Blend Developer Guide

Package Audit

  • Page Owner: Not Set
  • Last Reviewed: 2025-10-09

Audit nuget packages to determine if any can be uninstalled and review dependencies in README to verify they are still required.

  • When a transitive dependency contains a critical vulnerability, the latest stable version of that package is sometimes installed as a top-level dependency to address the vulnerability. If the original package that required the dependency is removed, there is no need to keep the dependency and it can be also removed.
  • If site functionality that once required a package is no longer being used, that package should be uninstalled.

For First Audit

This is when there is nothing in the readme or in the .csproj to determine what packages were transitive and were upgraded because of v11y or other reasons.

Step 1 - Initial Setup Packages

  1. Comment out all the Package Reference Items.
  2. Create 3 Item Groups and add comment to each for (Top Level Packages, Transitive - V11y, and Transitive - Various)
  3. Using either the Opti or Umbraco Template .csproj to move the commented out Package into the Top Level Packages area.

Step 2 - Project Specific Packages

  1. Run a rebuild and move the packages needed into the Top Level Packages area.
  2. Repeat until there are no build errors.

Step 3 - V11y Packages

  1. Using Package Manager look at all the vulnerable packages.
  2. Move the vulnerable packages into the Transitive - V11y area.
  3. Repeat for all packages until there are no vulnerable packages.
  4. Update Readme of V11y packages that are updated.

Step 4 - Additional Package Updates

  1. Go through each package that are comment out in the Manage Packages in VS and see if the version of the package is already used.
  2. If the package commented out is newer than the package in transitive then move the package to Transitive - Various area.
  3. If they are the same version then that means the package can be removed from the Top Level and not needed anymore.
  4. Update Readme of Update Packages.

Step 5 - Leftover Packages

  • These packages are either not used or they are but there is no code that interacts with them.
  • These packages are also vary by CMS specific and Project specific.
  • These remaining packages would be best discussed in the next scrum or in the PR having all BE devs approve the PR.