errors (NU1302)**](../reference/errors-and-warnings/nu1302.md). + +| Versions Affected | Behavior | +| ----------------------------------------------------- | --------------------------------------------------------------------- | +| [NuGet.exe 6.3](../release-notes/NuGet-6.3.md)+, Visual Studio 17.3+, .NET 6.0.100+ | ⚠️ **Warning (NU1803)** – HTTP sources allowed but discouraged | +| [NuGet.exe 6.12](../release-notes/NuGet-6.12.md)+, Visual Studio 17.12+, .NET 9.0.100+ | ❌ **Error (NU1302)** – HTTP sources blocked unless explicitly allowed| + +## See Also + +* [NU1302](../reference/errors-and-warnings/nu1302.md) +* [NU1803](../reference/errors-and-warnings/nu1803.md) +* [NuGet.Config Reference](../reference/nuget-config-file.md#packagesources) +* [NuGet Visual Studio Options](../consume-packages/nuget-visual-studio-options.md) diff --git a/docs/reference/errors-and-warnings/NU1302.md b/docs/reference/errors-and-warnings/NU1302.md index 8bbecf34e..2dd3803d8 100644 --- a/docs/reference/errors-and-warnings/NU1302.md +++ b/docs/reference/errors-and-warnings/NU1302.md @@ -10,6 +10,8 @@ f1_keywords: # NuGet Error NU1302 +## Scenario 1 + > You are running the 'restore' operation with an 'HTTP' source: myHttpSource. NuGet requires HTTPS sources. To use an HTTP source, you must explicitly set 'allowInsecureConnections' to true in your NuGet.Config file. Please refer to https://aka.ms/nuget-https-everywhere for more information. ### Issue @@ -53,3 +55,34 @@ Here's how it functions: > [!WARNING] > Changing SdkAnalysisLevel has other side-effects. Refer to the [`SdkAnalysisLevel`](/dotnet/core/project-sdk/msbuild-props#sdkanalysislevel) for a summary of the full scope of .NET SDK features affected. + +## Scenario 2 + +> You are using a NuGet source 'https://contoso/v3/index.json' that contains an 'HTTP' service index resource endpoint: 'http://contoso/v3-flatcontainer/contoso/index.json'. This is insecure and not recommended. To allow HTTP resources, you must explicitly set 'allowInsecureConnections' to true in your NuGet.Config file. For more information, visit https://aka.ms/nuget-https-everywhere. + +### Issue + +A configured package source uses **HTTPS**, but one of its resources (indicated in the error message) uses **HTTP**. + +NuGet requires that all sources and their resources use HTTPS. +If you want to continue using this source despite its HTTP resource, you must set the `allowInsecureConnections` flag to true in your NuGet.config file. + +To learn more about package sources and resource endpoints, take a look at the [NuGet Server API](../../api/overview). + +#### Option 1: Update the Source to Use HTTPS + +Whenever possible, switch to a package source that provides only HTTPS resources. This is the recommended and most secure option. + +#### Option 2: Allow Insecure Connections (If Necessary) + +If you must use the source, explicitly allow insecure connections by adding the `allowInsecureConnections` flag in the `NuGet.Config`: + +For information about managing the setting in Visual Studio, see [NuGet Options in Visual Studio](../../consume-packages/nuget-visual-studio-options.md#allow-insecure-connections) + +```xml + + + + + +``` diff --git a/docs/reference/errors-and-warnings/NU1901-NU1904.md b/docs/reference/errors-and-warnings/NU1901-NU1904.md index f55154558..4fb538434 100644 --- a/docs/reference/errors-and-warnings/NU1901-NU1904.md +++ b/docs/reference/errors-and-warnings/NU1901-NU1904.md @@ -33,7 +33,7 @@ For more information, see [the documentation on auditing packages](../../concept ### Solution -We have [a blog post](https://devblogs.microsoft.com/nuget/nugetaudit-2-0-elevating-security-and-trust-in-package-management/) with more discussion about our recommended actions when your project uses a package with a known vulnerability, and tools that can help. +We have [documentation on upgrading vulnerable packages](../../concepts/Auditing-Packages.md#actions-when-packages-with-known-vulnerabilities-are-reported) that goes in more detail about our recommended actions when your project uses a package with a known vulnerability, and tools that can help. Upgrading to a newer version of the package is likely to resolve the warning. If your project does not reference the package directly (it's a transitive package), [`dotnet nuget why`](/dotnet/core/tools/dotnet-nuget-why) can be used to understand which package caused it to be included in your project.