More sustainable solution for recurring NuGet problems

Hi!

Several weeks ago, there was an issue where suddenly ImageMagick version 14.0.0 was marked as having a critical security vulnerability online, which broke our builds across the board. (Someone posted about the issue here: [NuGet issues when moving to VS [Content removed] ).

Today, in the middle of trying to build submission versions of one of our games, builds broke again, because the latest vulnerability was detected by NuGet, as outlined here: [Tech Note: Errors when compiling the Unreal Automation Tool in [Content removed]

This is incredibly annoying, especially when at the eleventh hour in the middle of trying to ship a game, suddenly builds break left right and center. While I’m sure the critical vulnerability is completely debilitating to ImageMagick and the AutomationTool, I’m not sure the (insert random console here) build of our game would suffer a lot if we were able to build with the previous ImageMagick version for a bit longer.

Is there a more permanent solution to not having to benefit from those online vulnerability checks? I’m certain the old ImageMagick would work just fine until we update Unreal Engine again.

Thank you for any hints

Ciao, Daniel!

Hi Daniel,

We have turned off the validation of NuGet package in the Main stream so things don’t break anymore. We now have a special task that does run the validation so that we can still know that some packages should be avoided. You can grab CL#45240840 or this GH commit: https://github.com/EpicGames/UnrealEngine/commit/7af724cdfd8121bcf2a5e981c78ed383e79e7604

Regards,

Martin

Much appreciated, thank you! :person_bowing: