From 1029fd8cbd165424b8a42ddaf8f3e56851cbb5a0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?K=C3=A9vin=20Chalet?= <kevinchalet@gmail.com>
Date: Wed, 29 Oct 2025 15:19:30 +0100
Subject: [PATCH] Set NuGetAuditMode to "all" to enable vulnerable transitive
 dependencies warnings

---
 Directory.Build.props                         |  2 +-
 Directory.Packages.props                      | 68 ++++++++++---------
 .../Dantooine.Server/Dantooine.Server.csproj  |  6 ++
 .../Matty/Matty.Server/Matty.Server.csproj    |  8 ++-
 .../Mortis/Mortis.Client/Mortis.Client.csproj |  6 ++
 samples/Mortis/Mortis.Client/Web.config       |  6 ++
 .../Velusia.Server/Velusia.Server.csproj      |  6 ++
 7 files changed, 67 insertions(+), 35 deletions(-)

diff --git a/Directory.Build.props b/Directory.Build.props
index 22e26a91..029ce8a4 100644
--- a/Directory.Build.props
+++ b/Directory.Build.props
@@ -9,7 +9,7 @@
     <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
     <NoWarn>$(NoWarn);CS1591;NU5128</NoWarn>
     <WarningsNotAsErrors>NU1901;NU1902;NU1903;NU1904</WarningsNotAsErrors>
-    <NuGetAuditMode>direct</NuGetAuditMode>
+    <NuGetAuditMode>all</NuGetAuditMode>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
     <DebugSymbols>true</DebugSymbols>
diff --git a/Directory.Packages.props b/Directory.Packages.props
index 5d1b8cb5..543b9837 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -43,6 +43,7 @@
     <PackageVersion Include="Microsoft.Owin.Security.Cookies"                            Version="4.2.3"   />
     <PackageVersion Include="Microsoft.Owin.Security.OAuth"                              Version="4.2.3"   />
     <PackageVersion Include="Microsoft.Web.Infrastructure"                               Version="2.0.1"   />
+    <PackageVersion Include="Newtonsoft.Json"                                            Version="13.0.4"  />
     <PackageVersion Include="OpenIddict.Client.SystemIntegration"                        Version="7.0.0"   />
     <PackageVersion Include="OpenIddict.Client.SystemNetHttp"                            Version="7.0.0"   />
     <PackageVersion Include="OpenIddict.EntityFramework"                                 Version="7.0.0"   />
@@ -64,39 +65,40 @@
     <!--
       Note: the following references are exclusively used in the .NET 9.0 and ASP.NET Core 9.0 samples:
     -->
-    <PackageVersion Include="Dapplo.Microsoft.Extensions.Hosting.AppServices"            Version="1.0.14"  />
-    <PackageVersion Include="Dapplo.Microsoft.Extensions.Hosting.WinForms"               Version="1.0.14"  />
-    <PackageVersion Include="Dapplo.Microsoft.Extensions.Hosting.Wpf"                    Version="1.0.14"  />
-    <PackageVersion Include="Microsoft.AspNetCore.Authentication.Negotiate"              Version="9.0.10"  />
-    <PackageVersion Include="Microsoft.AspNetCore.Components.WebAssembly"                Version="9.0.10"  />
-    <PackageVersion Include="Microsoft.AspNetCore.Components.WebAssembly.Authentication" Version="9.0.10"  />
-    <PackageVersion Include="Microsoft.AspNetCore.Components.WebAssembly.Build"          Version="3.2.1"   />
-    <PackageVersion Include="Microsoft.AspNetCore.Components.WebAssembly.DevServer"      Version="9.0.10"  />
-    <PackageVersion Include="Microsoft.AspNetCore.Components.WebAssembly.Server"         Version="9.0.10"  />
-    <PackageVersion Include="Microsoft.AspNetCore.Components.WebView.Wpf"                Version="9.0.120" />
-    <PackageVersion Include="Microsoft.AspNetCore.Diagnostics.EntityFrameworkCore"       Version="9.0.10"  />
-    <PackageVersion Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore"          Version="9.0.10"  />
-    <PackageVersion Include="Microsoft.AspNetCore.Identity.UI"                           Version="9.0.10"  />
-    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation"          Version="9.0.10"  />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite"                       Version="9.0.10"  />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Tools"                        Version="9.0.10"  />
-    <PackageVersion Include="Microsoft.Extensions.DependencyInjection"                   Version="9.0.10"  />
-    <PackageVersion Include="Microsoft.Extensions.Hosting"                               Version="9.0.10"  />
-    <PackageVersion Include="Microsoft.Extensions.Http"                                  Version="9.0.10"  />
-    <PackageVersion Include="Microsoft.VisualStudio.Web.CodeGeneration.Design"           Version="9.0.0"   />
-    <PackageVersion Include="OpenIddict.Abstractions"                                    Version="7.0.0"   />
-    <PackageVersion Include="OpenIddict.AspNetCore"                                      Version="7.0.0"   />
-    <PackageVersion Include="OpenIddict.Client.SystemIntegration"                        Version="7.0.0"   />
-    <PackageVersion Include="OpenIddict.Client.SystemNetHttp"                            Version="7.0.0"   />
-    <PackageVersion Include="OpenIddict.Client.WebIntegration"                           Version="7.0.0"   />
