Open
Description
Docs Page URL
https://learn.microsoft.com/en-gb/nuget/concepts/auditing-packages
Description of the Issue
Audit sources are not used by dotnet list package --vulnerable at this time.
https://learn.microsoft.com/en-gb/nuget/concepts/auditing-packages#audit-sources
But this was added in NuGet 6.14 according to the release notes https://learn.microsoft.com/en-us/nuget/release-notes/nuget-6.14
dotnet list package --vulnerable should support auditSources - #13767
And is included in the 9.0.300 SDK as per the same page
(the wording of should is a bit funny, but it stems from the issue title) the PR that implemented it is here NuGet/NuGet.Client#6237
Suggested Fix
Include some info about it being available in 9.0.300+ SDKs
Additional Context
N/A