dotnet
Vulnerability doc should cover vulnerabilities of NuGet pkgs referenced by app
There's a gap in the scenarios covered by the Container Vulnerability Workflow doc. If the container image contains a .NET app where that app references NuGet packages which are vulnerable, it will likely be reported by a vulnerability scanner. But following the steps of the workflow document will lead them to the point of logging an issue at https://github.com/dotnet/dotnet-docker which is not what we want since the cause of the vulnerability is the application itself. The document needs to be updated to account for this scenario.
An additional step in the workflow would be to verify that the latest version of the affected NuGet package is being referenced.
[Triage] Moving to post-release since we have not received many issues about this type of vulnerability yet.