-    <PackageVersion Include="OpenIddict.EntityFrameworkCore"                             Version="7.0.0"   />
-    <PackageVersion Include="OpenIddict.Quartz"                                          Version="7.0.0"   />
-    <PackageVersion Include="OpenIddict.Validation.AspNetCore"                           Version="7.0.0"   />
-    <PackageVersion Include="OpenIddict.Validation.SystemNetHttp"                        Version="7.0.0"   />
-    <PackageVersion Include="Quartz.Extensions.Hosting"                                  Version="3.15.1"  />
-    <PackageVersion Include="Spectre.Console"                                            Version="0.51.1"  />
-    <PackageVersion Include="System.Linq.Async"                                          Version="6.0.3"   />
-    <PackageVersion Include="Yarp.ReverseProxy"                                          Version="2.3.0"   />
+    <PackageVersion Include="Dapplo.Microsoft.Extensions.Hosting.AppServices"            Version="1.0.14"   />
+    <PackageVersion Include="Dapplo.Microsoft.Extensions.Hosting.WinForms"               Version="1.0.14"   />
+    <PackageVersion Include="Dapplo.Microsoft.Extensions.Hosting.Wpf"                    Version="1.0.14"   />
+    <PackageVersion Include="Microsoft.AspNetCore.Authentication.Negotiate"              Version="9.0.10"   />
+    <PackageVersion Include="Microsoft.AspNetCore.Components.WebAssembly"                Version="9.0.10"   />
+    <PackageVersion Include="Microsoft.AspNetCore.Components.WebAssembly.Authentication" Version="9.0.10"   />
+    <PackageVersion Include="Microsoft.AspNetCore.Components.WebAssembly.Build"          Version="3.2.1"    />
+    <PackageVersion Include="Microsoft.AspNetCore.Components.WebAssembly.DevServer"      Version="9.0.10"   />
+    <PackageVersion Include="Microsoft.AspNetCore.Components.WebAssembly.Server"         Version="9.0.10"   />
+    <PackageVersion Include="Microsoft.AspNetCore.Components.WebView.Wpf"                Version="9.0.120"  />
+    <PackageVersion Include="Microsoft.AspNetCore.Diagnostics.EntityFrameworkCore"       Version="9.0.10"   />
+    <PackageVersion Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore"          Version="9.0.10"   />
+    <PackageVersion Include="Microsoft.AspNetCore.Identity.UI"                           Version="9.0.10"   />
+    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation"          Version="9.0.10"   />
+    <PackageVersion Include="Microsoft.Build"                                            Version="17.14.28" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite"                       Version="9.0.10"   />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Tools"                        Version="9.0.10"   />
+    <PackageVersion Include="Microsoft.Extensions.DependencyInjection"                   Version="9.0.10"   />
+    <PackageVersion Include="Microsoft.Extensions.Hosting"                               Version="9.0.10"   />
+    <PackageVersion Include="Microsoft.Extensions.Http"                                  Version="9.0.10"   />
+    <PackageVersion Include="Microsoft.VisualStudio.Web.CodeGeneration.Design"           Version="9.0.0"    />
+    <PackageVersion Include="OpenIddict.Abstractions"                                    Version="7.0.0"    />
+    <PackageVersion Include="OpenIddict.AspNetCore"                                      Version="7.0.0"    />
+    <PackageVersion Include="OpenIddict.Client.SystemIntegration"                        Version="7.0.0"    />
+    <PackageVersion Include="OpenIddict.Client.SystemNetHttp"                            Version="7.0.0"    />
+    <PackageVersion Include="OpenIddict.Client.WebIntegration"                           Version="7.0.0"    />
+    <PackageVersion Include="OpenIddict.EntityFrameworkCore"                             Version="7.0.0"    />
+    <PackageVersion Include="OpenIddict.Quartz"                                          Version="7.0.0"    />
+    <PackageVersion Include="OpenIddict.Validation.AspNetCore"                           Version="7.0.0"    />
+    <PackageVersion Include="OpenIddict.Validation.SystemNetHttp"                        Version="7.0.0"    />
+    <PackageVersion Include="Quartz.Extensions.Hosting"                                  Version="3.15.1"   />
+    <PackageVersion Include="Spectre.Console"                                            Version="0.51.1"   />
+    <PackageVersion Include="System.Linq.Async"                                          Version="6.0.3"    />
+    <PackageVersion Include="Yarp.ReverseProxy"                                          Version="2.3.0"    />
   </ItemGroup>
 
 </Project>
diff --git a/samples/Dantooine/Dantooine.Server/Dantooine.Server.csproj b/samples/Dantooine/Dantooine.Server/Dantooine.Server.csproj
index 5383096e..fe8151a2 100644
--- a/samples/Dantooine/Dantooine.Server/Dantooine.Server.csproj
+++ b/samples/Dantooine/Dantooine.Server/Dantooine.Server.csproj
@@ -6,10 +6,16 @@
   </PropertyGroup>
 
