diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md new file mode 100644 index 000000000..344d2e2ad --- /dev/null +++ b/.github/copilot-instructions.md @@ -0,0 +1,56 @@ +# .NET Documentation Guidelines + +## Disclosure + +For any Markdown files generated by AI, always disclose that they were created with the assistance of AI. Add the following frontmatter key/value pair: + +```markdown +ai-usage: ai-generated +``` + +## Terminology + +Unless otherwise specified, all .NET content refers to modern .NET (not .NET Framework). + +## Writing Style + +Follow [Microsoft Writing Style Guide](https://learn.microsoft.com/en-us/style-guide/welcome/) with these specifics: + +### Voice and Tone + +- Active voice, second person addressing reader directly. +- Conversational tone with contractions. +- Present tense for instructions/descriptions. +- Imperative mood for instructions ("Call the method" not "You should call the method"). +- Use "might" instead of "may" for possibility. +- Use "can" instead of "may" for permissible actions. +- Avoid "we"/"our" referring to documentation authors or product teams. + +### Structure and Format + +- Sentence case headings (no gerunds in titles). +- Be concise, break up long sentences. +- Oxford comma in lists. +- Use bullets for unordered lists. +- Number all ordered list items as "1." (not sequential numbering like "1.", "2.", "3.", etc.) +- Ordered and unordered lists should use complete sentences with proper punctuation, ending with a period if it's more than three words. +- Avoid "etc." or "and so on" - provide complete lists or use "for example". +- Use "for example" instead of "e.g.". +- Use "that is" instead of "i.e.". +- No consecutive headings without content between them. + +### Formatting Conventions + +- **Bold** for UI elements. +- `Code style` for file names, folders, custom types, non-localizable text. +- Raw URLs in angle brackets. +- Use relative links for files in this repo. +- Remove `https://learn.microsoft.com/en-us` from learn.microsoft.com links. + +## File Naming + +New Markdown files: lowercase with hyphens, omit filler words (the, a, etc.). + +## Special Cases + +- When you (Copilot) are assigned an issue in GitHub, after you've completed your work and the workflows (status checks) have run, check to make sure there are no build warnings under the OpenPublishing.Build status check. If there are, open the build report (under View Details) and resolve any build warnings you introduced. diff --git a/.github/workflows/stale-issues.yml b/.github/workflows/stale-issues.yml deleted file mode 100644 index ff1f98033..000000000 --- a/.github/workflows/stale-issues.yml +++ /dev/null @@ -1,34 +0,0 @@ -# See https://github.com/marketplace/actions/close-stale-issues -# Mark issues as stale if they're open with no activity for 1 day -# Closed marked issues after 3 days. - -name: close-stale-issues - -on: - schedule: - - cron: "0 0 * * 4" - workflow_dispatch: - -permissions: - contents: read - -jobs: - stale: - permissions: - issues: write # for actions/stale to close stale issues - pull-requests: write # for actions/stale to close stale PRs - runs-on: ubuntu-latest - steps: - - uses: actions/stale@v9 - with: - repo-token: ${{ secrets.GITHUB_TOKEN }} - stale-issue-message: 'Thanks for sharing your feedback. We apologize for our delayed response. Due to the sheer volume of feedback in our repo, we have decided to prioritize the newest issues and are automatically closing our oldest issues with an Issues bot. If you believe your feedback is still actionable, then either respond directly in this issue or open a new documentation issue and we’ll review. If no activity occurs in the next 14 days, this issue will be closed.' - close-issue-message: 'This issue is closed. If you feel this issue has been closed in error, please submit a new comment on the issue, and we will review it.' - stale-issue-label: 'stale' - close-issue-label: 'auto-close' - exempt-issue-labels: 'exempt,P1' - remove-stale-when-updated: true - days-before-close: 14 - days-before-issue-stale: 90 - days-before-pr-stale: -1 - operations-per-run: 500 diff --git a/.openpublishing.build.ps1 b/.openpublishing.build.ps1 deleted file mode 100644 index aadef7620..000000000 --- a/.openpublishing.build.ps1 +++ /dev/null @@ -1,17 +0,0 @@ -param( - [string]$buildCorePowershellUrl = "https://opbuildstorageprod.blob.core.windows.net/opps1container/.openpublishing.buildcore.ps1", - [string]$parameters -) -# Main -$errorActionPreference = 'Stop' - -# Step-1: Download buildcore script to local -echo "download build core script to local with source url: $buildCorePowershellUrl" -$repositoryRoot = Split-Path -Parent $MyInvocation.MyCommand.Definition -$buildCorePowershellDestination = "$repositoryRoot\.openpublishing.buildcore.ps1" -Invoke-WebRequest $buildCorePowershellUrl -OutFile "$buildCorePowershellDestination" - -# Step-2: Run build core -echo "run build core script with parameters: $parameters" -& "$buildCorePowershellDestination" "$parameters" -exit $LASTEXITCODE diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 4ae34efc7..be80d09e9 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -99,7 +99,7 @@ "source_path": "docs/Quickstart/Create-and-publish-a-package.md", "redirect_url": "/nuget/quickstart/create-and-publish-a-package-using-visual-studio", "redirect_document_id": false - }, + }, { "source_path": "docs/Quickstart/Use-a-Package.md", "redirect_url": "/nuget/quickstart/install-and-use-a-package-in-visual-studio", @@ -384,6 +384,11 @@ "source_path": "docs/reference/errors-and-warnings/NU1904.md", "redirect_url": "/nuget/reference/errors-and-warnings/NU1901-NU1904", "redirect_document_id": false + }, + { + "source_path": "docs/guides/create-packages-for-xamarin.md", + "redirect_url": "/nuget", + "redirect_document_id": false } ] } diff --git a/docs/TOC.md b/docs/TOC.md index 53461d34d..a49bb6178 100644 --- a/docs/TOC.md +++ b/docs/TOC.md @@ -17,6 +17,8 @@ ### [nuget.exe CLI](consume-packages/install-use-packages-nuget-cli.md) ### [Package Manager Console (PowerShell)](consume-packages/install-use-packages-powershell.md) ## Configure NuGet +### [Visual Studio options](consume-packages/nuget-visual-studio-options.md) +### [NuGet HTTPS Everywhere](consume-packages/nuget-https-everywhere.md) ### Package restore options #### [Restore packages](consume-packages/package-restore.md) #### [Troubleshooting](consume-packages/package-restore-troubleshooting.md) @@ -55,7 +57,6 @@ ### [Create a native package](guides/native-packages.md) ### [Create UI controls as a NuGet package](guides/create-UI-controls.md) ### [Create an analyzer as a NuGet package](guides/analyzers-conventions.md) -### [Create a package for Xamarin with Visual Studio 2017 or 2019](guides/create-packages-for-xamarin.md) ### [Create a package with COM interop assemblies](create-packages/author-packages-with-COM-interop-assemblies.md) ## Sign packages ### [Sign a package](create-packages/sign-a-package.md) @@ -78,6 +79,8 @@ ## [Best practices for a secure software supply chain](concepts/Security-Best-Practices.md) ## [MSBuild .props and .targets](concepts/MSBuild-props-and-targets.md) ## [Troubleshooting Installed Packages](concepts/troubleshooting-installed-packages.md) +## [MCP servers in NuGet packages](concepts/nuget-mcp.md) +## [Configuring the NuGet MCP Server](concepts/NuGet-MCP-Server.md) # Reference ## [.nuspec](reference/nuspec.md) ## [nuget.config file](reference/nuget-config-file.md) @@ -128,6 +131,7 @@ #### [Package metadata](api/registration-base-url-resource.md) #### [Push and delete](api/package-publish-resource.md) #### [Push symbol packages](api/symbol-package-publish-resource.md) +#### [README URI](api/readme-template-resource.md) #### [Report abuse URL](api/report-abuse-resource.md) #### [Repository signatures](api/repository-signatures-resource.md) #### [Search](api/search-query-service-resource.md) @@ -153,6 +157,7 @@ ### [NU1011](reference/errors-and-warnings/NU1011.md) ### [NU1012](reference/errors-and-warnings/NU1012.md) ### [NU1014](reference/errors-and-warnings/NU1014.md) +### [NU1015](reference/errors-and-warnings/NU1015.md) ### [NU1100](reference/errors-and-warnings/NU1100.md) ### [NU1101](reference/errors-and-warnings/NU1101.md) ### [NU1102](reference/errors-and-warnings/NU1102.md) @@ -172,6 +177,7 @@ ### [NU1212](reference/errors-and-warnings/NU1212.md) ### [NU1213](reference/errors-and-warnings/NU1213.md) ### [NU1301](reference/errors-and-warnings/NU1301.md) +### [NU1302](reference/errors-and-warnings/NU1302.md) ### [NU1401](reference/errors-and-warnings/NU1401.md) ### [NU1402](reference/errors-and-warnings/NU1402.md) ### [NU1403](reference/errors-and-warnings/NU1403.md) @@ -182,6 +188,11 @@ ### [NU1504](reference/errors-and-warnings/NU1504.md) ### [NU1505](reference/errors-and-warnings/NU1505.md) ### [NU1506](reference/errors-and-warnings/NU1506.md) +### [NU1507](reference/errors-and-warnings/NU1507.md) +### [NU1508](reference/errors-and-warnings/NU1508.md) +### [NU1509](reference/errors-and-warnings/NU1509.md) +### [NU1510](reference/errors-and-warnings/NU1510.md) +### [NU1511](reference/errors-and-warnings/NU1511.md) ### [NU1601](reference/errors-and-warnings/NU1601.md) ### [NU1602](reference/errors-and-warnings/NU1602.md) ### [NU1603](reference/errors-and-warnings/NU1603.md) @@ -189,6 +200,7 @@ ### [NU1605](reference/errors-and-warnings/NU1605.md) ### [NU1608](reference/errors-and-warnings/NU1608.md) ### [NU1701](reference/errors-and-warnings/NU1701.md) +### [NU1702](reference/errors-and-warnings/NU1702.md) ### [NU1703](reference/errors-and-warnings/NU1703.md) ### [NU1900](reference/errors-and-warnings/NU1900.md) ### [NU1901](reference/errors-and-warnings/NU1901-NU1904.md) @@ -240,6 +252,7 @@ ### [NU3038](reference/errors-and-warnings/NU3038.md) ### [NU3040](reference/errors-and-warnings/NU3040.md) ### [NU3042](reference/errors-and-warnings/NU3042.md) +### [NU3043](reference/errors-and-warnings/NU3043.md) ### [NU5000](reference/errors-and-warnings/NU5000.md) ### [NU5001](reference/errors-and-warnings/NU5001.md) ### [NU5002](reference/errors-and-warnings/NU5002.md) @@ -339,6 +352,10 @@ ### [Known Issues](release-notes/known-issues.md) ### NuGet 6.x +#### [NuGet 6.14](release-notes/NuGet-6.14.md) +#### [NuGet 6.13](release-notes/NuGet-6.13.md) +#### [NuGet 6.12](release-notes/NuGet-6.12.md) +#### [NuGet 6.11](release-notes/NuGet-6.11.md) #### [NuGet 6.10](release-notes/NuGet-6.10.md) #### [NuGet 6.9](release-notes/NuGet-6.9.md) #### [NuGet 6.8](release-notes/NuGet-6.8.md) diff --git a/docs/api/NuGet-Protocols.md b/docs/api/NuGet-Protocols.md index 0a027b5c2..ab00ae0cd 100644 --- a/docs/api/NuGet-Protocols.md +++ b/docs/api/NuGet-Protocols.md @@ -4,7 +4,7 @@ description: The evolving nuget.org protocols to interact with NuGet clients. author: anangaur ms.author: anangaur ms.date: 01/21/2021 -ms.topic: conceptual +ms.topic: article ms.reviewer: kraigb --- diff --git a/docs/api/implementation-guide.md b/docs/api/implementation-guide.md index fdf9e7696..6bc08aa28 100644 --- a/docs/api/implementation-guide.md +++ b/docs/api/implementation-guide.md @@ -4,7 +4,7 @@ description: Guidelines and recommendations to anyone implementing the NuGet Ser author: zivkan ms.author: zivkan ms.date: 07/29/2023 -ms.topic: conceptual +ms.topic: article --- # NuGet Server Implementation Guide @@ -35,6 +35,7 @@ To assist authors of existing NuGet repositories keep up to date with NuGet's ne ||Added `packageTypes` query parameter to `SearchQueryService` requests| |2021|[Embedded readme](#embedded-files)| |2023|[PreAuthenticate authenticated requests](#url-structure-for-authenticated-feeds)
[`VulnerabilityInfo` resource](#known-vulnerabilities-database-vulnerabilityinfo)| +|2025|[Enable embedded README downloads](#enable-embedded-readme-downloads)| ## Owner field @@ -105,9 +106,15 @@ Nuget.org provides vulnerability data for all GitHub reviewed advisories from th If your package repository is hosting first-party packages, and you would like to provide vulnerability information to customers using your own feed, but don't yet have any disclosed package vulnerabilities, you should provide a [vulnerability index](./vulnerability-info.md#vulnerability-index) with one or more [vulnerability pages](./vulnerability-info.md#vulnerability-page) whose contents are an empty JSON array (`[]`). -If your package repository is intended to be used by apps as the default repository (instead of nuget.org), you can use nuget.org's vulnerability data. -One option is to use nuget.org's vulnerability index URL in your service index. -Another option is to periodically check nuget.org's `VulnerabilityInfo` index, and download any changed pages to mirror locally. +#### Reusing nuget.org's vulnerability data + +NuGet does not require that resources in the [service index](./service-index.md), or [the vulnerability index](./vulnerability-info.md#vulnerability-index), must be on the same server as the service index itself. +However, there are several reasons why some companies choose to block nuget.org at the firewall, or have on-prem feeds on a disconnected network. +To avoid connectivity issues, we recommend serving vulnerability data from your own web app, so that NuGet clients only make HTTP connections to the host the feed is installed on. + +✔️ DO cache or proxy the vulnerability pages in your own web app + +❌ DO NOT advertise api.nuget.org in your service index or vulnerability index without a configuration to turn this off. ## `packageTypes` search query @@ -140,3 +147,7 @@ In this case, every request to the service index will have additional latency, d While NuGet's V3 API was designed to work on a static file server, the search resource is the exception that always requires a dynamic web service to process requests. If you wish to host search, or indeed any other NuGet API resource, on different servers, in order to benefit from `HttpClientHandler`'s `PreAuthenticate`, you will need to use a reverse proxy to ensure all customer facing URLs in the service index meet the "same or subdirectory" rule. + +## Enable embedded README downloads + +A [new resource](./readme-template-resource.md) was documented for constructing a URL that can be used to download a README for a given package. This will allow client, like the Package Management UI in VS, to display the embedded README for packages which haven't been previously installed by the user. The client will construct this URL and attempt to download the README, using the response to the request to determine if a README is available. This means servers should expect multiple requests to the constructed endpoint as users navigate the PM UI. diff --git a/docs/api/overview.md b/docs/api/overview.md index 2d15e8766..ecf2fd22c 100644 --- a/docs/api/overview.md +++ b/docs/api/overview.md @@ -61,6 +61,7 @@ Resource name | Required [PackageBaseAddress](package-base-address-resource.md) | yes | Get package content (.nupkg). [PackageDetailsUriTemplate](package-details-template-resource.md) | no | Construct a URL to access a package details web page. [PackagePublish](package-publish-resource.md) | yes | Push and delete (or unlist) packages. +[ReadmeUriTemplate](readme-template-resource.md) | no | Construct a URL to access a package's README. [RegistrationsBaseUrl](registration-base-url-resource.md) | yes | Get package metadata. [ReportAbuseUriTemplate](report-abuse-resource.md) | no | Construct a URL to access a report abuse web page. [RepositorySignatures](repository-signatures-resource.md) | no | Get certificates used for repository signing. diff --git a/docs/api/package-base-address-resource.md b/docs/api/package-base-address-resource.md index f2bc08624..56416a5d6 100644 --- a/docs/api/package-base-address-resource.md +++ b/docs/api/package-base-address-resource.md @@ -36,9 +36,9 @@ All