create new project build error #1451

Activity

1. iammukeshm commented on Nov 3, 2026

   

   iammukeshm

   on Nov 3, 2026

   Member

   More actions

   Thanks for reporting this. These aren't build errors in your code. They're NuGet security advisories, which the template turns into errors because it builds with TreatWarningsAsErrors. They were published after the 10.0.0 template went out on NuGet:

   • MessagePack 2.5.301 (GHSA-qhrr-8q5h-9q3h), fixed in 2.5.303
   • Microsoft.AspNetCore.SignalR.Common 10.0.8 (CVE-2026-70159), fixed in 10.0.13
   • Microsoft.OpenApi 2.0.0 (GHSA-v5pm-xwqc-g5wc), fixed in 2.7.5

   main already has all three fixed. What's missing is a new template release on NuGet, and I'm preparing that along with a full dependency upgrade.

   Until then, you can fix your generated project yourself. Open src/Directory.Packages.props and set MessagePack to 2.5.305, set every 10.0.x Microsoft package to 10.0.13, and add these pins next to the others:

   <PackageVersion Include="Microsoft.OpenApi" Version="2.12.2" />
   <PackageVersion Include="System.Security.Cryptography.Xml" Version="10.0.13" />
   <PackageVersion Include="System.Security.Cryptography.Pkcs" Version="10.0.13" />

   Those are the versions main builds with today, so the current Directory.Packages.props on main is a good reference to compare against.

   If you just need to get unblocked quickly, <NuGetAuditMode>direct</NuGetAuditMode> in Directory.Build.props also works. I'd only use it short term, though, because it hides real transitive advisories.

   I'll leave this open until the new template version is on NuGet.
2. iammukeshm commented on Nov 3, 2026

   

   iammukeshm

   on Nov 3, 2026

   Member

   More actions

   Quick update: main now has the whole stack on the latest stable versions (#1460, #1461). I packed the template from main and scaffolded fresh projects, and they build with zero audit errors. Once the 10.0.1 template is published to NuGet, dotnet new install FullStackHero.NET.StarterKit will give you a project that builds out of the box. I'll close this when it's out.