NuGet Product(s) Affected

dotnet.exe

Current Behavior

dotnet list package --vulnerable was created before NuGetAudit or auditSources. It still only reports vulnerabilities when the source's package metadata ("registration") endpoint reports the vulnerability. When a project has a lot of packages (especially transitive packages and `--include-transitive is used), the command can take a long time while many HTTP requests are made.

Desired Behavior

If NuGetAudit reports a vulnerability during restore, then dotnet list package --vulnerable --include-transitive should report it too, even if none of the package sources have vulnerability data, but an audit source is defined.

Additional Context

No response