URLs found in the package content resource support the HTTP methods `GET` an ## Enumerate package versions -If the client knows a package ID and wants to discover which package versions the package source has available, the -client can construct a predictable URL to enumerate all package versions. This list is meant to be a "directory -listing" for the package content API mentioned below. +If the client knows a package ID and wants to discover which package versions the package source has available, the client can construct a predictable URL to enumerate all package versions. +Every version listed in this list must be available for download. +This list is meant to be a "directory listing" for the package content API mentioned below. > [!Note] > This list contains both listed and unlisted package versions. diff --git a/docs/api/readme-template-resource.md b/docs/api/readme-template-resource.md new file mode 100644 index 000000000..565789ea7 --- /dev/null +++ b/docs/api/readme-template-resource.md @@ -0,0 +1,62 @@ +--- +title: README Uri Template, NuGet API +description: The README uri template allows clients to download the readme for a package, if available. +author: jgonz120 +ms.author: jongonza +ms.date: 1/6/2025 +ms.topic: reference +ms.reviewer: +--- + +# README Uri Template + +It is possible for a client to build a URL that can be used to download a README for a specific package. +This will enable the clients to render the package's README without downloading the entire package. + +The resource used for building this URL is the `ReadmeUriTemplate` resource found in the +[service index](service-index.md). + +## Versioning + +The following `@type` values are used: + +@type value | Notes +--------------------------------- | ----- +ReadmeUriTemplate/6.13.0 | The initial release + +## URL template + +The URL for the following API is the value of the `@id` property associated with one of the aforementioned +resource `@type` values. + +## HTTP methods + +The constructed URL must support the HTTP method `GET` + +## Construct the URL + +Given a known package ID and version, the client implementation can construct a URL to download the README. + +The value of the `@id` is a URL string containing any of the following placeholder tokens: + +### URL placeholders + +Name | Type | Required | Notes +----------- | ------- | -------- | ----- +`{lower_id}` | string | yes | The package ID, lowercased +`{lower_version}` | string | yes | The package version, lowercased + +Both `lower_id` and `lower_version` are lowercased using the rules implemented by .NET's +[`System.String.ToLowerInvariant()`](/dotnet/api/system.string.tolowerinvariant?view=netstandard-2.0#System_String_ToLowerInvariant&preserve-view=true) +method. + +The `lower_version` is the desired package version normalized using NuGet's version +[normalization rules](../concepts/package-versioning.md#normalized-version-numbers). This means that build metadata +that is allowed by the SemVer 2.0.0 specification must be excluded in this case. + +### Response body + +If the package has a readme, a 200 status code is returned. The response body will be the readme +content itself. + +If the package does not have a readme, a 404 status code is returned. diff --git a/docs/api/service-index.md b/docs/api/service-index.md index faacd9351..369bdbc16 100644 --- a/docs/api/service-index.md +++ b/docs/api/service-index.md @@ -65,6 +65,10 @@ There is no requirement that each resource has a unique `@id` or `@type`. It is determine which resource to prefer over another. One possible implementation is that resources of the same or compatible `@type` can be used in a round-robin fashion in case of connection failure or server error. +A resource can use a different host or domain than the service index, but this may cause issues in environments with strict network rules. +In particular, if your service index adds resources that point directly to nuget.org (rather than proxying or caching through your own feed), your feed will not work where access to nuget.org is blocked. +If your feed is going to delegate particular resources to nuget.org, we recommend adding a configuration so that when your feed is deployed, the direct nuget.org reference can be removed from the service index. + ### Sample request ``` diff --git a/docs/api/tools-json.md b/docs/api/tools-json.md index 692e45b0e..f42b5c70c 100644 --- a/docs/api/tools-json.md +++ b/docs/api/tools-json.md @@ -4,7 +4,7 @@ description: The endpoint for author: jver ms.author: jver ms.date: 08/16/2018 -ms.topic: conceptual +ms.topic: article ms.reviewer: kraigb --- diff --git a/docs/api/vulnerability-info.md b/docs/api/vulnerability-info.md index c76ea9d43..abddc2eaf 100644 --- a/docs/api/vulnerability-info.md +++ b/docs/api/vulnerability-info.md @@ -33,6 +33,9 @@ The data file schema does not allow for modification or redaction of known vulne Therefore if a server's vulnerability data source (for example the [GitHub Advisories Database](https://github.com/advisories)) modifies an existing advisory, the NuGet server must modify the page that the vulnerability information was previously reported. One way to achieve this with the suggested partition scheme is to treat all vulnerability modifications and deletions as a trigger to regenerate the complete `base.json` file, and empty `updates.json`. +If you intend to use nuget.org's vulnerability data in your own NuGet server implementation, you should take into consideration developers who do not have direct access to nuget.org. +[See our implementation guide for more details](./implementation-guide.md#reusing-nugetorgs-vulnerability-data). + ## Versioning The following `@type` values are used: diff --git a/docs/archive/media/project-json-migrator.png b/docs/archive/media/project-json-migrator.png new file mode 100644 index 000000000..4328dfa7f Binary files /dev/null and b/docs/archive/media/project-json-migrator.png differ diff --git a/docs/archive/project-json-and-uwp.md b/docs/archive/project-json-and-uwp.md index b36ab5d20..898f98a53 100644 --- a/docs/archive/project-json-and-uwp.md +++ b/docs/archive/project-json-and-uwp.md @@ -4,13 +4,16 @@ description: Description of how the project.json file is used to track NuGet dep author: JonDouglas ms.author: jodou ms.date: 07/17/2017 -ms.topic: conceptual +ms.topic: article --- # project.json and UWP > [!Important] -> This content is deprecated. Projects should use either the `packages.config` or PackageReference formats. +> This content is deprecated. Projects should use the PackageReference formats. +> Learn how to [migrate your project.json project to PackageReference](./project-json.md#migrate-projectjson-to-packagereference). +> Visual Studio 2026 automatically migrates project.json at solution load time. +> [.NET 10 SDK & NuGet.exe 7.0](../release-notes/NuGet-7.0.md) do not support project.json projects. This document describes the package structure that employs features in NuGet 3+ (Visual Studio 2015 and later). The `minClientVersion` property of your `.nuspec` can be used to state that you require the features described here by setting it to 3.1. diff --git a/docs/archive/project-json-impact.md b/docs/archive/project-json-impact.md index 3f171f019..98569678f 100644 --- a/docs/archive/project-json-impact.md +++ b/docs/archive/project-json-impact.md @@ -4,13 +4,16 @@ description: Details on how the implementation of project.json in NuGet 3.x affe author: JonDouglas ms.author: jodou ms.date: 01/18/2018 -ms.topic: conceptual +ms.topic: concept-article --- # Impact of project.json when creating packages > [!Important] -> This content is deprecated. Projects should use either the `packages.config` or PackageReference formats. +> This content is deprecated. Projects should use the PackageReference formats. +> Learn how to [migrate your project.json project to PackageReference](./project-json.md#migrate-projectjson-to-packagereference). +> Visual Studio 2026 automatically migrates project.json at solution load time. +> [.NET 10 SDK & NuGet.exe 7.0](../release-notes/NuGet-7.0.md) do not support project.json projects. The `project.json` system used in NuGet 3+ affects package authors in several ways as described in the following sections. diff --git a/docs/archive/project-json.md b/docs/archive/project-json.md index ec21cf7e0..6e039d251 100644 --- a/docs/archive/project-json.md +++ b/docs/archive/project-json.md @@ -10,9 +10,12 @@ ms.topic: reference # project.json reference > [!Important] -> This content is deprecated. Projects should use either the `packages.config` or PackageReference formats. +> This content is deprecated. Projects should use the PackageReference formats. +> Learn how to [migrate your project.json project to PackageReference](#migrate-projectjson-to-packagereference). +> Visual Studio 2026 automatically migrates project.json at solution load time. +> [.NET 10 SDK & NuGet.exe 7.0](../release-notes/NuGet-7.0.md) do not support project.json projects. -*NuGet 3.x+* +*NuGet 3.x* The `project.json` file maintains a list of packages used in a project, known as a package management format. It supersedes `packages.config` but is in turn superseded by [PackageReference](../consume-packages/package-references-in-project-files.md) with NuGet 4.0+. @@ -37,6 +40,38 @@ The [`project.lock.json`](#projectlockjson) file (described below) is also used } ``` +## Migrate project.json to PackageReference + +The migration between project.json and PackageReference is straightforward. + +### Automatic migration in Visual Studio 2026 + +Visual Studio 2026 and later automatically migrates project.json projects to PackageReference when you open a solution containing project.json projects. +The migration happens at solution load time: + +1. Open a solution containing project.json projects in Visual Studio 2026 or later. +1. Visual Studio automatically detects project.json files and migrates them to PackageReference format. +1. To check migration status, open the [Output Window](/visualstudio/ide/output-window) and select Show output from "Package Manager". +You should see messages like "Migrating project.json project..." followed by "Migration Succeeded" for each project. +Any errors will appear in the Error List. +1. A backup of the original project file and project.json file is created in a `Backup` folder in the root of the project directory. +1. The migration converts all package dependencies to PackageReference format in the project file. + + +### Manual migration in Visual Studio 2022 + +For Visual Studio 2022 and earlier, you can use the built-in migrator: + +1. Load the project.json project in Visual Studio. +1. Go to the solution explorer of the project.json project and find the dependencies node. +1. Right-click and select `Migrate project.json to PackageReference...` + +![Migrating from project.json to PackageReference](media/project-json-migrator.png) + +### Alternative migration methods + +Alternatively, you may use the [dotnet migrate](/dotnet/core/tools/dotnet-migrate) command-line tool, or do the migration manually by taking all of the content from the project.json file and replacing it with the equivalent [PackageReference syntax](../consume-packages/Package-References-in-Project-Files.md). + ## Dependencies Lists the NuGet package dependencies of your project in the following form: diff --git a/docs/concepts/Auditing-Packages.md b/docs/concepts/Auditing-Packages.md index e791d0065..72d185b5a 100644 --- a/docs/concepts/Auditing-Packages.md +++ b/docs/concepts/Auditing-Packages.md @@ -3,8 +3,8 @@ title: Auditing package dependencies for security vulnerabilities description: How to audit package dependencies for security vulnerabilities and acting on security audit reports. author: JonDouglas ms.author: jodou -ms.date: 10/11/2023 -ms.topic: conceptual +ms.topic: how-to +ms.date: 10/01/2025 --- # Auditing package dependencies for security vulnerabilities @@ -16,31 +16,186 @@ This involves identifying vulnerabilities, evaluating risks, and making recommen The audit can include a review of the packages themselves, as well as any dependencies and their associated risks. The goal of the audit is to identify and mitigate any security vulnerabilities that could be exploited by attackers, such as code injection or cross-site scripting attacks. -| Project Type | NuGet | .NET SDK | Visual Studio | -|--------------|-------|----------|---------------| -| PackageReference | 6.8 | .NET 8 SDK (8.0.100) | Visual Studio 2022 17.8 | -| packages.config | 6.10 | N/A | Visual Studio 2022 17.10 | +### Feature availability + +| NuGet | .NET SDK | Visual Studio | Feature | +|-------|----------|---------------|---------| +| [5.9](../release-notes/NuGet-5.9.md) | .NET 5 SDK (5.0.200) | N/A | [`dotnet list package --vulnerable`](#dotnet-list-package---vulnerable) | +| [6.8](../release-notes/NuGet-6.8.md) | .NET 8 SDK (8.0.100) | Visual Studio 2022 17.8 | [NuGetAudit](#running-a-security-audit-with-restore) for PackageReference | +| [6.10](../release-notes/NuGet-6.10.md) | N/A | Visual Studio 2022 17.10 | [NuGetAudit](#running-a-security-audit-with-restore) for packages.config| +| [6.11](../release-notes/NuGet-6.11.md) | .NET 8 SDK (8.0.400) | Visual Studio 2022 17.11 | [NuGetAuditSuppress](#excluding-advisories) for PackageReference | +| [6.12](../release-notes/NuGet-6.12.md) | .NET 9 SDK (9.0.100) | Visual Studio 2022 17.12 | [Audit sources](#audit-sources). [NuGetAuditSuppress](#excluding-advisories) for packages.config. | +| [7.0](../release-notes/NuGet-7.0.md) | .NET 10 SDK (10.0.100) | Visual Studio 2026 | [NuGetAuditMode default changes for .NET 10](#configuring-nuget-audit). [`dotnet package update --vulnerable`](#security-vulnerabilities-found-with-updates) | ## Running a security audit with `restore` The `restore` command automatically runs when you do a common package operation such as loading a project for the first time, adding a new package, updating a package version, or removing a package from your project in your favorite IDE. -A description of your dependencies is checked against a report of known vulnerabilities on the [GitHub Advisory Database](https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anuget). - -> [!IMPORTANT] -> For Audit to check packages, a package source that provides a vulnerability database must be used. -> NuGet.org's V3 URL is one such example (https://api.nuget.org/v3/index.json), but note that NuGet.org's V2 endpoint does not. +Your dependencies are checked against a list of known vulnerabilities provided by your [audit sources](#audit-sources). 1. On the command line, navigate to your project or solution directory. 1. Run `restore` using your preferred tooling (i.e. dotnet, MSBuild, NuGet.exe, VisualStudio etc). 