Dependency advisories do not fail the build, and transitive packages are not audited at all #51

Band: small

Directory.Build.props:50 sets TreatWarningsAsErrors, so the build already refuses to ship a warning. It says nothing about dependency advisories, so a known vulnerability in a transitive package is not a warning and does not fail anything.

Right now that is a theoretical gap. I ran the check by hand and it is clean:

$ dotnet list package --vulnerable --include-transitive
The given project `Verdict` has no vulnerable packages given the current sources.
... 18 projects, all clean

The point is that nothing re-runs it. NuGetAudit defaults to direct mode, so transitive packages are not scanned at all, and the packages that matter here are transitive: System.Memory 4.5.5 for Verdict.Extensions, System.Collections.Immutable 10.0.1 for Verdict.Rich, and System.Text.Json 8.0.5 for Verdict.Json, all on the netstandard2.0 target.

What should change

In Directory.Build.props:

<NuGetAudit>true</NuGetAudit>
<NuGetAuditMode>all</NuGetAuditMode>
<NuGetAuditLevel>low</NuGetAuditLevel>

With TreatWarningsAsErrors already set, an advisory at any severity then fails the build rather than waiting for somebody to run the command. low rather than moderate because this is a library, so a consumer inherits whatever it pulls in.

One thing to check before merging: NuGetAuditMode=all on a repo with TreatWarningsAsErrors means a newly published advisory can turn a green build red without anything in the repository changing. That is the intended behaviour and it is still worth knowing, because it will happen on somebody's unrelated pull request.

xUnit 2.6.6 is also flagged deprecated (legacy, superseded by xunit.v3). Not a vulnerability and not urgent, but it belongs on the same pass.