From a7ff8d907ed563d032bd1a2b85ba7b0f28700e77 Mon Sep 17 00:00:00 2001
From: William Storey <wstorey@maxmind.com>
Date: Fri, 24 Apr 2026 10:28:12 -0700
Subject: [PATCH] Don't fail CI builds on NuGet audit advisories

Set WarningsNotAsErrors for NU1901-NU1904 when building in CI (CI=true).
This keeps TreatWarningsAsErrors strict locally so developers still
catch issues, but avoids every PR being blocked by a newly-published
advisory on a dependency until Dependabot can merge an upgrade. The
advisory still appears in the build output for visibility.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 MaxMind.MinFraud.UnitTest/MaxMind.MinFraud.UnitTest.csproj | 4 ++++
 MaxMind.MinFraud/MaxMind.MinFraud.csproj                   | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/MaxMind.MinFraud.UnitTest/MaxMind.MinFraud.UnitTest.csproj b/MaxMind.MinFraud.UnitTest/MaxMind.MinFraud.UnitTest.csproj
index cea59da8..88c117ec 100644
--- a/MaxMind.MinFraud.UnitTest/MaxMind.MinFraud.UnitTest.csproj
+++ b/MaxMind.MinFraud.UnitTest/MaxMind.MinFraud.UnitTest.csproj
@@ -24,6 +24,10 @@
     <EnforceCodeStyleInBuild>true</EnforceCodeStyleInBuild>
     <EnableNETAnalyzers>true</EnableNETAnalyzers>
     <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+    <!-- In CI, don't fail the build on NuGet audit advisories (NU1901-NU1905).
+         Advisories still appear in build output, and Dependabot handles the
+         actual fix. Local builds keep the strict behavior. -->
+    <WarningsNotAsErrors Condition="'$(CI)' == 'true'">$(WarningsNotAsErrors);NU1901;NU1902;NU1903;NU1904;NU1905</WarningsNotAsErrors>
     <EnableMicrosoftTestingPlatform>true</EnableMicrosoftTestingPlatform>
   </PropertyGroup>
 
diff --git a/MaxMind.MinFraud/MaxMind.MinFraud.csproj b/MaxMind.MinFraud/MaxMind.MinFraud.csproj
index 4fa26a23..e22a0508 100644
--- a/MaxMind.MinFraud/MaxMind.MinFraud.csproj
+++ b/MaxMind.MinFraud/MaxMind.MinFraud.csproj
@@ -30,6 +30,10 @@
     <EnforceCodeStyleInBuild>true</EnforceCodeStyleInBuild>
     <EnableNETAnalyzers>true</EnableNETAnalyzers>
     <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+    <!-- In CI, don't fail the build on NuGet audit advisories (NU1901-NU1905).
+         Advisories still appear in build output, and Dependabot handles the
+         actual fix. Local builds keep the strict behavior. -->
+    <WarningsNotAsErrors Condition="'$(CI)' == 'true'">$(WarningsNotAsErrors);NU1901;NU1902;NU1903;NU1904;NU1905</WarningsNotAsErrors>
   </PropertyGroup>
 
   <ItemGroup>