1. Review the warnings and address the known security vulnerabilities. +### Configuring NuGet Audit + +Audit can be configured via MSBuild properties in a `.csproj` or MSBuild file being evaluated as part of your project. +We recommend that audit is configured at a repository level. + +| MSBuild Property | Default | Possible values | Notes | +|------------------|---------|-----------------|-------| +| NuGetAuditMode | See 1 below | `direct` and `all` | If you'd like to audit top-level dependencies only, you can set the value to `direct`. NuGetAuditMode is not applicable for packages.config projects. | +| NuGetAuditLevel | low | `low`, `moderate`, `high`, and `critical` | The minimum severity level to report. If you'd like to see `moderate`, `high`, and `critical` advisories (exclude `low`), set the value to `moderate` | +| NuGetAudit | true | `true` and `false` | If you wish to not receive security audit reports, you can opt-out of the experience entirely by setting the value to `false` | + +1. `NuGetAuditMode` defaults to `all` when a project targets `net10.0` or higher. + Otherwise `NuGetAuditMode` defaults to `direct`. + When a project multi-targets, if any one target framework selects `all`, then audit will use this value for all target frameworks. + +#### Audit Sources + +Restore downloads a server's [`VulnerabilityInfo` resource](../api/vulnerability-info.md) to check against the list of packages each project is using. +The list of sources are defined by [the `auditSources` element in NuGet.Config](../reference/nuget-config-file.md#auditsources), and [warning NU1905](#warning-codes) is raised if any of the audit sources do not provide any vulnerability info. +If `auditSources` is not defined or is cleared without adding any sources, then `packageSources` will be used and warning NU1905 is suppressed. + +Since a common mitigation for package substitution attacks is [to use a single package source that upstreams from nuget.org, so that NuGet is not configured to use nuget.org as a package source](Security-Best-Practices.md#nuget-feeds), audit sources can be used to use nuget.org (or any other source that provides vulnerability information) without also using it as a package source. + +The data source for nuget.org's vulnerability database is [GitHub Advisory Database](https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anuget). +Note that the [V2 protocol is deprecated](../nuget-org/overview-nuget-org.md#api-endpoint-for-nugetorg), so if your nuget.config is still using the V2 endpoint, you must migrate to the V3 endpoint. + +```xml + + + + + + +``` + +**Note**: The table below lists features that support Audit Sources. + +| Introduced In | Feature Supporting Audit Sources | +| -------------------------------------------------------------------------------------------- | ------------------------------------------------------------------ | +| [NuGet 6.12, .NET 9.0.100 SDK, and Visual Studio 2022 17.12](../release-notes/NuGet-6.12.md) | Restore | +| [NuGet 6.14, .NET 9.0.300 SDK](../release-notes/NuGet-6.14.md) | `dotnet package list --vulnerable` | +| [NuGet 7.0 and Visual Studio 2026](../release-notes/NuGet-7.0.md) | NuGet AuditSources support in the Visual Studio Package Manager UI | + +### Warning codes + +| Warning Code | Reason | +|--------------|----------| +| [NU1900](../reference/errors-and-warnings/NU1900.md) | Error communicating with package source, while getting vulnerability information. | +| [NU1901](../reference/errors-and-warnings/NU1901-NU1904.md) | Package with low severity detected | +| [NU1902](../reference/errors-and-warnings/NU1901-NU1904.md) | Package with moderate severity detected | +| [NU1903](../reference/errors-and-warnings/NU1901-NU1904.md) | Package with high severity detected | +| [NU1904](../reference/errors-and-warnings/NU1901-NU1904.md) | Package with critical severity detected | +| [NU1905](../reference/errors-and-warnings/NU1905.md) | An audit source does not provide a vulnerability database | + +You can customize your build to treat these warnings as errors to [treat warnings as errors, or treat warnings not as errors](/dotnet/csharp/language-reference/compiler-options/errors-warnings#warningsaserrors-and-warningsnotaserrors). +For example, if you're already using `` to treat all (C#, NuGet, MSBuild, etc) warnings as errors, you can use `$(WarningsNotAsErrors);NU1901;NU1902;NU1903;NU1904` to prevent vulnerabilities discovered in the future from breaking your build. +Alternatively, if you want to keep low and moderate vulnerabilities as warnings, but treat high and critical vulnerabilities as errors, and you're not using `TreatWarningsAsErrors`, you can use `$(WarningsAsErrors);NU1903;NU1904`. + +> [!NOTE] +> MSBuild properties for message severity such as `NoWarn` and `TreatWarningsAsErrors` are not supported for packages.config projects. + +#### Excluding advisories + +You can exclude advisories by adding a new `NuGetAuditSuppress` MSBuild item for each advisory. +Define a `NuGetAuditSuppress` item with the `Include=` metadata set to the advisory URL you wish to suppress. + +```xml + + + +``` + +Similar to the other NuGet audit configuration properties, `NuGetAuditSuppress` items can be defined at the project or repository level. + +`NuGetAuditSuppress` is available for PackageReference projects starting from [NuGet 6.11, Visual Studio 17.11, and the .NET 8.0.400 SDK](../release-notes/NuGet-6.11.md). +It is available for packages.config from [Visual Studio 17.12 and NuGet 6.12](../release-notes/NuGet-6.12.md). + +##### When to exclude advisories + +In scenarios where you have analyzed a specific advisory and have determined that it either does not apply to your scenario, or you are comfortable with the risks it imposes, you can choose to exclude specific advisories from the audit report. +Note that this would completely suppress the advisories, even for packages that share the advisory that may not be part of your project. +`NuGetAuditSuppress` should be considered a last resort for managing advisories. + +## Actions when packages with known vulnerabilities are reported + +Getting a warning about packages with known vulnerabilities is only part of the process. +Once discovered, action needs to be taken to remove the potential vulnerability from your solution. + +The easiest case is when a package you reference directly has the known vulnerability. +In this situation, update the package version to one that fixes the vulnerability. + +Package vulnerabilities may be reported in both direct and transitive package references. +The action you take to resolve may be different because of that. + ### Security vulnerabilities found with updates -If security vulnerabilities are found and updates are available for the package, you can either: +If security vulnerabilities are found and updates are available for the package, you can do one of the following: - Edit the `.csproj` or other package version location (`Directory.Packages.props`) with a newer version containing a security fix. - Use the NuGet package manager user interface in Visual Studio to update the individual package. -- Run the `dotnet add package` command with the respective package ID to update to the latest version. +- Run the `dotnet package update --vulnerable` command to update all vulnerable packages in a project to the first version without known vulnerabilities. +- Run the `dotnet package update` or `dotnet package add` commands with the respective package ID to update to the latest version. Use [`dotnet add package` when using .NET 9 or earlier](/dotnet/core/whats-new/dotnet-10/sdk#more-consistent-command-order). +- Use the NuGet Model Context Protocol (MCP) server that has the ability to update packages in your project to versions that resolve known vulnerabilities. +See [Fixing package vulnerabilities](NuGet-MCP-Server.md#fixing-package-vulnerabilities) for more information. + +#### Transitive Packages + +Often a vulnerability will be in a transitive dependency. +Our recommendation is to prefer updates to packages "closest" to your direct references. +Though, there's nothing wrong with just upgrading the package with known vulnerability either. + +For example, say your project references package A. +Package A has a dependency on package B, which in turn has a dependency on package C. +In this example, we'll consider that package C version 1.0.0 has a known vulnerability, fixed in version 2.0.0. +Our recommendation is to first try upgrading package A. +If that doesn't resolve the audit warning, then try upgrading package B. +If that doesn't resolve the audit warning, then upgrade C directly. +To aid with this, you'll [need to find the transitive package path](#finding-the-transitive-package-path). + +In summary, if a known vulnerability exists in a top-level package's transitive dependencies, you have these options: + +- Check if the top-level package contains an update that does not have a transitive vulnerability and update that instead. +- Update the closest package to your direct references that does not reference a vulnerability. +- Add the fixed package version as a direct package reference. **Note:** Be sure to remove this reference when a new package version update becomes available and be sure to maintain the defined attributes for the expected behavior. +- Use [Central Package Management with the transitive pinning functionality](../consume-packages/Central-Package-Management.md#transitive-pinning). + Note that if you pack your project into your own package to share with others, [CPM with transitive pinning will cause packages to become dependencies](../consume-packages/Central-Package-Management.md#transitive-pinning-and-pack), even if your project doesn't directly call APIs on that package. +- [Suppress the advisory](#excluding-advisories) until it can be addressed. +- File an issue in the top-level package's tracker to request an update. + +##### Finding the transitive package path + +There are several ways to find the package path. +Which method you prefer depends on what tools you normally use during your development. + +###### dotnet nuget why + +On the command line, you can use the [`dotnet nuget why` command](/dotnet/core/tools/dotnet-nuget-why) to understand why transitive packages are being included in your project's package graph. + +![dotnet nuget why example](media/dotnet-nuget-why-1.png) + +###### Visual Studio Solution Explorer + +SDK style projects also provide the full package graph under the project's Dependency node. +It's also searchable! +Expand search options and enable “search external files”. + +![Visual Studio Solution Explorer Search Options](media/vs-solution-explorer-search-options-1.png) + +Search the package name, and it will show you all instances under each project's Dependencies node. + +![Visual Studio Solution Explorer Search Results](media/vs-solution-explorer-search-results-1.png) + +###### Visual Studio NuGet Package Manager UI + +When you look at the Installed tab in Visual Studio's package manager UI, when the project uses PackageReference for package management, it will show both direct and transitive packages. +Currently, this only happens when you manage packages for a project, not for the solution. + +If you mouse hover over a package in the package list, the tooltip will include the name of one direct package that has caused that transitive package to be included in the project. + +![Visual Studio Package Manager UI tooltip](media/pm-ui-transitive-tooltip-1.png) ### Security vulnerabilities found with no updates @@ -74,40 +229,67 @@ On NuGet.org, you can navigate to the package details page and click `Report pac If no security vulnerabilities are found, this means that packages with known vulnerabilities were not found in your package graph at the present moment of time you checked. Since the advisory database can be updated at any time, we recommend regularly checking your `dotnet restore` output and ensuring the same in your continuous integration process. -### Configuring NuGet audit +## Running NuGet Audit in CI -Audit can be configured via MSBuild properties in a `.csproj` or MSBuild file being evaluated as part of your project. -We recommend that audit is configured at a repository level. +### Separating Errors from Warnings with a Dedicated Auditing Pipeline -| MSBuild Property | Default | Possible values | Notes | -|------------------|---------|-----------------|-------| -| NuGetAuditMode | direct | `direct` and `all` | If you'd like to audit both top-level and transitive dependencies, you can set the value to `all`. NuGetAuditMode is not applicable for packages.config projects | -| NuGetAuditLevel | low | `low`, `moderate`, `high`, and `critical` | If you'd like to see `moderate`, `high`, and `critical` advisories, set the value to `moderate` | -| NuGetAudit | true | `true` and `false` | If you wish to not receive security audit reports, you can opt-out of the experience entirely by setting the value to `false` | +You can use MSBuild's conditional statements to configure a dedicated CI pipeline for running audits, without audit warnings being treated as errors in other pipelines or on local builds. +Depending on your CI system and team processes, you can have failed runs of the audit pipeline email the team, or you may have a dashboard where you can show a badge of the most recent run of the pipeline. -### Excluding advisories +Like many things in programming, there are multiple ways to achieve the outcome. +One option is to treat NuGet Audit warnings as errors only in an audit pipeline. -There is no support for excluding individual advisories at this time. -You can use `` to suppress `NU1901`-`NU1904` warnings or use the `` functionality to ensure your audit reports are useful to your workflow. +```xml + + NU1900;NU1901;NU1902;NU1903;NU1904;NU1905 + $(WarningsAsErrors);$(NuGetAuditCodes) + $(WarningsNotAsErrors);$(NuGetAuditCodes) + +``` -### Warning codes +Then in your pipeline, you run restore specifying the property used by the condition. +For example, using GitHub Actions syntax: -| Warning Code | Reason | -|--------------|----------| -| NU1900 | Error communicating with package source, while getting vulnerability information. | -| NU1901 | Package with low severity detected | -| NU1902 | Package with moderate severity detected | -| NU1903 | Package with high severity detected | -| NU1904 | Package with critical severity detected | +```yml +- name: Restore with NuGet Auditing + run: dotnet restore -p:AuditPipeline=true +``` -You can customize your build to treat these warnings as errors to [treat warnings as errors, or treat warnings not as errors](/dotnet/csharp/language-reference/compiler-options/errors-warnings#warningsaserrors-and-warningsnotaserrors). -For example, if you're already using `` to treat all (C#, NuGet, MSBuild, etc) warnings as errors, you can use `NU1901;NU1902;NU1903;NU1904` to prevent vulnerabilities discovered in the future from breaking your build. -Alternatively, if you want to keep low and moderate vulnerabilities as warnings, but treat high and critical vulnerabilities as errors, and you're not using `TreatWarningsAsErrors`, you can use `NU1903;NU1904`. +The property name `AuditPipeline` is only an example, and you can customize it as you wish, as long as the name is the same in both the MSBuild condition and the command line. +MSBuild also uses environment variables when reading a property that has not yet been defined, so an environment variable is an alternative to the command line parameter. -> [!NOTE] -> MSBuild properties for message severity such as `NoWarn` and `TreatWarningsAsErrors` are not supported for packages.config projects. +By using conditions to selectively cause NuGet Audit warnings to fail a restore, you can have a dedicated pipeline to check packages for known vulnerabilities, while preventing new security advisories from blocking your bug fixes at inconvenient times. +Keeping NuGet Audit warnings enabled for local builds allows developers to get a non-blocking notification about new security advisories and can encourage upgrading package versions to fix the vulnerabilities more quickly than waiting for someone to check the audit pipeline status. + +### Ensure restore audited projects + +NuGet in MSBuild 17.13 and .NET 9.0.200 added output properties `RestoreProjectCount`, `RestoreSkippedCount` and `RestoreProjectsAuditedCount` on the restore task. +This can be used to enforce that audit ran during a restore. +Note that these output properties are not available with [static graph restore](../reference/msbuild-targets.md#restoring-with-msbuild-static-graph-evaluation). + +Since MSBuild is a scripting language, this can be achieved a number of different ways, but also has the same restrictions as MSBuild has. +One example is to create a file *Directory.Solution.targets* in the same directory as your solution file, whose contents has a target similar to the following. +Note that *Directory.Build.props* is commonly used, but is imported by projects. +However, NuGet's restore target and task runs at the solution level, so needs to be in MSBuild's solution extensibility file, not the project/build file. + +```xml + + + + + +``` + +Depending on your use-case, you may wish to use condition `'$(RestoreProjectCount)' != '$([MSBuild::Add($(RestoreProjectsAuditedCount), $(RestoreSkippedCount))'` on the error message, to account for projects that restore skipped because they were already up to date. +Similarly, think about if you want this error to happen everywhere, or only in CI pipelines, and what environment variables are defined in your CI environment, and factor this into the target's condition. +Again, since MSBuild is a scripting language, you can use any of its capabilities to customize your repo however you want. +Viewing [MSBuild's metaproj](/visualstudio/msbuild/how-to-build-specific-targets-in-solutions-by-using-msbuild-exe#troubleshooting) and [binlogs](/visualstudio/msbuild/msbuild-command-line-reference#switches-for-loggers) are useful to develop and troubleshoot solution level targets. -## Summary +## `dotnet list package --vulnerable` -Security auditing features are crucial for maintaining the security and integrity of software projects. -These features provide you with an additional layer of protection against security vulnerabilities and ensures that you can use open source packages with confidence. +[`dotnet list package`](/dotnet/core/tools/dotnet-list-package) has a `--vulnerable` argument to filter the packages based on which packages have known vulnerabilities. +Note that `--include-transitive` is not default, so should be included. diff --git a/docs/concepts/Dependency-Resolution.md b/docs/concepts/Dependency-Resolution.md index 0f7da2b60..97f63ebae 100644 --- a/docs/concepts/Dependency-Resolution.md +++ b/docs/concepts/Dependency-Resolution.md @@ -4,7 +4,7 @@ description: Details on the process through which a NuGet package's dependencies author: JonDouglas ms.author: jodou ms.date: 08/14/2017 -ms.topic: conceptual +ms.topic: article --- # How NuGet resolves package dependencies @@ -63,6 +63,7 @@ When using a floating version, NuGet resolves the highest version of a package t | 1.1.* | 1.1.0
