<![CDATA[Can I create a policy exception for a vulnerable package]]>ProGet has identified a package that has 2 high risk vulnerabilities and is blocking it. We have a situation where we nee to allow that package to be downloaded while we perform an upgrade to one of our systems. How can I allow that package to be downloaded for a short time? It seems I need to Add a Policy Exception, but the only available categories are License Rules, Unlisted Rule, Aged Package Rule, Deprecation Rule, Latest Patch Rule, and Recently Published Rule. I don't see anything to override the vulnerability.

What is the recommended way to accomplish this?

]]>https://forums.inedo.com/topic/5869/can-i-create-a-policy-exception-for-a-vulnerable-packageRSS for NodeThu, 12 Nov 2026 13:12:39 GMTWed, 11 Nov 2026 16:21:18 GMT60<![CDATA[Reply to Can I create a policy exception for a vulnerable package on Thu, 12 Nov 2026 07:54:13 GMT]]>Hi @bobmaurer ,

There are a couple ways to handle this:

  • Overriding the Assessment on the vulnerability; this is probably the best way to do it
  • Override the Compliance status on the package itself by doing Set Package Status

But if it's temporary, then it doesn't really matter. They will both work.

Thanks,
Alana

]]>https://forums.inedo.com/post/20195https://forums.inedo.com/post/20195Thu, 12 Nov 2026 07:54:13 GMT