The NuGet Blog

The latest news, updates, and insights from the NuGet team

Security - The NuGet Blog

NuGetAudit 2.0: Elevating Security and Trust in Package Management

July 17, 2024 Jul 17, 2024 07/17/24
authorsAndy Zivkovic, Jon Douglas
Introduction In November 2023 (NuGet 6.8, Visual Studio 17.8, .NET SDK 8.0.100), we released NuGet Audit. NuGet Audit provides warnings during restore when a package with a known vulnerability is used by a project. More information about NuGet Audit, including detailed configuration options can be found on our learn website. New features are ...

Building a Safer Future – How NuGet is Tackling Software Supply Chain Threats

July 16, 2024 Jul 16, 2024 07/16/24
Jon Douglas
Despite significant technological progress in addressing complex security threats, the key to preventing the next attack lies in adhering to fundamental security principles. It's essential to ensure the software ecosystem is secure, focusing on protecting .NET developers who design, build, and maintain the critical software we all use. As the...

HTTPS Everywhere Update

September 19, 2023 Sep 19, 2023 09/19/23
Jon Douglas
Mistakes were made When we first published the plan for the effort of HTTPS everywhere, we wanted to get developer community feedback on the various HTTP and HTTPS scenarios that we don't have much everyday visibility of. After we published that blog, we heard you loud and clear that there was a gap. This plan needed a clear way to suppress ...

HTTPS everywhere

August 9, 2022 Aug 9, 2022 08/9/22
Jon Douglas
Safety guaranteed As an ongoing effort to make HTTPS everywhere a reality for NuGet, we have taken a number of steps to help protect your everyday package management experiences. Earlier this year, a security fact sheet from The White House reinforced companies to take action to secure our software supply chains. HTTPS and SSL not only ...