-
Notifications
You must be signed in to change notification settings - Fork 6.1k
Document SDK vulnerability and EOL build warnings #53870
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
gewarren
merged 2 commits into
dotnet:main
from
JamieMagee:jamieMagee/sdk-vulnerability-warnings
Jun 1, 2026
Merged
Changes from all commits
Commits
Show all changes
2 commits
Select commit
Hold shift + click to select a range
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,51 @@ | ||
| --- | ||
| title: "NETSDK1238: The current .NET SDK has known vulnerabilities" | ||
| description: Learn how to resolve build warning NETSDK1238, which reports known CVEs against the .NET SDK that built your project. | ||
| ms.topic: error-reference | ||
| ms.date: 05/15/2026 | ||
| ai-usage: ai-assisted | ||
| f1_keywords: | ||
| - NETSDK1238 | ||
| --- | ||
| # NETSDK1238: The current .NET SDK has known vulnerabilities | ||
|
|
||
| This warning indicates that the .NET SDK used to build your project has one or more known Common Vulnerabilities and Exposures (CVEs). The full warning message is similar to the following example: | ||
|
|
||
| > NETSDK1238: The current .NET SDK (\<version>) has known vulnerabilities (\<CVE list>). Update to version \<version>. See <https://dotnet.microsoft.com/download> | ||
|
|
||
| To resolve the warning, install a patched .NET SDK from <https://dotnet.microsoft.com/download> and update your `global.json` (if present) to select the new version. | ||
|
|
||
| ## How the check works | ||
|
|
||
| The check is opt-in and only runs when the MSBuild property `CheckSdkVulnerabilities` is set to `true`: | ||
|
|
||
| ```xml | ||
| <Project Sdk="Microsoft.NET.Sdk"> | ||
| <PropertyGroup> | ||
| <CheckSdkVulnerabilities>true</CheckSdkVulnerabilities> | ||
| </PropertyGroup> | ||
| </Project> | ||
| ``` | ||
|
|
||
| You can also pass `/p:CheckSdkVulnerabilities=true` to a .NET CLI command, such as `dotnet build`. | ||
|
|
||
| By default, the .NET CLI refreshes a local cache of SDK release metadata in the background at most once every 24 hours under `~/.dotnet/sdk-vulnerability-cache/`. To change that interval, set [`DOTNET_SDK_VULNERABILITY_CHECK_INTERVAL_HOURS`](../dotnet-environment-variables.md#dotnet_sdk_vulnerability_check_interval_hours). The MSBuild check reads only that cache; it does not make network calls during the build. On machines that have never had network access, no warning is emitted. | ||
|
|
||
| ## Suppress the warning | ||
|
|
||
| To suppress the warning without updating the SDK: | ||
|
|
||
| - Add `NETSDK1238` to `NoWarn`: | ||
|
|
||
| ```xml | ||
| <NoWarn>$(NoWarn);NETSDK1238</NoWarn> | ||
| ``` | ||
|
|
||
| - Set `CheckSdkVulnerabilities` to `false` (the default) to turn off NETSDK1238, NETSDK1239, and NETSDK1240. | ||
| - Set the [`DOTNET_SDK_VULNERABILITY_CHECK_DISABLE`](../dotnet-environment-variables.md#dotnet_sdk_vulnerability_check_disable) environment variable to `true` to disable both the cache refresh and the build-time check. | ||
|
|
||
| ## See also | ||
|
|
||
| - [NETSDK1239: The current .NET SDK is end of life](netsdk1239.md) | ||
| - [NETSDK1240: The current .NET SDK feature band is discontinued](netsdk1240.md) | ||
| - [.NET releases and support](../../releases-and-support.md) | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,53 @@ | ||
| --- | ||
| title: "NETSDK1239: The current .NET SDK is end of life" | ||
| description: Learn how to resolve build warning NETSDK1239, which reports that the .NET SDK that built your project is end of life. | ||
| ms.topic: error-reference | ||
| ms.date: 05/15/2026 | ||
| ai-usage: ai-assisted | ||
| f1_keywords: | ||
| - NETSDK1239 | ||
| --- | ||
| # NETSDK1239: The current .NET SDK is end of life | ||
|
|
||
| This warning indicates that the .NET SDK used to build your project is end of life (EOL) and no longer receives security updates. The full warning message is similar to the following example: | ||
|
gewarren marked this conversation as resolved.