1.1.1
1.1.2-alpha
1.2.0-alpha | 1.1.1 | The highest stable version that respects the specified pattern.| | \*-\* | 1.1.0
1.1.1
1.1.2-alpha
1.3.0-beta | 1.3.0-beta | The highest version including the not stable versions. | Available in Visual Studio version 16.6, NuGet version 5.6, .NET Core SDK version 3.1.300 | | 1.1.\*-\* | 1.1.0
1.1.1
1.1.2-alpha
1.1.2-beta
1.3.0-beta | 1.1.2-beta | The highest version respecting the pattern and including the not stable versions. | Available in Visual Studio version 16.6, NuGet version 5.6, .NET Core SDK version 3.1.300 | +| 1.2.0-rc.* | 1.1.0
1.2.0-rc.1
1.2.0-rc.2
1.2.0 | 1.2.0 | Despite this being a version range with a prerelease part, stables are allowed if they match the stable part. Given that 1.2.0 > 1.2.0-rc.2, it is chosen. | | > [!Note] > Floating version resolution does not take into account whether or not a package is listed. diff --git a/docs/concepts/MSBuild-props-and-targets.md b/docs/concepts/MSBuild-props-and-targets.md index 10e630270..1f40da97a 100644 --- a/docs/concepts/MSBuild-props-and-targets.md +++ b/docs/concepts/MSBuild-props-and-targets.md @@ -4,7 +4,7 @@ description: Describes MSBuild props and targets in NuGet packages author: nkolev92 ms.author: nikolev ms.date: 07/13/2022 -ms.topic: conceptual +ms.topic: article --- # MSBuild .props and .targets in a package diff --git a/docs/concepts/NuGet-MCP-Server.md b/docs/concepts/NuGet-MCP-Server.md new file mode 100644 index 000000000..ccbd97e63 --- /dev/null +++ b/docs/concepts/NuGet-MCP-Server.md @@ -0,0 +1,182 @@ +--- +title: Using the NuGet Model Context Protocol (MCP) Server +description: How to configure and use the NuGet Model Context Protocol (MCP) server. +author: jeffkl +ms.author: jeffkl +ms.topic: conceptual +ms.date: 10/01/2025 +--- + +# Using the NuGet Model Context Protocol (MCP) Server + +## Requirements + +To run the MCP server, you must have **[.NET 10 SDK or later](https://dotnet.microsoft.com/en-us/download/dotnet/10.0)** installed. +This version of .NET adds a command, `dnx`, which is used to download, install, and run the MCP server from [nuget.org](https://nuget.org). + +To verify your .NET version, run the following command in your terminal: +```bash +dotnet --info +``` + +## Getting started in Visual Studio 2026 + +In Visual Studio 2026, the NuGet MCP server is built-in but must be enabled once in order to use its functionality. + +To enable the NuGet MCP server, follow these steps: +1. Open Visual Studio 2026. +1. Open the GitHub Copilot Chat window and make sure you are signed in. +1. Click the tools icon in the bottom toolbar to bring up the Tools menu. +1. Find the MCP server named "nuget" and check the box to enable it. + +![GitHub Copilot Chat Tools window in Visual Studio 2026](./media/copilot-tools-menu.png) + +## Getting started in Visual Studio 2022 + +> [!NOTE] +> You must have Visual Studio 2022 17.14 or later in order to configure an MCP server. + +In Visual Studio 2022, you must manually add the NuGet MCP server to your configuration. +There are several configuration files that Visual Studio 2022 uses to define MCP servers. +See [Use MCP Servers](/visualstudio/ide/mcp-servers) for more information on which file to configure. + +Once you have identified the correct configuration file, add the following JSON snippet to your `mcp.json`: +```json +{ + "servers": { + "nuget": { + "type": "stdio", + "command": "dnx", + "args": [ "NuGet.Mcp.Server", "--source", "https://api.nuget.org/v3/index.json", "--yes" ] + } + } +} +``` + +This will configure Visual Studio 2022 to use the latest version of the NuGet MCP server from nuget.org. +To verify that the MCP server is working correctly, open the GitHub Copilot Chat window and make sure you are signed in. +Then click the Tools icon in the bottom toolbar to bring up the Tools menu. +You should see the MCP server named "nuget" in the list of available servers. + +![GitHub Copilot Chat Tools window in Visual Studio 2022](./media/copilot-tools-menu-2022.png) + +## Getting started in VS Code + +To configure the NuGet MCP server in VS Code click the appropriate button below and it will be set up. + +[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install_Server-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)]( +https://vscode.dev/redirect/mcp/install?name=NuGet&config=%7B%22name%22%3A%22NuGet.Mcp.Server%22%2C%22command%22%3A%22dnx%22%2C%22args%22%3A%5B%22NuGet.Mcp.Server%22%2C%22https%3A%2F%2Fapi.nuget.org%2Fv3%2Findex.json%22%2Cnull%2Cnull%5D%7D) [![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install_Server-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://vscode.dev/redirect/mcp/install?name=NuGet&config=%7B%22name%22%3A%22NuGet.Mcp.Server%22%2C%22command%22%3A%22dnx%22%2C%22args%22%3A%5B%22NuGet.Mcp.Server%22%2C%22https%3A%2F%2Fapi.nuget.org%2Fv3%2Findex.json%22%2Cnull%2Cnull%5D%7D&quality=insiders) + +> ![GitHub Copilot Chat Tools window in VS Code](./media/copilot-tools-menu-vs-code.png) + +To verify that the MCP server is working correctly, open the GitHub Copilot Chat window and make sure you are signed in. +Then click the Tools icon in the bottom toolbar to bring up the Tools menu. +You should see the MCP server named "nuget" in the list of available servers. + +## Getting started in GitHub Copilot Agent + +You can also configure the MCP Server to work with GitHub Copilot as a Coding Agent in your repositories. +Ensure that you configured your repository to use [GitHub Copilot Coding Agents](https://github.com/settings/copilot/coding_agent). + +Browse to your repository and click the Settings tab. +Expand the Copilot section and click on Coding Agents. + +![GitHub Copilot coding agent settings](./media/github-copilot-agent-settings.png) + +Scroll down to the **Model Context Protocol (MCP)** section and add the following JSON snippet to your `mcpServers` configuration: + +```json +{ + "mcpServers": { + "NuGet": { + "type": "local", + "command": "dnx", + "args": ["NuGet.Mcp.Server", "--yes"], + "tools": ["*"], + "env": {} + } + } +} +``` + +This will make all of NuGet's MCP server tools available. If you want specific tools, you can list them in the `"tools"` parameter array. + +Finally, click the **Save MCP configuration** button to save your changes. + +Now that the NuGet MCP is configured, you will also need to create a GitHub Actions workflow to install .NET 10 Preview 6 or higher so that the `dnx` command is available to run the MCP server. +You can do this by creating the following workflow file in your repository at + +`.github/workflows/copilot-setup-steps.yml` + +The contents of this workflow file should be as follows: + +```yml +name: "Copilot Setup Steps" + +# Automatically run the setup steps when they are changed to allow for easy validation, and +# allow manual testing through the repository's "Actions" tab +on: + workflow_dispatch: + push: + paths: + - .github/workflows/copilot-setup-steps.yml + pull_request: + paths: + - .github/workflows/copilot-setup-steps.yml + +jobs: + # The job MUST be called `copilot-setup-steps` or it will not be picked up by Copilot. + copilot-setup-steps: + runs-on: ubuntu-latest + + # Set the permissions to the lowest permissions possible needed for your steps. + # Copilot will be given its own token for its operations. + permissions: + # If you want to clone the repository as part of your setup steps, for example to install dependencies, you'll need the `contents: read` permission. If you don't clone the repository in your setup steps, Copilot will do this for you automatically after the steps complete. + contents: read + + # You can define any steps you want, and they will run before the agent starts. + # If you do not check out your code, Copilot will do this for you. + steps: + - name: Install .NET 10.x + uses: actions/setup-dotnet@v5 + with: + dotnet-version: | + 10.x + dotnet-quality: preview + + - name: dotnet --info + run: dotnet --info +``` + +This will ensure that the `dnx` command is available to run the NuGet MCP server when GitHub Copilot runs as a coding agent in your repository. + +## Fixing package vulnerabilities + +The NuGet MCP server can help you identify and fix package vulnerabilities in your project. +To use the MCP server to fix vulnerabilities, enter the following prompt in the GitHub Copilot Chat window: + +> Fix my package vulnerabilities + +The MCP server will analyze your project's dependencies and suggest updates to packages that have known vulnerabilities. + +## Updating all packages + +The NuGet MCP server can also update your packages to the latest compatible versions. +To use the MCP server to update all packages, enter the following prompt in the GitHub Copilot Chat window: + +> Update all my packages to the latest compatible versions + +The MCP server will analyze your project's target framework(s) and suggest updates to the latest version of packages that are compatible with your project. + +## Update a package to a specific version + +The NuGet MCP server can update a specific package to a version you specify. +To do so, enter the following prompt in the GitHub Copilot Chat window: + +> Update the package [PackageName] to version [VersionNumber] + +## Support + +If you experience an issue with the NuGet MCP server or have any other feedback, please open an issue on the [NuGet GitHub repository](https://github.com/NuGet/Home/issues/new?template=MCPSERVER.yml). +Please provide the requested information in the issue template so that we can better understand and address your issue or suggestion. \ No newline at end of file diff --git a/docs/concepts/Package-Versioning.md b/docs/concepts/Package-Versioning.md index 01a806a88..eb29a1da6 100644 --- a/docs/concepts/Package-Versioning.md +++ b/docs/concepts/Package-Versioning.md @@ -58,7 +58,7 @@ That said, package developers generally follow recognized naming conventions: When ordering versions by precedence, NuGet follows the SemVer standard and chooses a version without a suffix first, then applies precedence to pre-release versions in reverse alphabetical order and treats dot notation numbers with numerical order. > [!Note] -> Prerelease numbers with dot notation, as in *1.0.1-build.23*, are considered are part of the [SemVer 2.0.0](https://semver.org/spec/v2.0.0.html) standard, and as such are [only supported with NuGet 4.3.0+](#semantic-versioning-200). +> Prerelease numbers with dot notation, as in *1.0.1-build.23*, are considered part of the [SemVer 2.0.0](https://semver.org/spec/v2.0.0.html) standard, and as such are [only supported with NuGet 4.3.0+](#semantic-versioning-200). ### [SemVer 2.0 sorting](#tab/semver20sort) @@ -116,9 +116,10 @@ When referring to package dependencies, NuGet supports using interval notation f | [1.0,2.0) | 1.0 ≤ x < 2.0 | Mixed inclusive minimum and exclusive maximum version | | (1.0) | invalid | invalid | -### Examples +### Best Practice -Always specify a version or version range for package dependencies in project files, `packages.config` files, and `.nuspec` files. Without a version or version range, NuGet 2.8.x and earlier chooses the latest available package version when resolving a dependency, whereas NuGet 3.x and later chooses the lowest package version. Specifying a version or version range avoids this uncertainty. +Always specify a version or version range for package dependencies in project files, `packages.config` files, and `.nuspec` files. Without a version or version range, when resolving a dependency, consistent restore results are not guaranteed. +Avoid specifying an upper bound to version ranges to packages you don't own unless you know of a compatibility problem. Upper bounds to version ranges harm adoption, discourage consumers from getting valuable updates to dependencies, and in some cases may lead them to use unsupported versions of dependencies. #### References in project files (PackageReference) @@ -131,6 +132,9 @@ Always specify a version or version range for package dependencies in project fi Will resolve to the highest acceptable stable version.