15 questions found
How do you audit a .NET project's dependencies for known security vulnerabilities using NuGet tooling?
Advanced
`dotnet list package --vulnerable` (optionally with --include-transitive) scans all direct and transitive package references against the NuGet vulnerability database (sourced from GitHub Advisory Database) and reports any known CVEs with severity ratings, letting teams proactively identify and upgrade vulnerable dependencies before they become an incident, often integrated as a CI pipeline gate.
dotnet list package --vulnerable --include-transitive
# Output flags any package with a known CVE, e.g.:
# > System.Text.Json 6.0.0 : High severity - GHSA-xxxx
Real-world example
A CI pipeline fails the build automatically whenever `dotnet list package --vulnerable` reports a High or Critical severity vulnerability, preventing known-vulnerable dependencies from ever reaching a production deployment.
Common follow-ups: How often should this scan run in a CI/CD pipeline?;What's the difference between a vulnerable direct dependency and a vulnerable transitive one for remediation?
CI/CD
Publishing & Deployment;Assemblies & NuGet
What is a NuGet lock file (packages.lock.json), and what problem does it solve for reproducible builds?
Intermediate
A lock file records the exact resolved version of every direct and transitive dependency at restore time, ensuring that subsequent restores (across different machines, CI runs, or dates) produce bit-for-bit identical dependency trees rather than potentially resolving to newer compatible versions that happen to be available -- critical for reproducible builds and catching unexpected dependency changes in code review.
<PropertyGroup>
<RestorePackagesWithLockFile>true</RestorePackagesWithLockFile>
</PropertyGroup>
# Generates packages.lock.json, committed to source control
# dotnet restore --locked-mode fails the build if resolution would differ from the lock file
Real-world example
A CI pipeline runs `dotnet restore --locked-mode` to guarantee that a build today resolves the exact same dependency versions as it did when the lock file was last committed, catching any unexpected drift immediately.
Common follow-ups: How do you update the lock file when you intentionally want a new version?;How does this compare to npm's package-lock.json conceptually?
CI/CD
Publishing & Deployment;.NET CLI
SDK & Project Structure (csproj)
How does reflection allow inspecting an assembly's types and metadata at runtime, and what are common uses?
Advanced
System.Reflection APIs let you load an assembly (Assembly.Load, Assembly.LoadFrom) and enumerate its types, methods, properties, and custom attributes at runtime without compile-time knowledge of them -- powering scenarios like plugin discovery (finding all types implementing an interface), ORM mapping (reading property metadata to generate SQL), and dependency injection container auto-registration (scanning assemblies for service implementations).
var assembly = Assembly.LoadFrom("MyPlugin.dll");
var pluginTypes = assembly.GetTypes()
.Where(t => typeof(IPlugin).IsAssignableFrom(t) && !t.IsInterface);
foreach (var type in pluginTypes) {
var instance = (IPlugin)Activator.CreateInstance(type);
instance.Execute();
}
Real-world example
A DI container auto-registration extension scans all loaded assemblies via reflection at startup, automatically registering every class implementing a marker interface like IScopedService, eliminating dozens of manual registration lines.
Common follow-ups: What's the performance cost of reflection-heavy code, and how does source generation help?;Why is heavy reflection incompatible with Native AOT trimming?
Dependency Injection;CLR & Runtime
What are NuGet package sources, and how do you configure a project to pull packages from a private/internal feed alongside NuGet.org?
Intermediate
NuGet package sources are configured (globally or per-solution via NuGet.Config) URLs NuGet searches when resolving packages -- you can add multiple sources simultaneously (e.g., NuGet.org for public packages plus an internal Azure Artifacts feed for proprietary packages), with authentication handled via API keys or credential providers for private feeds.
<!-- NuGet.Config -->
<configuration>
<packageSources>
<add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
<add key="CompanyFeed" value="https://pkgs.dev.azure.com/mycompany/_packaging/internal/nuget/v3/index.json" />
</packageSources>
</configuration>
Real-world example
A company's internal shared libraries are published to a private Azure Artifacts feed configured alongside NuGet.org in every project's NuGet.Config, so developers use the same `dotnet add package` workflow for both public and internal dependencies.
Common follow-ups: How do you securely store credentials for a private feed in CI?;What's the package source mapping feature and why does it improve security?
CI/CD
Publishing & Deployment;.NET CLI
SDK & Project Structure (csproj)
What is package source mapping, and how does it protect against dependency confusion attacks?
Advanced
Package source mapping lets you explicitly restrict which package source(s) are allowed to provide packages matching specific name patterns (e.g., only your internal feed can provide packages prefixed 'MyCompany.*'), preventing a dependency confusion attack where a malicious actor publishes a same-named package to the public NuGet.org registry hoping your build accidentally pulls the public (malicious) version instead of your intended private one.
<!-- NuGet.Config -->
<packageSourceMapping>
<packageSource key="nuget.org">
<package pattern="*" />
</packageSource>
<packageSource key="CompanyFeed">
<package pattern="MyCompany.*" /> <!-- only CompanyFeed can provide these -->
</packageSource>
</packageSourceMapping>
Real-world example
After a widely publicized dependency confusion attack against another company, a security team adds package source mapping to every internal repository's NuGet.Config to guarantee internal package names can never accidentally resolve to a public NuGet.org impostor.
Common follow-ups: How would an attacker exploit the absence of source mapping?;What naming convention best supports effective source mapping patterns?
CI/CD
Publishing & Deployment;Assemblies & NuGet