fix(nethermind): skip NuGet audit to unblock CI#1036
Merged
Conversation
Collaborator
✅ Heimdall Review Status
|
mw2000
force-pushed
the
mihirwadekar/pin-nethermind-dotnet-sdk
branch
from
44ef6e9 to
3b02658
Compare
NuGet's vulnerability database was updated after Nethermind 1.36.2's release to flag Microsoft.AspNetCore.DataProtection 10.0.1 as critically vulnerable (GHSA-9mv3-2cwr-p262). Since Nethermind treats warnings as errors, dotnet restore fails with NU1904 on every PR. Disable NuGet audit at build time with -p:NuGetAudit=false to unblock CI. The fix is merged upstream (NethermindEth/nethermind#11331) and included in 1.37.0 (pre-release). Once a stable Nethermind release ships with the patched dependency, we bump NETHERMIND_TAG and remove this flag.
mw2000
force-pushed
the
mihirwadekar/pin-nethermind-dotnet-sdk
branch
from
3b02658 to
a916a6e
Compare
mw2000
changed the title
mw2000
changed the title
mw2000
changed the title
danyalprout
approved these changes
Apr 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The nethermind Docker build fails on every PR with:
A CVE was published against
Microsoft.AspNetCore.DataProtection10.0.1 after Nethermind 1.36.2 shipped. Since Nethermind enablesTreatWarningsAsErrors, NuGet audit now hard-failsdotnet restorefor ~40 projects in the dependency graph.Fix
Pass
-p:NuGetAudit=falsetodotnet publishin the nethermind Dockerfile. This is the standard workaround when an upstream dependency pins a vulnerable transitive package in its latest stable release.Upstream
Already patched in NethermindEth/nethermind#11331, shipping in 1.37.0 (pre-release). When 1.37.0 goes stable, we bump
NETHERMIND_TAGinversions.envand drop this flag.