--> + + + diff --git a/docs/concepts/Security-Best-Practices.md b/docs/concepts/Security-Best-Practices.md index 2ead7aa6f..d28f60fb0 100644 --- a/docs/concepts/Security-Best-Practices.md +++ b/docs/concepts/Security-Best-Practices.md @@ -3,21 +3,26 @@ title: Best practices for a secure software supply chain description: Best practices for securing your software supply chain using NuGet & GitHub. author: JonDouglas ms.author: jodou -ms.date: 02/08/2021 -ms.topic: conceptual +ms.topic: best-practice --- # Best practices for a secure software supply chain -Open Source is everywhere. It is in many proprietary codebases and community projects. For organizations and individuals, the question today is not whether you are or are not using open-source code, but what open-source code you are using, and how much. +Open Source is everywhere. +It is in many proprietary codebases and community projects. +For organizations and individuals, the question today is not whether you are or are not using open-source code, but what open-source code you are using, and how much. -If you're not aware of what is in your software supply chain, an upstream vulnerability in one of your dependencies can be fatal, making you, and your customers, vulnerable to a potential compromise. In this document, we will dive deeper into what the term “software supply chain” means, why it matters, and how you can help secure your project’s supply chain with best practices. +If you're not aware of what is in your software supply chain, an upstream vulnerability in one of your dependencies can be fatal, making you, and your customers, vulnerable to a potential compromise. +In this document, we will dive deeper into what the term “software supply chain” means, why it matters, and how you can help secure your project’s supply chain with best practices. ![The State of the Octoverse 2020 - Open Source](media/opensource-percent.png) -## Dependencies +## Dependencies -The term software supply chain is used to refer to everything that goes into your software and where it comes from. It is the dependencies and properties of your dependencies that your software supply chain depends on. A dependency is what your software needs to run. It can be code, binaries, or other components, and where they come from, such as a repository or package manager. +The term software supply chain is used to refer to everything that goes into your software and where it comes from. +It is the dependencies and properties of your dependencies that your software supply chain depends on. +A dependency is what your software needs to run. +It can be code, binaries, or other components, and where they come from, such as a repository or package manager. It includes who wrote the code, when it was contributed, how it was reviewed for security issues, known vulnerabilities, supported versions, license information, and just about anything that touches it at any point of the process. @@ -25,21 +30,33 @@ Your supply chain also encompasses other parts of your stack beyond a single app ## Vulnerabilities -Today, software dependencies are pervasive. It is quite common for your projects to use hundreds of open-source dependencies for functionality that you did not have to write yourself. This may mean that most of your application consists of code that you did not author. +Today, software dependencies are pervasive. +It is quite common for your projects to use hundreds of open-source dependencies for functionality that you did not have to write yourself. +This may mean that most of your application consists of code that you did not author. ![The State of the Octoverse 2020 - Dependencies](media/dependencies.png) Possible vulnerabilities in your third-party or open-source dependencies, are presumably dependencies you cannot control as tightly as the code you write, which can create potential security risks in your supply chain. -If one of these dependencies has a vulnerability, the chances are you have a vulnerability as well. This can be scary as one of your dependencies may change without you even knowing. Even if a vulnerability exists in a dependency today, but is not exploitable, it can be exploitable in the future. +If one of these dependencies has a vulnerability, the chances are you have a vulnerability as well. +This can be scary as one of your dependencies may change without you even knowing. +Even if a vulnerability exists in a dependency today, but is not exploitable, it can be exploitable in the future. -Being able to leverage the work of thousands of open-source developers and library authors means that thousands of strangers can effectively contribute directly to your production code. Your product, through your software supply chain, is affected by unpatched vulnerabilities, innocent mistakes, or even malicious attacks against dependencies. +Being able to leverage the work of thousands of open-source developers and library authors means that thousands of strangers can effectively contribute directly to your production code. +Your product, through your software supply chain, is affected by unpatched vulnerabilities, innocent mistakes, or even malicious attacks against dependencies. ## Supply chain compromises -The traditional definition of a supply chain comes from manufacturing; it is the chain of processes required to make and supply something. It includes planning, supply of materials, manufacturing, and retail. A software supply chain is similar, except instead of materials, it is code. Instead of manufacturing, it is development. Instead of digging ore from the ground, code is sourced from suppliers, commercial or open source, and, in general, the open-source code comes from repositories. Adding code from a repository means your product takes a dependency on that code. +The traditional definition of a supply chain comes from manufacturing; it is the chain of processes required to make and supply something. +It includes planning, supply of materials, manufacturing, and retail. +A software supply chain is similar, except instead of materials, it is code. +Instead of manufacturing, it is development. +Instead of digging ore from the ground, code is sourced from suppliers, commercial or open source, and, in general, the open-source code comes from repositories. +Adding code from a repository means your product takes a dependency on that code. -One example of a software supply chain attack occurs when malicious code is purposefully added to a dependency, using the supply chain of that dependency to distribute the code to its victims. Supply chain attacks are real. There are many methods to attack a supply chain, from directly inserting malicious code as a new contributor, to taking over a contributor’s account without others noticing, or even compromising a signing key to distribute software that is not officially part of the dependency. +One example of a software supply chain attack occurs when malicious code is purposefully added to a dependency, using the supply chain of that dependency to distribute the code to its victims. +Supply chain attacks are real. +There are many methods to attack a supply chain, from directly inserting malicious code as a new contributor, to taking over a contributor’s account without others noticing, or even compromising a signing key to distribute software that is not officially part of the dependency. A software supply chain attack is in and of itself rarely the end goal, rather it is the beginning of an opportunity for an attacker to insert malware or provide a backdoor for future access. @@ -47,18 +64,35 @@ A software supply chain attack is in and of itself rarely the end goal, rather i ## Unpatched software -The use of open source today is significant and is not expected to slow down anytime soon. Given that we are not going to stop using open-source software, the threat to supply chain security is unpatched software. Knowing that, how can you address the risk that a dependency of your project has a vulnerability? +The use of open source today is significant and is not expected to slow down anytime soon. +Given that we are not going to stop using open-source software, the threat to supply chain security is unpatched software. +Knowing that, how can you address the risk that a dependency of your project has a vulnerability? - **Knowing what is in your environment.** This requires discovering your dependencies and any transitive dependencies to understand the risks of those dependencies such as vulnerabilities or licensing restrictions. -- **Manage your dependencies.** When a new security vulnerability is discovered, you must determine whether you are impacted, and if so, update to the latest version and security patch available. This is especially important to review changes that introduce new dependencies or regularly auditing older dependencies. -- **Monitor your supply chain.** This is by auditing the controls you have in place to manage your dependencies. This will help you enforce more restrictive conditions to be met for your dependencies. +- **Manage your dependencies.** When a new security vulnerability is discovered, you must determine whether you are impacted, and if so, update to the latest version and security patch available. + This is especially important to review changes that introduce new dependencies or regularly auditing older dependencies. +- **Monitor your supply chain.** This is by auditing the controls you have in place to manage your dependencies. + This will help you enforce more restrictive conditions to be met for your dependencies. ![The State of the Octoverse 2020 - Advisories](media/advisories.png) -We will cover various tools and techniques that NuGet and GitHub provides, which you can use today to address potential risks inside your project. +We will cover various tools and techniques that NuGet and GitHub provides, which you can use today to address potential risks inside your project. ## Knowing what is in your environment +### Packages with known vulnerabilities + +**📦 Package Consumer | 📦🖊 Package Author** + +.NET 8 and Visual Studio 17.8 added [NuGetAudit](Auditing-Packages.md), which will warn about direct packages with known vulnerabilities during restore. +.NET 9 and Visual Studio 17.12 changed the default to warn about transitive packages as well. + +NuGetAudit requires a source to provide a known vulnerabilities database, so if you're not using nuget.org as a package source, you should add it as an [audit source](Auditing-Packages.md#audit-sources). + +By the time that NuGet is warning you, the vulnerability is publicly known. +Attackers can use this public disclosure to develop attacks for targets who have not patched their applications. +Therefore, when you get a warning that a package your project is using has a known vulnerability, you should quickly take action. + ### NuGet dependency graph **📦 Package Consumer** @@ -67,20 +101,22 @@ You can view your NuGet dependencies in your project by looking directly at the This is typically found in one of two places: -- [`packages.config`](../reference/packages-config.md) – Located in the project root. -- [``](../consume-packages/package-references-in-project-files.md) – Located in the project file. +- [`packages.config`](../reference/packages-config.md) – Located in the project root. +- [``](../consume-packages/package-references-in-project-files.md) – Located in the project file. Depending on what method you use to manage your NuGet dependencies, you can also use Visual Studio to view your dependencies directly in [Solution Explorer](/visualstudio/ide/solutions-and-projects-in-visual-studio#solution-explorer) or [NuGet Package Manager](../consume-packages/install-use-packages-visual-studio.md). -For CLI environments, you can use the [`dotnet list package`](/dotnet/core/tools/dotnet-list-package) command to list out your project or solution’s dependencies. +For CLI environments, you can use the [`dotnet list package` command](/dotnet/core/tools/dotnet-list-package) to list out your project or solution’s dependencies. +You can also use the [`dotnet nuget why` command](/dotnet/core/tools/dotnet-nuget-why) to understand why transitive packages (those not directly referenced by your project) are being included in your project's package graph. For more information on managing NuGet dependencies, [see the following documentation](../consume-packages/overview-and-workflow.md). -### GitHub dependency graph +### GitHub dependency graph **📦 Package Consumer | 📦🖊 Package Author** -You can use GitHub’s dependency graph to see the packages your project depends on and the repositories that depend on it. This can help you see any vulnerabilities detected in its dependencies. +You can use GitHub’s dependency graph to see the packages your project depends on and the repositories that depend on it. +This can help you see any vulnerabilities detected in its dependencies. For more information on GitHub repository dependencies, [see the following documentation](https://github.co/dependency-graph). @@ -88,12 +124,14 @@ For more information on GitHub repository dependencies, [see the following docum **📦 Package Consumer | 📦🖊 Package Author** -To ensure a secure supply chain of dependencies, you will want to ensure that all of your dependencies & tooling are regularly updated to the latest stable version as they will often include the latest functionality and security patches to known vulnerabilities. Your dependencies can include code you depend on, binaries you consume, tooling you use, and other components. This may include: +To ensure a secure supply chain of dependencies, you will want to ensure that all of your dependencies & tooling are regularly updated to the latest stable version as they will often include the latest functionality and security patches to known vulnerabilities. +Your dependencies can include code you depend on, binaries you consume, tooling you use, and other components. +This may include: -- [Visual Studio](https://visualstudio.microsoft.com/downloads/) -- [.NET SDK & Runtime](https://dotnet.microsoft.com/download) -- [NuGet](https://www.nuget.org/downloads) -- [NuGet packages](../consume-packages/reinstalling-and-updating-packages.md) +- [Visual Studio](https://visualstudio.microsoft.com/downloads/) +- [.NET SDK & Runtime](https://dotnet.microsoft.com/download) +- [NuGet](https://www.nuget.org/downloads) +- [NuGet packages](../consume-packages/reinstalling-and-updating-packages.md) ## Manage your dependencies @@ -101,23 +139,50 @@ To ensure a secure supply chain of dependencies, you will want to ensure that al **📦 Package Consumer | 📦🖊 Package Author** -You can use the [dotnet CLI](/dotnet/core/tools/dotnet-list-package) to list any known deprecated or vulnerable dependencies you may have inside your project or solution. You can use the command `dotnet list package --deprecated` or `dotnet list package --vulnerable` to provide you a list of any known deprecations or vulnerabilities. +You can use the [dotnet CLI](/dotnet/core/tools/dotnet-list-package) to list any known deprecated or vulnerable dependencies you may have inside your project or solution. +You can use the command `dotnet list package --deprecated` or `dotnet list package --vulnerable` to provide you a list of any known deprecations or vulnerabilities. +[NuGetAudit](Auditing-Packages.md) can warn you about known vulnerable dependencies, and is enabled by default when [a source provides a vulnerabilities database](Auditing-Packages.md#audit-sources). ### GitHub vulnerable dependencies **📦 Package Consumer | 📦🖊 Package Author** -If your project is hosted on GitHub, you can leverage [GitHub Security](https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/automatically-scanning-your-code-for-vulnerabilities-and-errors) to find security vulnerabilities and errors in your project and Dependabot will fix them by opening up a pull request against your codebase. +If your project is hosted on GitHub, you can leverage [GitHub Security](https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/automatically-scanning-your-code-for-vulnerabilities-and-errors) to find security vulnerabilities and errors in your project and Dependabot will fix them by opening up a pull request against your codebase. -Catching vulnerable dependencies before they are introduced is one goal of the [“Shift Left”](https://en.wikipedia.org/wiki/Shift-left_testing) movement. Being able to have information about your dependencies such as their license, transitive dependencies, and the age of dependencies helps you do just that. +Catching vulnerable dependencies before they are introduced is one goal of the [“Shift Left”](https://en.wikipedia.org/wiki/Shift-left_testing) movement. +Being able to have information about your dependencies such as their license, transitive dependencies, and the age of dependencies helps you do just that. For more information about Dependabot alerts & security updates, [see the following documentation](https://docs.github.com/en/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies). +## NuGet Configuration + +**📦 Package Consumer** + +Add a `nuget.config` file in the root of your project repository. This is considered a best practice as it promotes repeatability and ensures