Set proper exit code on `dotnet list package --vulnerable` to enable usage in CI pipelines

Running dotnet list package --vulnerable does not use the exit code to indicate issues. I’d think vulnerable packages with medium / high severity would at least be returned with an exitcode <> 0.

Usage example:

I want to include this command in our CI pipeline to enable a shift left mentality and warn us earlier about possible vulnerabilities. Currently the only option I see is parsing the result for something like has the following vulnerable packages.

Alternatively I can image adding a parameter to return either a number of vulnerable packages (that we can then test to larger then 0) or a json object we can parse the right way to look for the numbers per severity.

I’ve been searching the source code but could not find where to look for the exit code setup 😁 .

[msftbot[bot]]

Thanks for creating this issue! We believe this issue is related to NuGet tooling, which is maintained by the NuGet team. Thus, we closed this one and encourage you to raise this issue in the NuGet repository instead. Don’t forget to check out NuGet’s contributing guide before submitting an issue!

If you believe this issue was closed out of error, please comment to let us know.

Happy Coding!

[mrjoops]

Hi,

As a workaround, I use these lines to make my (linux-based) CI work:

dotnet list package --vulnerable --include-transitive | tee vulnerable.out
test `grep -cm 1 'has the following vulnerable packages' vulnerable.out` = 0

So yes, it may break with future dotnet versions but since I’m very optimistic, I hope dotnet will implement a correct return code so my added line will never be executed 😉.