NuGet audits both formats, but not identically. Audit for PackageReference arrived in NuGet 6.8, and for packages.config in NuGet 6.10. The direct versus all mode setting does not apply to packages.config, and the default mode depends on your target framework.
What the documentation says
The NuGet auditing page gives this history: the vulnerable listing of dotnet list package from NuGet 5.9, NuGetAudit for PackageReference from 6.8, and NuGetAudit for packages.config from 6.10. Suppression support followed in 6.11 for PackageReference and 6.12 for packages.config.
NuGetAuditMode takes direct or all. The page says it is not applicable to packages.config projects. The default is all when a project targets net10.0 or higher, and direct otherwise. For a multi-targeting project, if any target selects all, audit uses all for every target.
The vulnerability data for nuget.org comes from the GitHub Advisory Database, and audit sources are set in NuGet.Config.
Where gaps appear
| Gap | Effect |
|---|---|
| Older tooling than 6.8 or 6.10 | No audit warnings at all |
| Default mode is direct | Vulnerable transitive packages are not reported |
| Audit source returns no data | Warning NU1905 is raised |
| Source unreachable | Warning NU1900 is raised |
| Restore skipped for an up to date project | That project may not be audited in that run |
A quiet restore is not proof of a clean project. The documentation itself says no findings means none were found at the present moment, and advisory data can change at any time.
How to confirm everything was audited
- Check the SDK and NuGet versions on every build agent, not just developer machines.
- Set NuGetAuditMode to all where you can, and note that packages.config projects follow their own behavior.
- Treat NU1900 and NU1905 as signals that coverage failed, not as noise.
- Use the restore output properties described in the documentation, RestoreProjectCount and RestoreProjectsAuditedCount, to fail CI if a project was not audited. They are not available with static graph restore.
- Run the dotnet list package command with the vulnerable and include transitive options, because transitive packages are not included by default there.
Prefer a dedicated audit pipeline so new advisories do not block unrelated fixes at awkward times, as the documentation suggests.
See also dotnet central package management and vulnerability scans.
Safeguard's SBOM and dependency scanning gives one inventory across ecosystems, with a free scan at https://gold.safeguard.sh/scan.
Quick check
Does NuGetAuditMode work for packages.config?
No. The documentation says it is not applicable to packages.config projects.
What does warning NU1905 mean?
An audit source does not provide a vulnerability database, so that source could not be used to check packages.
Sources
Last reviewed: 19 October 2026.