that different users have the same NuGet configuration. +We recommend adding `clear` elements to ensure no user or machine specific configuration is applied. [Read more about how settings are applied](../consume-packages/configuring-nuget-behavior.md#how-settings-are-applied). + +For example: + +```xml + + + + + + + + + +``` + ### NuGet feeds **📦 Package Consumer** -When using multiple public & private NuGet source feeds, a package can be downloaded from any of the feeds. To ensure your build is predictable and secure from known attacks such as [Dependency Confusion](https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610), knowing what specific feed(s) your packages are coming from is a best practice. You can use a single feed or private feed with upstreaming capabilities for protection. +Use package sources that you trust. +When using multiple public & private NuGet source feeds, a package can be downloaded from any of the feeds. +To ensure your build is predictable and secure from known attacks such as [Dependency Confusion](https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610), knowing what specific feed(s) your packages are coming from is a best practice. +You can use a single feed or private feed with upstreaming capabilities for protection. For more information to secure your package feeds, see [3 Ways to Mitigate Risk When Using Private Package Feeds](https://azure.microsoft.com/resources/3-ways-to-mitigate-risk-using-private-package-feeds/en-us/). @@ -127,7 +192,8 @@ When using a private feed, refer to the [security best practices for managing cr **📦 Package Consumer** -There are policies that you can opt-into in which you require the packages you use to be signed. This allows you to trust a package author, as long as it is author signed, or trust a package if it is owned by a specific user or account that is repository signed by NuGet.org. +There are policies that you can opt-into in which you require the packages you use to be signed. +This allows you to trust a package author, as long as it is author signed, or trust a package if it is owned by a specific user or account that is repository signed by NuGet.org. To configure client trust policies, [see the following documentation](../consume-packages/installing-signed-packages.md). @@ -135,7 +201,8 @@ To configure client trust policies, [see the following documentation](../consume **📦 Package Consumer** -Lock files store the hash of your package’s content. If the content hash of a package you want to install matches with the lock file, it will ensure package repeatability. +Lock files store the hash of your package’s content. +If the content hash of a package you want to install matches with the lock file, it will ensure package repeatability. To enable lock files, [see the following documentation](../consume-packages/package-references-in-project-files.md#locking-dependencies). @@ -147,13 +214,54 @@ Package Source Mapping allows you to centrally declare which source each package To enable package source mapping, [see the following documentation](../consume-packages/package-source-mapping.md). +## Secure computers + +### Directory permissions + +**📦 Package Consumer** + +On Windows and Mac, and some Linux distributions, user account home directories are private by default. +However, some Linux distributions make user directories readable by other accounts on the same computer by default. +Additionally, there are [multiple configuration options to redirect NuGet's global packages folder and HTTP cache to non-default locations](../consume-packages/managing-the-global-packages-and-cache-folders.md). +Solutions, projects, and repositories might also be created outside of the user's home directory. + +If you use any packages that are not on nuget.org, then if any other account on the computer can read NuGet's global packages or HTTP cache directories, or the project's build output directory, then these packages might be disclosed to people who should not have access to those packages. + +On Linux, `dotnet nuget update source` will change *nuget.config* file permissions to make it only readable by the file owner. +However, if you edit the *nuget.config* file in any other way, and the file is in a location that other accounts can read the file, there might be information disclosure about package source URL or package source credentials. +You should ensure any nuget.config file cannot be read by other users of the same computer. + +### Solutions within the downloads directory + +**📦 Package Consumer** + +Extra care should be taken if working on solutions or projects in your downloads directory. +NuGet will [accumulate settings from multiple config files](../consume-packages/configuring-nuget-behavior.md), and MSBuild will typically import *Directory.Build.props*, *Directory.NuGet.props*, *Directory.Build.targets*, and potentially other files, from any parent directory, right up to the filesystem root. + +The downloads folder has additional risk, since it's usually the default location that web browsers will download files from the internet + +### Build Agents + +**📦 Package Consumer** + +Build agents (CI agents) that are not reset to an initial state after every build have multiple risks that must be considered. + +To learn about secure ways to manage credentials, [see the docs on consuming packages from authenticated feeds](../consume-packages/consuming-packages-authenticated-feeds.md). + +To learn about modifying the directories that NuGet stores data in, see [the docs on managing the global packages, cache, and temp folders](../consume-packages/managing-the-global-packages-and-cache-folders.md). +These directories should be configured to a directory that the CI agent cleans after every build. + +Note that any packages used by your project might be left in your project's build output directory. +If your project uses packages from authenticated sources, then other users of the same CI agent might gain unauthorized access to the package assemblies. +Therefore, you should also clean your repo at the end of your build, even when the build fails or is cancelled. + ## Monitor your supply chain ### GitHub secret scanning **📦🖊 Package Author** -GitHub scans repositories for NuGet API keys to prevent fraudulent uses of secrets that were accidentally committed. +GitHub scans repositories for NuGet API keys to prevent fraudulent uses of secrets that were accidentally committed. To learn more about secret scanning, see [About secret scanning](https://docs.github.com/en/github/administering-a-repository/about-secret-scanning). @@ -161,7 +269,9 @@ To learn more about secret scanning, see [About secret scanning](https://docs.gi **📦🖊 Package Author** -[Author signing](../reference/signed-packages-reference.md) allows a package author to stamp their identity on a package and for a consumer to verify it came from you. This protects you against content tampering and serves as a single source of truth about the origin of the package and the package authenticity. When combined with client trust policies, you can verify a package came from a specific author. +[Author signing](../reference/signed-packages-reference.md) allows a package author to stamp their identity on a package and for a consumer to verify it came from you. +This protects you against content tampering and serves as a single source of truth about the origin of the package and the package authenticity. +When combined with client trust policies, you can verify a package came from a specific author. To author sign a package, see [Sign a package](../create-packages/sign-a-package.md). @@ -177,13 +287,14 @@ To learn more about reproducible builds, see [Producing Packages with Source Lin **📦🖊 Package Author** -Every account on nuget.org has 2FA enabled. This adds an extra layer of security when [logging into your GitHub account](https://docs.github.com/en/github/authenticating-to-github/securing-your-account-with-two-factor-authentication-2fa) or your [NuGet.org account](../nuget-org/individual-accounts.md#add-a-new-individual-account). +Every account on nuget.org has 2FA enabled. +This adds an extra layer of security when [logging into your GitHub account](https://docs.github.com/en/github/authenticating-to-github/securing-your-account-with-two-factor-authentication-2fa) or your [NuGet.org account](../nuget-org/individual-accounts.md#add-a-new-individual-account). -### Package ID prefix reservation +### Package ID prefix reservation **📦🖊 Package Author** -To protect the identity of your packages, you can reserve a package ID prefix with your respective namespace to associate a matching owner if your package ID prefix properly falls under the [specified criteria](../nuget-org/id-prefix-reservation.md#id-prefix-reservation-criteria). +To protect the identity of your packages, you can reserve a package ID prefix with your respective namespace to associate a matching owner if your package ID prefix properly falls under the [specified criteria](../nuget-org/id-prefix-reservation.md#id-prefix-reservation-criteria). To learn about reserving ID prefixes, see [Package ID prefix reservation](../nuget-org/id-prefix-reservation.md). @@ -191,13 +302,17 @@ To learn about reserving ID prefixes, see [Package ID prefix reservation](../nug **📦🖊 Package Author** -To protect the .NET package ecosystem when you are aware of a vulnerability in a package you have authored, do your best to deprecate and unlist the package so it is hidden from users searching for packages. If you are consuming a package that is deprecated and unlisted, you should avoid using the package. +To protect the .NET package ecosystem when you are aware of a vulnerability in a package you have authored, do your best to deprecate and unlist the package so it is hidden from users searching for packages. +If you are consuming a package that is deprecated and unlisted, you should avoid using the package. To learn how to deprecate and unlist a package, see the following documentation on [deprecating](../nuget-org/deprecate-packages.md) and [unlisting packages](../nuget-org/policies/deleting-packages.md#unlisting-a-package). +Also consider reporting the known to the [GitHub Advisories Database](https://github.com/advisories). + ## Summary -Your software supply chain is anything that goes into or affects your code. Even though supply chain compromises are real and growing in popularity, they are still rare; so the most important thing you can do is protect your supply chain by **being aware of your dependencies, managing your dependencies** and **monitoring your supply chain.** +Your software supply chain is anything that goes into or affects your code. +Even though supply chain compromises are real and growing in popularity, they are still rare; so the most important thing you can do is protect your supply chain by **being aware of your dependencies, managing your dependencies** and **monitoring your supply chain.** You learned about various methods that NuGet and [GitHub](/training/modules/maintain-secure-repository-github/) provide that are available to you today to be more effective in viewing, managing, and monitoring your supply chain. diff --git a/docs/concepts/media/copilot-tools-menu-2022.png b/docs/concepts/media/copilot-tools-menu-2022.png new file mode 100644 index 000000000..3fe2bdfb5 Binary files /dev/null and b/docs/concepts/media/copilot-tools-menu-2022.png differ diff --git a/docs/concepts/media/copilot-tools-menu-vs-code.png b/docs/concepts/media/copilot-tools-menu-vs-code.png new file mode 100644 index 000000000..995a86948 Binary files /dev/null and b/docs/concepts/media/copilot-tools-menu-vs-code.png differ diff --git a/docs/concepts/media/copilot-tools-menu.png b/docs/concepts/media/copilot-tools-menu.png new file mode 100644 index 000000000..ec5033751 Binary files /dev/null and b/docs/concepts/media/copilot-tools-menu.png differ diff --git a/docs/concepts/media/dotnet-nuget-why-1.png b/docs/concepts/media/dotnet-nuget-why-1.png new file mode 100644 index 000000000..b8422c44e Binary files /dev/null and b/docs/concepts/media/dotnet-nuget-why-1.png differ diff --git a/docs/concepts/media/github-copilot-agent-settings.png b/docs/concepts/media/github-copilot-agent-settings.png new file mode 100644 index 000000000..2b998ee35 Binary files /dev/null and b/docs/concepts/media/github-copilot-agent-settings.png differ diff --git a/docs/concepts/media/pm-ui-transitive-tooltip-1.png b/docs/concepts/media/pm-ui-transitive-tooltip-1.png new file mode 100644 index 000000000..d83e6bced Binary files /dev/null and b/docs/concepts/media/pm-ui-transitive-tooltip-1.png differ diff --git a/docs/concepts/media/vs-solution-explorer-search-options-1.png b/docs/concepts/media/vs-solution-explorer-search-options-1.png new file mode 100644 index 000000000..870c39a8a Binary files /dev/null and b/docs/concepts/media/vs-solution-explorer-search-options-1.png differ diff --git a/docs/concepts/media/vs-solution-explorer-search-results-1.png b/docs/concepts/media/vs-solution-explorer-search-results-1.png new file mode 100644 index 000000000..00e30fedd Binary files /dev/null and b/docs/concepts/media/vs-solution-explorer-search-results-1.png differ diff --git a/docs/concepts/nuget-mcp.md b/docs/concepts/nuget-mcp.md new file mode 100644 index 000000000..42eeaa5af --- /dev/null +++ b/docs/concepts/nuget-mcp.md @@ -0,0 +1,81 @@ +--- +title: MCP servers in NuGet packages +description: How can MCP servers be distributed using NuGet? +author: joelverhagen +ms.author: jver +ms.topic: article +ms.date: 07/23/2025 +--- + +# MCP servers in NuGet packages + +NuGet provides a convenient way to package and distribute MCP servers written in .NET. The C# MCP SDK and .NET offer a robust platform for building MCP servers, and NuGet is ideal for delivering your MCP server to end users as a local tool. Self-contained, platform-specific packages reduce runtime compatibility issues, and AOT compilation can further improve the end-user experience. + +For more information about the Model Context Protocol (MCP) in general, see the [introduction on the MCP website](https://modelcontextprotocol.io/introduction). To create your own MCP server and package it using NuGet, see the [quickstart guide](/dotnet/ai/quickstarts/build-mcp-server). + +## Applicable scenarios + +Shipping your MCP server via NuGet does not apply to all situations. The term "MCP client" is used in this document and refers to an application that orchestrates the interaction between an AI agent or LLM and calls made to an MCP server. Some example MCP clients are [Visual Studio Code](https://code.visualstudio.com/docs/copilot/chat/mcp-servers), [Visual Studio](/visualstudio/ide/mcp-servers), [GitHub Copilot coding agent](https://docs.github.com/copilot/concepts/coding-agent/about-copilot-coding-agent), Claude Code, or Cursor. + +Consider the following criteria to determine whether shipping your MCP server as a NuGet package makes sense: + +- ✅ You want your MCP server to run **locally** on the user's system (i.e., in the same context as the MCP client). + - Local MCP servers, such as those shipped in NuGet packages, run in the same context as the MCP client and communicate with the MCP client via standard IO (stdio) transport. The MCP client is responsible for launching the local MCP server process. +- ✅ The .NET SDK is available to the MCP client. + - NuGet MCP servers are [.NET tool packages](/dotnet/core/tools/global-tools), which are installed and executed using `dnx` from the .NET SDK. +- ✅ You have a NuGet package feed to host your MCP server package. + - NuGet.org can be used to publish MCP server packages and provides a tailored MCP browsing and consumption experience. However, any NuGet package feed, such as Azure Artifacts, can be used for hosting MCP servers if you wish to