Hi @richard-allen_8963 , I'm afraid I'm really not sure how different versions the NuGet client tools behave in different scenarios... just really how ProGet works in implementing the Vulnerabilities information on the NuGet API. This API is used by Visual Studio, and in our testing, they show up as we expected -- so if you're not seeing the desired behavior, that's where you'd want to look. Using something like Fiddler, you can see what's being called. I do know there is an older, NuGet.org-only API that the tools may be calling. But we only implement the one I mentioned above. Best, Alana