[Breaking change]: NuGet audit sources no longer allow insecure http by default

[zivkan]

Description

NuGetAudit will fail if an auditSource defined in the nuget.config, uses http:// (as opposed to https://), without also using allowInsecureConnections="true". This aligns it with package sources. The change starts with the .NET 10.0.400 SDK.

Version

.NET 10

Previous behavior

If an auditSource used insecure http://, NuGetAudit would continue without warnings

New behavior

NuGet will raise error NU1302, instructing you to update the URL, or to set allowInsecureConnections to true in your nuget.config file.

Type of breaking change

• Binary incompatible: Existing binaries might encounter a breaking change in behavior, such as failure to load or execute, and if so, require recompilation.
• Source incompatible: When recompiled using the new SDK or component or to target the new runtime, existing source code might require source changes to compile successfully.
• Behavioral change: Existing binaries might behave differently at run time.

Reason for change

Follow best practices in using https everywhere, and align with other NuGet features that already enforce it.

Recommended action

Use audit sources that support https, such as https://data.nuget.org/v3/index.json.

Feature area

SDK

Affected APIs

No response