Change default dependency resolution to avoid vulnerable nuget packages

[mcm-ham]

NuGet Product(s) Affected

dotnet.exe

Current Behavior

If you install the latest version of some Microsoft nuget package, due to lowest dependency version strategy you can end up with nuget packages with known security vulnerabilities.

Desired Behavior

Either change strategy to HighestPatch or exclude vulnerable packages when executing lowest strategy or add a command similar to "npm audit fix" to allow users to easily fix known security vulnerabilities.

Additional Context

No response

[kartheekp-ms]

add a command similar to "npm audit fix" to allow users to easily fix known security vulnerabilities.

There is work going on in this area already #11549.

Either change strategy to HighestPatch or exclude vulnerable packages when executing lowest strategy

I think it is by design that NuGet resolves lowest dependency version by default. However, if you can onboard your repository into Central Package Management (CPM) which has Transitive pinning feature that allows to override the transitive package version without explicitly specifying the transitive dependency as a top-level dependency.

[aortiz-msft]

Thanks for the suggestion. Any changes to the dependency resolution algorithm can be super impactful, so we try to minimize those. In some cases, moving off vulnerable packages requires people to replace a package altogether.