transitive-vulnerability-overrides

Resolve vulnerable transitive NuGet package warnings with targeted version overrides.

1|Updated Dec 23, 2025

Search Tags:#security #vulnerability #dependencies #dotnet #nuget #patching

Ready to run

npx skills add https://github.com/jonnymuir/Umbraco.Prism --skill transitive-vulnerability-overrides

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: transitive-vulnerability-overrides
Source: https://github.com/jonnymuir/Umbraco.Prism/tree/main/.claude/skills/transitive-vulnerability-overrides
Command: npx skills add https://github.com/jonnymuir/Umbraco.Prism --skill transitive-vulnerability-overrides

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the common issue of build warnings caused by vulnerable transitive NuGet packages, allowing you to patch security risks without performing broad, unnecessary, or breaking upgrades to top-level dependencies.

Core Features & Use Cases

Targeted Overrides: Provides a methodology to pin specific transitive dependencies to their patched minimum versions.
Build Hygiene: Ensures your project remains secure while maintaining dependency stability.
Use Case: When a security scan flags a deep dependency in your dependency tree, use this skill to apply a surgical override that clears the warning while keeping your primary package versions intact.

Quick Start

Identify the vulnerable transitive package using the dotnet list command and apply a specific PackageReference override with PrivateAssets set to all in your project file.

Frequently Asked Questions about transitive-vulnerability-overrides

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I resolve security warnings from vulnerable transitive NuGet packages?▼

You can resolve security warnings from vulnerable transitive NuGet packages by applying targeted version overrides. This pins specific transitive dependencies to their patched minimum versions without upgrading your top-level packages.

What is the best way to patch a vulnerable transitive dependency in .NET without breaking top-level packages?▼

The best way to patch a vulnerable transitive dependency in .NET is to apply a surgical PackageReference override in your XML project file. This clears the security warning while keeping your primary package versions intact.

How do I find vulnerable paths in my NuGet dependency graph?▼

You can find vulnerable paths in your NuGet dependency graph by using the dotnet list command. This CLI tool identifies the specific deep dependencies causing build warnings so you can target them for patching.

Can I use dotnet CLI tools to apply granular overrides for NuGet security vulnerabilities?▼

Yes, you use dotnet CLI tools to identify vulnerable paths and then modify your XML project file to pin patched versions. This provides granular control over the dependency graph to clear security warnings safely.

When do I need to use PrivateAssets in a PackageReference override for NuGet patching?▼

You need to set PrivateAssets to all in your PackageReference override when pinning a patched transitive dependency version. This ensures the override resolves the vulnerability warning without affecting dependency distribution.

Why does upgrading my top-level NuGet package not clear the transitive vulnerability warning?▼

Upgrading a top-level NuGet package may not clear a transitive vulnerability warning if the deep dependency remains unchanged. Applying a targeted version override to the specific transitive package resolves the security risk directly.