> For the complete documentation index, see [llms.txt](https://docs.snyk.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.snyk.io/supported-languages/supported-languages-list/.net.md). # .NET (C# and VB.NET) {% hint style="info" %} .NET is supported for Snyk Code and Snyk Open Source. {% endhint %} ## .NET for Snyk Code {% hint style="info" %} For .NET with Snyk Code, C# and VB.NET are supported. {% endhint %} ### Supported frameworks and libraries For .NET with Snyk Code, the following frameworks and libraries are supported: * .NET 6.0 - 10.0 * .NET Core * .NET Framework 4.6-4.8.x * Anthropic.SDK * ASP.NET 6.x (C# only) * Azure.AI.OpenAI * Dapper * fastJSON * Google\_GenerativeAI * grpc-dotnet (C# only) * Microsoft.CodeAnalysis.VisualBasic * Mistral.SDK * System.CodeDom.Compiler * Windows Forms ### Supported file formats * For C#, Snyk supports the `.aspx` & `.cs` file formats. * For VB.NET, Snyk supports the `.vb` file format. ### Available features * Reports * Interfile analysis ## .NET for Snyk Open Source {% hint style="info" %} For .NET with Snyk Open Source, Snyk supports C# only. {% endhint %} ### Supported versions For .NET with Snyk Open Source, the following versions are supported: * .NET versions 6, 7 - only the latest SDK version * .NET versions 8, 9, and 10 - all SDK versions * .NET Framework version 4 - using SDK-style projects * All versions of .NET Standard ### Supported package managers and package registries For .NET with Snyk Open Source, NuGet and Paket are supported as package managers and [nuget.org](https://www.nuget.org/) as a package registry. ### Supported file formats * For NuGet: `project.assets.json`, `*.sln`, `packages.config,` `project.json` * For Paket: `paket.dependencies` and `paket.lock` ### Available integrations * SCM import (not available for Paket) * CLI and IDE: test or monitor your app ### Available features For .NET with Snyk Open Source, the following features are available: * Fix PRs (only for NuGet) * License scanning * Reports * (Only for Paket) Test your app's SBOM and packages using `pkg:nuget` PURLs, using the [SBOM test](/developer-tools/snyk-cli/snyk-cli/commands/sbom-test.md) command. {% hint style="warning" %} Snyk does not support `PackageReference` entries without a version attribute. If your Project is missing this attribute, Snyk cannot open a pull request. Ensure you add versions to all `PackageReference` entries. {% endhint %} ### Dependency analysis using the CLI {% hint style="info" %} Snyk does not support `package-lock.json`. Snyk uses the build system to determine which dependencies are installed. {% endhint %} For dependency analysis using the CLI, Snyk must accurately resolve dependencies to identify vulnerabilities in .NET applications. Snyk scans and fixes build and development dependencies in your `*.proj`, `packages.config`, and `project.json` files. If you manage Project dependencies using `PackageReference`, Snyk scans the `obj/project.assets.json` file. Snyk resolves runtime dependencies (or meta-packages) more accurately when the host machine uses a runtime SDK similar to the one used by the server running the application. ### Dependency analysis using SCM integrations Snyk resolves dependencies to identify vulnerabilities in .NET applications. The .NET ecosystem includes multiple dependency levels, including those not visible to developers. By default, Snyk excludes developer dependencies to reduce noise in scan results, since you rarely deploy them to production. To include developer dependencies in NuGet SCM imports, navigate to **Settings** > **Languages** > **.NET**. When scanning through an SCM integration, the methodology varies based on your Project format: * Modern Projects (SDK-style): For modern `.csproj` formats, the scanner utilises the .NET SDK directly to resolve dependencies, resulting in higher accuracy. This also provides the capability of scanning any Project that can be successfully restored by the `dotnet` SDK itself including `Directory.Build.props` files, `global.json`, or Central Package Management (`Directory.Packages.props`). * Legacy Projects (Non-SDK style): For Projects relying on `packages.config`, `project.json`, or XML-style `*.csproj` , `*.vbproj` or `*.fproj` files. The scanner uses static analysis to approximate the dependency graph based on standard NuGet algorithms. To improve accuracy, migrate to the [Universal Broker](/platform-administration/snyk-broker/universal-broker.md) and [enable](/platform-administration/snyk-broker/universal-broker/basic-steps-to-install-and-configure-universal-broker.md#enabling-the-universal-broker-for-enhanced-sca-scanning) it for Open Source Scanning. ### .NET framework package pruning For Snyk Projects targeting .NET 10.0 and later, the Snyk SCM and CLI scanners align with default Microsoft build behavior. By default, Microsoft enables the `RestoreEnablePackagePruning` property for these frameworks. This setting prunes framework-provided package references during the restore operation. Snyk respects your Project configuration. If you set `RestoreEnablePackagePruning` to `false` in your Project file or `Directory.Build.props`, Snyk does not prune these references during the scan. For Projects targeting .NET 10.0 and later, Snyk SCM and CLI scanners align with the default Microsoft build behaviour. By default, Microsoft enables the `RestoreEnablePackagePruning` property for these target frameworks. This setting prunes framework-provided package references during the restore operation. The Improved .NET scanner respects your Project configuration. If you disable this feature by setting the `RestoreEnablePackagePruning` property to `false` either in your Project file or in a `Directory.Build.props` file, Snyk respects this setting and does not prune those references during the scan. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.snyk.io/supported-languages/supported-languages-list/.net.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.