|
||
|
|
||
| > NETSDK1239: The current .NET SDK (\<version>) is end of life as of \<date>. It will receive no further security updates: <https://dotnet.microsoft.com/download> | ||
|
|
||
| To resolve the warning, install a supported .NET SDK from <https://dotnet.microsoft.com/download> and update your `global.json` (if present) to select the new version. For the current support timeline, see [.NET releases and support](../../releases-and-support.md). | ||
|
|
||
| This warning is distinct from [NETSDK1138](netsdk1138.md), which is raised when your project's *target framework* is out of support. NETSDK1239 is raised when the *SDK that runs the build* is out of support, regardless of which framework you target. | ||
|
|
||
| ## How the check works | ||
|
|
||
| The check is opt-in and only runs when the MSBuild property `CheckSdkVulnerabilities` is set to `true`: | ||
|
|
||
| ```xml | ||
| <Project Sdk="Microsoft.NET.Sdk"> | ||
| <PropertyGroup> | ||
| <CheckSdkVulnerabilities>true</CheckSdkVulnerabilities> | ||
| </PropertyGroup> | ||
| </Project> | ||
| ``` | ||
|
|
||
| You can also pass `/p:CheckSdkVulnerabilities=true` to a .NET CLI command, such as `dotnet build`. | ||
|
|
||
| By default, the .NET CLI refreshes a local cache of SDK release metadata in the background at most once every 24 hours under `~/.dotnet/sdk-vulnerability-cache/`. Set [`DOTNET_SDK_VULNERABILITY_CHECK_INTERVAL_HOURS`](../dotnet-environment-variables.md#dotnet_sdk_vulnerability_check_interval_hours) to change the refresh interval. The MSBuild check reads only that cache; it doesn't make network calls during the build. | ||
|
|
||
| ## Suppress the warning | ||
|
|
||
| To suppress the warning without updating the SDK: | ||
|
|
||
| - Add `NETSDK1239` to `NoWarn`: | ||
|
|
||
| ```xml | ||
| <NoWarn>$(NoWarn);NETSDK1239</NoWarn> | ||
| ``` | ||
|
|
||
| - Set `CheckSdkVulnerabilities` to `false` (the default) to turn off NETSDK1238, NETSDK1239, and NETSDK1240. | ||
| - Set the [`DOTNET_SDK_VULNERABILITY_CHECK_DISABLE`](../dotnet-environment-variables.md#dotnet_sdk_vulnerability_check_disable) environment variable to `true`. | ||
|
|
||
| ## See also | ||
|
|
||
| - [NETSDK1238: The current .NET SDK has known vulnerabilities](netsdk1238.md) | ||
| - [NETSDK1240: The current .NET SDK feature band is discontinued](netsdk1240.md) | ||
| - [.NET releases and support](../../releases-and-support.md) | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,51 @@ | ||
| --- | ||
| title: "NETSDK1240: The current .NET SDK feature band is discontinued" | ||
| description: Learn how to resolve build warning NETSDK1240, which reports that the feature band of the .NET SDK that built your project has no newer release. | ||
| ms.topic: error-reference | ||
| ms.date: 05/15/2026 | ||
| ai-usage: ai-assisted | ||
| f1_keywords: | ||
| - NETSDK1240 | ||
| --- | ||
| # NETSDK1240: The current .NET SDK feature band is discontinued | ||
|
|
||
| This warning indicates that the feature band of the .NET SDK used to build your project has no newer release, even though a newer SDK exists in a different feature band on the same major version. The full warning message is similar to the following example: | ||
|
gewarren marked this conversation as resolved.
|
||
|
|
||
| > NETSDK1240: The current .NET SDK (\<version>) has no newer release in its feature band. Update to version \<version>: <https://dotnet.microsoft.com/download> | ||
|
|
||
| A .NET SDK version has the form `<major>.<minor>.<feature-band><patch>` (for example, `8.0.404`, where `4xx` is the feature band). When the recommended servicing path moves to a different feature band, the older band stops receiving updates. To resolve the warning, install the recommended .NET SDK version from <https://dotnet.microsoft.com/download> and update your `global.json` (if present) to select it. | ||
|
|
||
| ## How the check works | ||
|
|
||
| The check is opt-in and only runs when the MSBuild property `CheckSdkVulnerabilities` is set to `true`: | ||
|
|
||
| ```xml | ||
| <Project Sdk="Microsoft.NET.Sdk"> | ||
| <PropertyGroup> | ||
| <CheckSdkVulnerabilities>true</CheckSdkVulnerabilities> | ||
| </PropertyGroup> | ||
| </Project> | ||
| ``` | ||
|
|
||
| You can also pass `/p:CheckSdkVulnerabilities=true` to a .NET CLI command, such as `dotnet build`. | ||
|
|
||
| The .NET CLI refreshes a local cache of SDK release metadata in the background under `~/.dotnet/sdk-vulnerability-cache/`. By default, it refreshes the cache at most once every 24 hours. To change that interval, set [`DOTNET_SDK_VULNERABILITY_CHECK_INTERVAL_HOURS`](../dotnet-environment-variables.md#dotnet_sdk_vulnerability_check_interval_hours). The MSBuild check reads only that cache; it does not make network calls during the build. | ||
|
|
||
| ## Suppress the warning | ||
|
|
||
| To suppress the warning without updating the SDK: | ||
|
|
||
| - Add `NETSDK1240` to `NoWarn`: | ||
|
|
||
| ```xml | ||
| <NoWarn>$(NoWarn);NETSDK1240</NoWarn> | ||
| ``` | ||
|
|
||
| - Set `CheckSdkVulnerabilities` to `false` (the default) to turn off NETSDK1238, NETSDK1239, and NETSDK1240. | ||
| - Set the [`DOTNET_SDK_VULNERABILITY_CHECK_DISABLE`](../dotnet-environment-variables.md#dotnet_sdk_vulnerability_check_disable) environment variable to `true`. | ||
|
|
||
| ## See also | ||
|
|
||
| - [NETSDK1238: The current .NET SDK has known vulnerabilities](netsdk1238.md) | ||
| - [NETSDK1239: The current .NET SDK is end of life](netsdk1239.md) | ||
| - [.NET SDK versioning](../../versions/index.md) | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.