skills.rest
jonnymuir
jonnymuirCOMMUNITY
Explore all skills by this author →
Website𝕏@jonnymooGitHub

nuget-vulnerability-overrides

Override transitive NuGet dependency versions to resolve vulnerability warnings.

1|Updated Dec 23, 2025
Search Tags:#security#vulnerability#dependencies#dotnet#nuget#patching
One-click install
npx skills add https://github.com/jonnymuir/Umbraco.Prism --skill nuget-vulnerability-overrides
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: nuget-vulnerability-overrides
Source: https://github.com/jonnymuir/Umbraco.Prism/tree/main/.claude/skills/nuget-vulnerability-overrides
Command: npx skills add https://github.com/jonnymuir/Umbraco.Prism --skill nuget-vulnerability-overrides

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill addresses the common friction of transitive NuGet vulnerability warnings (like NU1902) where upgrading a top-level package would introduce unnecessary breaking changes or bloat the dependency graph.

Core Features & Use Cases

  • Surgical Pinning: Allows you to override specific transitive dependencies with the minimum patched version required to clear security warnings.
  • Dependency Isolation: Uses PrivateAssets to ensure overrides do not leak into downstream consumers.
  • Use Case: When a build fails due to a vulnerability in a deep dependency of a major framework package, use this to apply a targeted fix without forcing a risky major version upgrade of the parent library.

Quick Start

Use the nuget-vulnerability-overrides skill to identify the vulnerable transitive package and apply a direct version pin to the project file.

Frequently Asked Questions about nuget-vulnerability-overrides

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I fix transitive NuGet vulnerability warnings without upgrading top-level packages?▼

You fix transitive NuGet vulnerability warnings by applying targeted direct package references to override insecure versions. This surgical pinning clears security warnings without forcing risky major version upgrades of parent libraries.

What is the best way to patch a vulnerable deep dependency in a .NET project?▼

Patching a vulnerable deep dependency involves adding a direct version pin for the minimum patched package required. This isolates the security fix using PrivateAssets to prevent override leakage into downstream consumers.

Can I override insecure transitive dependencies without bloating the dependency graph?▼

Yes, you can override insecure transitive dependencies without bloating the dependency graph by applying surgical direct package references. This maintains clean dependency resolution while clearing vulnerability warnings like NU1902.

How do I ensure my NuGet vulnerability overrides don't leak to downstream consumers?▼

You ensure NuGet vulnerability overrides do not leak to downstream consumers by using PrivateAssets in your project file. This isolates the targeted direct package references used to pin insecure transitive dependencies.

Why does my .NET build fail due to a vulnerability in a deep dependency of a major framework package?▼

Your .NET build fails because transitive NuGet dependencies contain known security vulnerabilities triggering warnings like NU1902. You fix this by applying a direct version pin to override the insecure transitive package.

Related Skills

Explore More Software Engineering Skills→
jonnymuirjonnymuir
1

transitive-vulnerability-overrides

Resolve vulnerable transitive NuGet package warnings with targeted version overrides.

Community
Intermediate
jnPiyushjnPiyush

dependency-management

Automates secure dependency management for .NET/NuGet, npm, and pip workflows with lockfiles and security audits.

Community
Advanced
yash-gargyash-garg

dart-resolve-package-conflicts

Resolve Dart package dependency conflicts blocking pub get and builds.

Community
Intermediate
dorriodorrio

ln-712-nuget-upgrader

Upgrade .NET NuGet packages while handling breaking changes.

Community
Intermediate