Dav is a free PowerShell module that reads a .NET assembly without running it and reports risky API calls, known vulnerable dependencies, a too-small version bump and circular dependencies. This article shows how to install it, read its results and fail a CI build on the right findings.

Most checks on a .NET assembly happen late: a security review before release, or a customer who finds the breaking change. Dav moves four of them into the build. It is a free, open-source PowerShell module that reads the metadata and IL of an assembly, without running it, and tells you:

  • which risky APIs it calls,
  • which of its dependencies have known vulnerabilities,
  • whether the version number covers the API changes between two builds,
  • which methods call each other in a circle.

Risky APIs, vulnerabilities and a too-small version bump fail the command. Circular dependencies only warn. This article shows how to install Dav, how to read its output, and how to use it in a pipeline.

Dav is part of the .NET Assembly Visualizer project: https://github.com/Aizaz-hash/dotnet-Assembly-Visualizer?tab=readme-ov-file

What you need

  • PowerShell 7 (Windows, Linux or macOS) or Windows PowerShell 5.1.
  • A compiled .NET assembly (.dll or .exe). Any .NET assembly can be read; Dav does not need the SDK.
  • Internet access only for the vulnerability check (package names and versions are sent to OSV.dev and NuGet.org; nothing else).