From c770bbffcfd19e786cdf81f5bc7b5596cdd650c1 Mon Sep 17 00:00:00 2001
From: Oliver Kieselbach <oliver.kieselbach@outlook.com>
Date: Thu, 13 Aug 2026 09:49:27 +0200
Subject: [PATCH] build: keep NuGet audit advisories as warnings in the warning
 freeze

A CVE published against an already-referenced package must not block an
unrelated hotfix deploy; advisories are handled by bumping the package.
WarningsNotAsErrors NU1901-NU1904 - everything else stays fatal.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 Directory.Build.props | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/Directory.Build.props b/Directory.Build.props
index 41fe96ac..b516ba81 100644
--- a/Directory.Build.props
+++ b/Directory.Build.props
@@ -1,11 +1,12 @@
 <Project>
   <!-- Warning freeze (2026-08-13, backlog cleared to zero): every .NET build in this repo
        must stay warning-free. Compiler, MSBuild and NuGet restore warnings are all fatal.
-       Deliberately includes NuGet audit advisories (NU1901-NU1904): a newly published CVE
-       against a referenced package fails the build until it is bumped or mitigated
-       (fail-closed, same philosophy as the ops alert chain). -->
+       Exception: NuGet audit advisories (NU1901-NU1904) stay warnings — a CVE published
+       against an already-referenced package must not block an unrelated hotfix deploy;
+       advisories are handled by bumping the package, not by failing the build. -->
   <PropertyGroup>
     <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
     <MSBuildTreatWarningsAsErrors>true</MSBuildTreatWarningsAsErrors>
+    <WarningsNotAsErrors>NU1901;NU1902;NU1903;NU1904</WarningsNotAsErrors>
   </PropertyGroup>
 </Project>