Proposal: Transitive Vulnerability Reporting Mechanism for NuGet Packages

[FranckSix]

When a package references another that contains a known vulnerability, only the transitive dependency is flagged — not the primary package listed in the solution. This makes it difficult to identify the root package responsible for introducing the vulnerability.

Some packages seem to benefit from this gap, delaying updates because their own library is not marked as vulnerable. Despite referencing a vulnerable dependency, they remain in a “green” status, which can be misleading.

Introducing a transitive vulnerability tag on the primary package could act as a wake-up call, encouraging maintainers to take responsibility and keep environments safe and secure.

But the deeper issue is this: when developers see warnings they cannot act upon, they often defer them to TODOs — and those TODOs become production code. Over time, these unresolved warnings fade into the background, never revisited, and silently weaken the security posture of the system.

Too many passive alerts without actionable paths lead to alert fatigue, eroding vigilance and opening the door to long-term breaches.

[FranckSix]

NuGet/NuGetGallery#10596