   <ItemGroup>
+    <!--
+      Note: Microsoft.Build is explicitly referenced to override the
+      vulnerable version referenced by other packages or metapackages.
+    -->
+
     <PackageReference Include="Microsoft.AspNetCore.Diagnostics.EntityFrameworkCore" />
     <PackageReference Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore" />
     <PackageReference Include="Microsoft.AspNetCore.Identity.UI" />
     <PackageReference Include="Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation" />
+    <PackageReference Include="Microsoft.Build" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.Tools" PrivateAssets="All" />
     <PackageReference Include="Microsoft.VisualStudio.Web.CodeGeneration.Design" />
diff --git a/samples/Matty/Matty.Server/Matty.Server.csproj b/samples/Matty/Matty.Server/Matty.Server.csproj
index 7e7fba45..fe8151a2 100644
--- a/samples/Matty/Matty.Server/Matty.Server.csproj
+++ b/samples/Matty/Matty.Server/Matty.Server.csproj
@@ -6,10 +6,16 @@
   </PropertyGroup>
 
   <ItemGroup>
+    <!--
+      Note: Microsoft.Build is explicitly referenced to override the
+      vulnerable version referenced by other packages or metapackages.
+    -->
+
     <PackageReference Include="Microsoft.AspNetCore.Diagnostics.EntityFrameworkCore" />
-    <PackageReference Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore"  />
+    <PackageReference Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore" />
     <PackageReference Include="Microsoft.AspNetCore.Identity.UI" />
     <PackageReference Include="Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation" />
+    <PackageReference Include="Microsoft.Build" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.Tools" PrivateAssets="All" />
     <PackageReference Include="Microsoft.VisualStudio.Web.CodeGeneration.Design" />
diff --git a/samples/Mortis/Mortis.Client/Mortis.Client.csproj b/samples/Mortis/Mortis.Client/Mortis.Client.csproj
index 59c1a338..fbd1d281 100644
--- a/samples/Mortis/Mortis.Client/Mortis.Client.csproj
+++ b/samples/Mortis/Mortis.Client/Mortis.Client.csproj
@@ -13,6 +13,11 @@
   </ItemGroup>
 
   <ItemGroup>
+    <!--
+      Note: Newtonsoft.Json is explicitly referenced to override the
+      vulnerable version referenced by other packages or metapackages.
+    -->
+
     <PackageReference Include="Antlr" />
     <PackageReference Include="Autofac.Extensions.DependencyInjection" />
     <PackageReference Include="Autofac.Mvc5" />
@@ -23,6 +28,7 @@
     <PackageReference Include="Microsoft.Owin.Host.SystemWeb" />
     <PackageReference Include="Microsoft.Owin.Security.Cookies" />
     <PackageReference Include="Microsoft.Web.Infrastructure" PrivateAssets="all" />
+    <PackageReference Include="Newtonsoft.Json" />
     <PackageReference Include="OpenIddict.EntityFramework" />
     <PackageReference Include="OpenIddict.Owin" />
     <PackageReference Include="WebGrease" />
diff --git a/samples/Mortis/Mortis.Client/Web.config b/samples/Mortis/Mortis.Client/Web.config
index 73f46fb5..f0ad7e12 100644
--- a/samples/Mortis/Mortis.Client/Web.config
+++ b/samples/Mortis/Mortis.Client/Web.config
@@ -140,6 +140,12 @@
         <bindingRedirect oldVersion="0.0.0.0-4.2.3.0" newVersion="4.2.3.0" />
       </dependentAssembly>
     </assemblyBinding>
+    <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
+      <dependentAssembly>
+        <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />
+        <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />
+      </dependentAssembly>
+    </assemblyBinding>
   </runtime>
   <system.codedom>
     <compilers>
diff --git a/samples/Velusia/Velusia.Server/Velusia.Server.csproj b/samples/Velusia/Velusia.Server/Velusia.Server.csproj
index 7e7fba45..408174c9 100644
--- a/samples/Velusia/Velusia.Server/Velusia.Server.csproj
+++ b/samples/Velusia/Velusia.Server/Velusia.Server.csproj
@@ -6,10 +6,16 @@
   </PropertyGroup>
 
   <ItemGroup>
+    <!--
+      Note: Microsoft.Build is explicitly referenced to override the
+      vulnerable version referenced by other packages or metapackages.
+    -->
+
     <PackageReference Include="Microsoft.AspNetCore.Diagnostics.EntityFrameworkCore" />
     <PackageReference Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore"  />
     <PackageReference Include="Microsoft.AspNetCore.Identity.UI" />
     <PackageReference Include="Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation" />
+    <PackageReference Include="Microsoft.Build" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.Tools" PrivateAssets="All" />
     <PackageReference Include="Microsoft.VisualStudio.Web.CodeGeneration.Design" />