keep your MCP server package private. + +## Benefits of using .NET and NuGet for MCP servers + +There are several benefits to using NuGet for hosting your MCP server: + +- **Official SDK** - the [MCP C# SDK](https://github.com/modelcontextprotocol/csharp-sdk) provides a familiar interface for implementing your MCP server in C# and makes it easy to expose tools to MCP clients. +- **Flexible runtime options** - the .NET SDK provides several options for how your MCP server is compiled and packaged. See the [runtime requirements](#runtime-requirements) section for details. +- **Discoverability and distribution** - NuGet.org provides a way to showcase your MCP server, allowing potential users to find your MCP server and easily use it from inside VS Code or Visual Studio. NuGet.org encourages the use of an embedded [`.mcp/server.json`](https://github.com/modelcontextprotocol/registry/blob/main/docs/server-json/README.md) to declare inputs and an `McpServer` package type to allow MCP servers to be differentiated from other tool or dependency packages. +- **Familiar authoring workflows** - if you already use NuGet for creating dependency packages, creating and publishing an MCP server will be a very similar experience. + +## Package download and execution + +To fetch a local MCP server, the code for the server must be located and downloaded using a mechanism (protocol) specific to the package ecosystem. This is generally done with a "single-shot" command which takes the package name and arguments to download and then execute the package as a command-line application. + +For NuGet-based MCP servers, we recommend using `dnx` (a new command shipped in .NET 10 Preview 6) to acquire and execute the package. `dnx` currently ships with the .NET SDK, but there [is discussion to include `dnx` in the .NET runtime](https://github.com/dotnet/sdk/issues/49796). + +A command to start an MCP server would look something like this: + +```bash +dnx NuGet.Mcp.Server@0.1.2-preview --yes +``` + +Environment variables and command-line arguments can both be used to configure your MCP server in custom ways. These inputs allow you to customize the behavior of your MCP server to suit specific needs. + +This will download the `NuGet.Mcp.Server` package of version `0.1.2-preview` from your configured package sources (NuGet.org by default), and launch the contained CLI tool. For an MCP server, you may see log messages appear in stderr, but the process will appear to hang. This is expected, since the process is waiting for MCP protocol messages over stdin from your MCP client. + +Typically, your MCP client will invoke this command via tool-specific MCP configuration, such as the `mcp.json` file used by Visual Studio Code and Visual Studio. + +All of these tools support installing alternate sources. For example, `dnx` supports installing from Azure DevOps using the `--source` parameter, allowing consumption of private MCP servers, as long as the needed credential or credential providers are configured. + +## Runtime requirements + +Once the package is downloaded, a runtime is needed to execute the code inside the package. .NET tool packages (and by extension NuGet-based MCP servers) support a variety of options for how the tool is compiled and packaged. These options allow you, the MCP server author, to decide which runtime requirements should be placed on the users of your MCP server. + +There are three main options for how to package your MCP server: + +1. **Framework-dependent**: Requires that the MCP client has access to a compatible .NET runtime. If `dnx` is being used to download and execute the package, a runtime will be available. +2. **Self-contained**: Bundles the runtime with the package. [Using trimming](/dotnet/core/deploying/trimming/trimming-options) can reduce the size of the package. Self-contained .NET tools use `true`. +3. **Ahead-of-time (AOT) compiled**: A self-contained package with AOT compilation enabled. See [native AOT deployment](/dotnet/core/deploying/native-aot/) for more information. AOT .NET tools use `true`. + +For MCP servers, we recommend using option #2 (self-contained package without AOT) because it eliminates the need for any specific .NET runtime version present in the user's environment. If you can guarantee a compatible runtime version on the intended execution environment, option #1 is reasonable. Option #3 (using AOT) is also a good option, but it forces you or your dependencies to make your code compatible with AOT compilation. The C# MCP SDK is AOT compatible, but other dependencies you intend to use may not yet be AOT compatible. + +Consider using the `mcpserver` template in the [Microsoft.Extensions.AI.Templates](https://www.nuget.org/packages/Microsoft.Extensions.AI.Templates) template package to use the latest recommended defaults. + +## Comparison to other ecosystems + +Other ecosystems have similar requirements and workflows for packaging and running MCP servers: + +- **NuGet/.NET**: Uses the `dnx` command to download and execute .NET tool packages. Requires the .NET SDK for `dnx`. Additional runtime dependencies can be bundled into the package. +- **npm**: Uses the `npx` command to download and execute npm packages, and install dependencies transitively. Requires Node.js. +- **Python**: Uses the `uvx` command to download and execute Python packages, and install dependencies transitively. Requires a Python runtime. +- **Docker**: Uses the `docker run` command to download and execute images. Requires the Docker Engine. Docker images can target multiple CPU architectures and provide excellent isolation, but are generally larger than NuGet, npm, or Python packages. + +In all of these cases, the MCP client needs to have the necessary ecosystem-specific tool (e.g., `dnx`, `npx`) to download and execute the package-based MCP server. diff --git a/docs/concepts/package-installation-process.md b/docs/concepts/package-installation-process.md index 7ca6863e8..76074a1c4 100644 --- a/docs/concepts/package-installation-process.md +++ b/docs/concepts/package-installation-process.md @@ -4,7 +4,7 @@ description: Detailed information about the package installation process author: JonDouglas ms.author: jodou ms.date: 06/20/2019 -ms.topic: conceptual +ms.topic: article --- # What happens when a NuGet package is installed? diff --git a/docs/concepts/troubleshooting-installed-packages.md b/docs/concepts/troubleshooting-installed-packages.md index 1b6c361b9..d06dfcebc 100644 --- a/docs/concepts/troubleshooting-installed-packages.md +++ b/docs/concepts/troubleshooting-installed-packages.md @@ -4,7 +4,7 @@ description: How to find which package source was used for individual packages author: JonDouglas ms.author: jodou ms.date: 03/26/2021 -ms.topic: conceptual +ms.topic: troubleshooting-general --- # Troubleshooting Installed Packages diff --git a/docs/consume-packages/Central-Package-Management.md b/docs/consume-packages/Central-Package-Management.md index 06890cf72..66f7e9744 100644 --- a/docs/consume-packages/Central-Package-Management.md +++ b/docs/consume-packages/Central-Package-Management.md @@ -1,45 +1,32 @@ --- title: Central Package Management -description: Manage your dependencies in a central location and how you can get started with central package management. +description: Manage your dependencies in a central location and learn how to get started with Central Package Management. author: jondouglas ms.author: jodou ms.date: 05/09/2022 -ms.topic: conceptual +ms.topic: article --- # Central Package Management (CPM) -Dependency management is a core feature of NuGet. Managing dependencies for a single project can be easy. Managing dependencies for multi-project solutions -can prove to be difficult as they start to scale in size and complexity. In situations where you manage common dependencies for many different projects, you -can leverage NuGet's central package management (CPM) features to do all of this from the ease of a single location. +Dependency management is a core feature of NuGet. +While managing dependencies for a single project is straightforward, it becomes increasingly complex as the number of projects in a solution grows. -Historically, NuGet package dependencies have been managed in one of two locations: +If you manage common dependencies for many different projects, you can leverage NuGet's Central Package Management (CPM) features to do all of this from a single, central location. -- `packages.config` - An XML file used in older project types to maintain the list of packages referenced by the project. -- `` - An XML element used in MSBuild projects defines NuGet package dependencies. +Central Package Management applies to all ``-based MSBuild projects (including [legacy CSPROJ](https://github.com/dotnet/project-system/blob/main/docs/feature-comparison.md)). -Starting with [NuGet 6.2](..\release-notes\NuGet-6.2.md), you can centrally manage your dependencies in your projects with the addition of a -`Directory.Packages.props` file and an MSBuild property. - -The feature is available across all NuGet integrated tooling, starting with the following versions. - -* [Visual Studio 2022 17.2](https://visualstudio.microsoft.com/downloads/) -* [.NET SDK 6.0.300](https://dotnet.microsoft.com/download/dotnet/6.0) -* [nuget.exe 6.2.0](https://www.nuget.org/downloads) - -Older tooling will ignore central package management configurations and features. To use this feature to the fullest extent, ensure all your build environments -use the latest compatible tooling versions. +## Enabling Central Package Management -Central package management applies to all ``-based MSBuild projects (including -[legacy CSPROJ](https://github.com/dotnet/project-system/blob/main/docs/feature-comparison.md)) as long as compatible tooling is used. +To get started with Central Package Management, create a `Directory.Packages.props` file at the root of your repository and set the MSBuild property `ManagePackageVersionsCentrally` to `true`. -## Enabling Central Package Management +You can create it manually, or use the .NET CLI: -To get started with central package management, you must create a `Directory.Packages.props` file at the root of your repository and set the MSBuild property -`ManagePackageVersionsCentrally` to `true`. +```shell +dotnet new packagesprops +``` -Inside, you then define each of the respective package versions required of your projects using `` elements that define the package ID and -version. +Inside `Directory.Packages.props`, define `` elements to specify the package IDs and versions used by your projects. ```xml @@ -47,13 +34,14 @@ version. true - + + ``` -For each project, you then define a `` but omit the `Version` attribute since the version will be attained from a corresponding -`` item. +In each project file, define `` elements without the `Version` attribute. +The version will be resolved from the corresponding `` entry in `Directory.Packages.props`. ```xml @@ -61,65 +49,107 @@ For each project, you then define a `` but omit the `Version net6.0 - + ``` -Now you're using central package management and managing your versions in a central location! +Now you're using Central Package Management and managing your versions in a central location! -## Central Package Management rules +## Central Package Management Rules -The `Directory.Packages.props` file has a number of rules with regards to where it's located in a repository's directory and its context. For the sake of -simplicity, only one `Directory.Packages.props` file is evaluated for a given project. +The `Directory.Packages.props` file has specific rules regarding its location and context within a repository. +Only one `Directory.Packages.props` file is evaluated for a given project by default. -What this means is that if you had multiple `Directory.Packages.props` files in your repository, the file that is closest to your project's directory will -be evaluated for it. This allows you extra control at various levels of your repository. +If you have multiple `Directory.Packages.props` files in your repository, the file closest to a given project's directory will be evaluated for it. +This allows extra control at various levels of your repository. -Here's an example, consider the following repository structure: +Consider the following repository directory structure: ``` -Repository - |-- Directory.Packages.props - |-- Solution1 - |-- Directory.Packages.props - |-- Project1 - |-- Solution2 - |-- Project2 +📂 (root) + ├─📄 Directory.Packages.props + | + ├─📂Solution1 + | ├─ 📄Directory.Packages.props + | | + | └─ 📂 Project1 + | └─📄Project1.csproj + | + └─ 📂 Solution2 + └─ 📂 Project2 + └─ 📄 Project2.csproj +``` + +`Project1.csproj` will use the `Directory.Packages.props` file in the `Repository\Solution1\` directory. +If you want to include settings from a parent `Directory.Packages.props`, you must manually import it. + +```xml + + + + + + ``` -- Project1 will evaluate the `Directory.Packages.props` file in the `Repository\Solution1\` directory and it must manually import the next one if so desired. - ```xml - - - - - - - ``` -- Project2 will evaluate the `Directory.Packages.props` file in the `Repository\` directory. +`Project2.csproj` will evaluate the `Directory.Packages.props` file in the root directory. -**Note:** MSBuild will not automatically import each `Directory.Packages.props` for you, only the first one closest to the project. If you have multiple -`Directory.Packages.props`, you must import the parent one manually while the root `Directory.Packages.props` would not. +> [!NOTE] +> MSBuild will only automatically import the first `Directory.Packages.props` file it finds in the project directory or any parent directory. +> If you have multiple such files, you must manually import parent files as needed. -## Get started +## Getting Started -To fully onboard your repository, consider taking these steps: +To fully onboard your repository, follow these steps: -1. Create a new file at the root of your repository named `Directory.Packages.props` that declares your centrally defined package versions and set - the MSBuild property `ManagePackageVersionsCentrally` to `true`. +1. Create a new file at the root of your repository named `Directory.Packages.props` that declares your centrally defined package versions and set the MSBuild property `ManagePackageVersionsCentrally` to `true`. 2. Declare `` items in your `Directory.Packages.props`. 