[erikdarlingdata]

v1.31.0's release run (39448831126) raised SSMS restore failed the NuGet audit, quoting the csc command line. It was a false alarm.

• Pin vulnerable transitive packages and audit them in CI (#650) #654 put NU1903;NU1904 in WarningsAsErrors (root Directory.Build.props), so MSBuild passes them to csc as /warnaserror+:...NU1903,NU1904.
• The release step searched the msbuild log for the bare codes, so it matched that compiler line. It would do so on every release.
• The step log has no real warning NU190x: or error NU190x: line.

The pattern is now (warning|error) NU190[34]:. Checked with PowerShell Select-String against the downloaded step log: the old pattern hits 2 non-echo lines, the new one hits 0. On sample lines, the new one matches ... : warning NU1903: Package ... and ... : error NU1904: ..., and skips csc.exe /warnaserror+:NU1605,NU1903,NU1904.

One file, three lines (two of them a comment). The release workflow runs only on a dev -> main merge, so the next release is its first run.

🤖 Generated with Claude Code

https://claude.ai/code/session_01UoaQ2xKMpZEXvm4HncT8ND

[claude]

Reviewed: the narrowed pattern (warning|error) NU190[34]: matches MSBuild's real diagnostic format (path(l,c): warning NU1903: ...) and skips the /warnaserror+:...NU1903,NU1904 csc echo, so the false alarm is fixed. This is a CI-only change with no version, NoWarn, T-SQL or Core/Web impact, and I found nothing to flag.