GitHub Copilot in Visual Studio: Fix NuGet Vulnerabilities from the Error List
GitHub CopilotNuGet Audit warnings in the Visual Studio Error List now include a fixer action that opens GitHub Copilot Chat in agent mode and asks Copilot to fix the vulnerable packages using the NuGet MCP server. Developers can go from a vulnerability warning to a fix without manually hunting for safe versions. The feature requires signing in to GitHub Copilot and enabling the NuGet MCP server from the Copilot Chat tools menu.
Key Takeaways
- NuGet Audit warnings in the Error List now carry a fixer action powered by GitHub Copilot.
- The action opens Copilot Chat in agent mode and asks Copilot to fix the vulnerable packages.
- Copilot uses the NuGet MCP server to analyze dependencies and update packages with known vulnerabilities.
- Developers must be signed in to GitHub Copilot and enable the NuGet MCP server from the Copilot Chat tools menu.
- The feature ships in the September 2026 Visual Studio update and is available on all Copilot plans.
- It builds on earlier Fix with GitHub Copilot support for NuGet vulnerabilities from Solution Explorer.
Sources & Mentions
2 external resources covering this update
From Vulnerability Warning to Fix in One Step
GitHub added a fixer action to NuGet Audit warnings shown in the Visual Studio Error List. When Visual Studio flags a vulnerable package, the warning now offers an action that opens GitHub Copilot Chat in agent mode and asks Copilot to fix the vulnerable packages. Copilot does the work through the NuGet MCP server, which analyzes a project's dependencies and proposes updates for packages with known vulnerabilities. The change turns a warning that previously required manual research into an action the developer can start directly from the Error List.
What Developers Need to Enable
The fixer requires that the developer is signed in to GitHub Copilot and that the NuGet MCP server is enabled from the Copilot Chat tools menu. It shipped in the September 2026 update for GitHub Copilot in Visual Studio, which is available on all Copilot plans, including Free, Student, Pro, Pro+, Max, Business and Enterprise.
Why It Matters
Dependency vulnerabilities are easy to leave in place because fixing them means finding the affected packages, choosing safe versions and checking that nothing breaks. Putting the fix behind the warning itself shortens that path, and keeping it in agent mode means Copilot can take the multi-step work of updating dependencies rather than offering a single suggestion.