Requesting Vulnerability Source `dotnet list package --vulnerable`

[digitalcoyote]

Requesting Vulnerability Source `dotnet list package --vulnerable`

[rajbos]

Will this be an extra source for finding vulnerabilities that automatically can be ran?
It would be a welcome addition since we cannot really use the dotnet list command as is in a CI/CD scenario without adding string comparison scripts around it. :-)

[digitalcoyote]

The current plan is to add the option to the 'dotnet list' command run internally by NuGetDefense.Core and parse out any vulnerabilities there (if it's enabled).

[digitalcoyote]

Did some research on this and it appears that it relies on a single source (github). Looking into just adding that source as the information supplied from the DotNet tool is very limited and complicates dotnet list packages parsing

[digitalcoyote]

Hoping to have this out with the 3.0.0 release. Working on NuGetDefense.GitHubAdvisoryDatabase now