3. Declare `` items without `Version` attributes in your project files. -For an idea of how central package management may look like, refer to our [samples repo](https://github.com/NuGet/Samples/tree/main/CentralPackageManagementExample). +For an example of how Central Package Management may look, refer to our [samples repository](https://github.com/NuGet/Samples/tree/main/CentralPackageManagementExample). + +## Using Different Versions for Different Target Frameworks + +As NuGet packages evolve, package owners may drop support for older target frameworks. +This can cause issues for developers of libraries that still target older frameworks but want to reference newer versions of packages for newer target frameworks. + +For example, if your project targets .NET Standard 2.0, .NET 8.0, and .NET Framework 4.7.2, but `PackageA` no longer supports .NET Standard 2.0 in its latest version, you can specify different versions for each target framework. + +```xml + + + netstandard2.0;net8.0;net472 + + + + + +``` + +In this case, define different versions for each target framework in your `Directory.Packages.props` using [MSBuild conditions](/visualstudio/msbuild/msbuild-conditions): + +```xml + + + true + + + + + + +``` + +## Transitive Pinning -## Transitive pinning +You can automatically override a transitive package version without an explicit top-level `` item by opting into a feature known as transitive pinning. +This promotes a transitive dependency to a top-level dependency implicitly on your behalf when necessary. -You can automatically override a transitive package version even without an explicit top-level `` by opting into a feature known as -transitive pinning. This promotes a transitive dependency to a top-level dependency implicitly on your behalf when necessary. +Note that downgrades are not allowed when transitive pinning a package. +If you attempt to pin a package to a lower version than the one requested by your dependencies, restore will raise a [NU1109](../reference/errors-and-warnings/NU1109.md) error. -You can enable this feature by setting the MSBuild property `CentralPackageTransitivePinningEnabled` to `true` in a project or in a `Directory.Packages.props` -or `Directory.Build.props` import file: +You can enable this feature by setting the MSBuild property `CentralPackageTransitivePinningEnabled` to `true` in a project or in a `Directory.Packages.props` or `Directory.Build.props` import file: ```xml @@ -127,10 +157,49 @@ or `Directory.Build.props` import file: ``` -## Overriding package versions +### Transitive Pinning and Pack + +When a package is transitively pinned, your project uses a higher version than the one requested by your dependencies. +If you create a package from your project, to ensure that your package will work, NuGet will promote the transitively pinned dependencies to explicit dependencies in the nuspec. + +In the following example, `PackageA 1.0.0` has a dependency on `PackageB 1.0.0`. + +```xml + + + + + + +``` + +```xml + + + true + net6.0 + + + + + +``` + +When you use the pack command to create a package, both packages will appear in the dependency group. + +```xml + + + + +``` + +Because of this, the use of transitive pinning should be carefully evaluated when authoring a library, as it may lead to dependencies you did not expect. -You can override an individual package version by using the `VersionOverride` property on a `` item. This overrides any `` -defined centrally. +## Overriding Package Versions + +You can override an individual package version by using the `VersionOverride` property on a `` item. +This will take precedence over any centrally defined ``. ```xml @@ -152,8 +221,7 @@ defined centrally. ``` -You can disable this feature by setting the MSBuild property `CentralPackageVersionOverrideEnabled` to `false` in a project or in a `Directory.Packages.props` or -`Directory.Build.props` import file: +You can disable this feature by setting the MSBuild property `CentralPackageVersionOverrideEnabled` to `false` in a project or in a `Directory.Packages.props` or `Directory.Build.props` import file: ```xml @@ -161,13 +229,11 @@ You can disable this feature by setting the MSBuild property `CentralPackageVers ``` -When this feature is disabled, specifying a `VersionOverride` on any `` item will result in an error at restore time indicating that -the feature is disabled. +When this feature is disabled, specifying a `VersionOverride` on any `` item will result in an error at restore time indicating that the feature is disabled. ## Disabling Central Package Management -If you'd like to disable central package management for any a particular project, you can disable it by setting the MSBuild property -`ManagePackageVersionsCentrally` to `false`: +To disable Central Package Management for a specific project, set the MSBuild property `ManagePackageVersionsCentrally` to `false`: ```xml @@ -176,17 +242,19 @@ If you'd like to disable central package management for any a particular project ``` ## Global Package References -> [!Note] + +> [!NOTE] > This feature is only available in Visual Studio 2022 17.4 or higher, .NET SDK 7.0.100.preview7 or higher, and NuGet 6.4 or higher. -A global package reference is used to specify that a package will be used by every project in a repository. This includes packages that do versioning, extend your build, or any other packages that are needed by all projects. Global package references are added to the PackageReference item group with the following metadata: +A global package reference is used to specify that a package will be used by every project in a repository. +This includes packages that do versioning, extend your build, or any other packages that are needed by all projects. +Global package references are added to the PackageReference item group with the following metadata: * `IncludeAssets="Runtime;Build;Native;contentFiles;Analyzers"`
- This ensures that the package is only used as a development dependency and prevents any compile-time assembly references. + This ensures that the package is only used as a development dependency and prevents it from being included as a compile-time assembly reference. * `PrivateAssets="All"`
This prevents global package references from being picked up by downstream dependencies. - `GlobalPackageReference` items should be placed in your `Directory.Packages.props` to be used by every project in a repository: ```xml @@ -197,16 +265,11 @@ A global package reference is used to specify that a package will be used by eve ``` -## Warning when using multiple package sources +## NU1507 Warning When Using Multiple Package Sources -When using central package management, you will see a `NU1507` warning if you have more than one package source defined in your configuration. To resolve -this warning, map your package sources with [package source mapping](https://aka.ms/nuget-package-source-mapping) or specify a single package source. +When using Central Package Management, NuGet will log an [`NU1507`](../reference/errors-and-warnings/nu1507.md) warning if more than one package source is defined in your configuration. +To resolve this warning, map your package sources with [package source mapping](https://aka.ms/nuget-package-source-mapping) or specify a single package source. ``` -There are 3 package sources defined in your configuration. When using central package management, please map your package sources with package source mapping (https://aka.ms/nuget-package-source-mapping) or specify a single package source. +There are 3 package sources defined in your configuration. When using Central Package Management, please map your package sources with package source mapping (https://aka.ms/nuget-package-source-mapping) or specify a single package source. ``` - - - -> [!Note] -> Central package management is in active development. We appreciate you trying it out and providing any feedback you may have at [NuGet/Home](https://github.com/nuget/home/issues). diff --git a/docs/consume-packages/Finding-and-Choosing-Packages.md b/docs/consume-packages/Finding-and-Choosing-Packages.md index 34990c486..fef94e0cd 100644 --- a/docs/consume-packages/Finding-and-Choosing-Packages.md +++ b/docs/consume-packages/Finding-and-Choosing-Packages.md @@ -3,8 +3,8 @@ title: Find and evaluate NuGet packages description: Find and evaluate publicly available NuGet packages for your project by using advanced nuget.org search filters and syntax. author: JonDouglas ms.author: jodou -ms.date: 02/08/2024 -ms.topic: conceptual +ms.date: 03/03/2025 +ms.topic: how-to --- # Find and evaluate NuGet packages for your project diff --git a/docs/consume-packages/Overview-and-Workflow.md b/docs/consume-packages/Overview-and-Workflow.md index 4c47052ab..b9bc8f527 100644 --- a/docs/consume-packages/Overview-and-Workflow.md +++ b/docs/consume-packages/Overview-and-Workflow.md @@ -4,7 +4,7 @@ description: An overview of the process of consuming NuGet packages in a project author: JonDouglas ms.author: jodou ms.date: 03/22/2018 -ms.topic: conceptual +ms.topic: concept-article --- # Package consumption workflow diff --git a/docs/consume-packages/Package-References-in-Project-Files.md b/docs/consume-packages/Package-References-in-Project-Files.md index c243db7e7..d9290e3cd 100644 --- a/docs/consume-packages/Package-References-in-Project-Files.md +++ b/docs/consume-packages/Package-References-in-Project-Files.md @@ -4,20 +4,20 @@ description: Details on NuGet PackageReference in project files as supported by author: nkolev92 ms.author: nikolev ms.date: 4/6/2022 -ms.topic: conceptual +ms.topic: article --- # `PackageReference` in project files Package references, using `` MSBuild items, specify NuGet package dependencies directly within project files, as opposed to having a separate `packages.config` file. Use of PackageReference doesn't affect other aspects of NuGet; for example, settings in `NuGet.Config` files (including package sources) are still applied as explained in [Common NuGet configurations](configuring-nuget-behavior.md). -With PackageReference, you can also use MSBuild conditions to choose package references per target framework, or other groupings. It also allows for fine-grained control over dependencies and content flow. (See For more details [NuGet pack and restore as MSBuild targets](../reference/msbuild-targets.md).) +With PackageReference, you can also use MSBuild conditions to choose package references per target framework, or other groupings. It also allows for fine-grained control over dependencies and content flow. (For more information, see [NuGet pack and restore as MSBuild targets](../reference/msbuild-targets.md).) ## Project type support -By default, PackageReference is used for .NET Core projects, .NET Standard projects, and UWP projects targeting Windows 10 Build 15063 (Creators Update) and later, with the exception of C++ UWP projects. .NET Framework projects support PackageReference, but currently default to `packages.config`. To use PackageReference, [migrate](../consume-packages/migrate-packages-config-to-package-reference.md) the dependencies from `packages.config` into your project file, then remove packages.config. +By default, PackageReference is used for .NET projects, .NET Standard projects, and UWP projects targeting Windows 10 Build 15063 (Creators Update) and later, with the exception of C++ UWP projects. .NET Framework projects support PackageReference, but currently default to `packages.config`. To use PackageReference in a .NET Framework project, [migrate](../consume-packages/migrate-packages-config-to-package-reference.md) the dependencies from `packages.config` into your project file, then remove packages.config. -ASP.NET apps targeting the full .NET Framework include only [limited support](https://github.com/NuGet/Home/issues/5877) for PackageReference. C++ and JavaScript project types are unsupported. +ASP.NET apps that target the full .NET Framework include only [limited support](https://github.com/NuGet/Home/issues/5877) for PackageReference. C++ and JavaScript project types are unsupported. ## Adding a PackageReference @@ -43,7 +43,7 @@ The convention for specifying the version of a package is the same as when using ``` -In the example above, 3.6.0 means any version that is >=3.6.0 with preference for the lowest version, as described on [Package versioning](../concepts/package-versioning.md#version-ranges). +In the example above, 3.6.0 means any version that is >=3.6.0 with preference for the lowest version, as described in [Package versioning](../concepts/package-versioning.md#version-ranges). ## Using PackageReference for a project with no package dependencies @@ -57,11 +57,11 @@ Advanced: If you have no packages installed in a project (no PackageReferences i ``` -This may be useful, if you reference projects which are PackageReference styled (existing csproj or SDK-style projects). This will enable packages that those projects refer to, to be "transitively" referenced by your project. +This might be useful if you reference projects that are PackageReference styled (existing csproj or SDK-style projects). This will enable packages that those projects refer to, to be "transitively" referenced by your project. ## PackageReference and sources -In PackageReference projects, the transitive dependency versions are resolved at restore time. As such, in PackageReference projects all sources need to be available for all restores. +In PackageReference projects, the transitive dependency versions are resolved at restore time. As such, in PackageReference projects, all sources need to be available for all restores. ## Floating Versions @@ -94,13 +94,13 @@ You might be using a dependency purely as a development harness and might not wa The following metadata tags control dependency assets: -| Tag | Description | Default Value | -| --- | --- | --- | -| IncludeAssets | These assets will be consumed | all | -| ExcludeAssets | These assets will not be consumed | none | +| Tag | Description | Default Value | +|---------------|--------------------------------------------------------------------|------------------------------| +| IncludeAssets | These assets will be consumed | all | +| ExcludeAssets | These assets will not be consumed | none | | PrivateAssets | These assets will be consumed but won't flow to the parent project | contentfiles;analyzers;build | -Allowable values for these tags are as follows, with multiple values separated by a semicolon except with `all` and `none` which must appear by themselves: +Allowable values for these tags are as follows, with multiple values separated by a semicolon except for `all` and `none`, which must appear by themselves: | Value | Description | | --- | --- @@ -143,9 +143,9 @@ Note that because `build` is not included with `PrivateAssets`, targets and prop ## Adding a PackageReference condition -You can use a condition to control whether a package is included, where conditions can use any MSBuild variable or a variable defined in the targets or props file. However, at presently, only the `TargetFramework` variable is supported. +You can use a condition to control whether a package is included. Conditions can use any MSBuild variable or a variable defined in the targets or props file. However, at present, only the `TargetFramework` variable is supported. -For example, say you're targeting `netstandard1.4` as well as `net452` but have a dependency that is applicable only for `net452`. In this case you don't want a `netstandard1.4` project that's consuming your package to add that unnecessary dependency. To prevent this, you specify a condition on the `PackageReference` as follows: +For example, say you're targeting `netstandard1.4` as well as `net452` but have a dependency that's applicable only for `net452`. In this case you don't want a `netstandard1.4` project that consumes your package to add that unnecessary dependency. To prevent this, you specify a condition on the `PackageReference` as follows: ```xml @@ -191,7 +191,7 @@ Example: ```` -Additionally NuGet will automatically generate properties for packages containing a tools folder. +Additionally NuGet automatically generates properties for packages containing a tools folder. ```xml @@ -206,12 +206,12 @@ Additionally NuGet will automatically generate properties for packages containin MSBuild properties and package identities do not have the same restrictions so the package identity needs to be changed to an MSBuild friendly name, prefixed by the word `Pkg`. To verify the exact name of the property generated, look at the generated [nuget.g.props](../reference/msbuild-targets.md#restore-outputs) file. -## PackageReference Aliases +## PackageReference aliases -In some rare instances different packages will contain classes in the same namespace. Starting with NuGet 5.7 & Visual Studio 2019 Update 7, equivalent to ProjectReference, PackageReference supports [`Aliases`](/dotnet/api/microsoft.codeanalysis.projectreference.aliases). -By default no aliases are provided. When an alias is specified, *all* assemblies coming from the annotated package with need to be referenced with an alias. +In some rare instances, different packages will contain classes in the same namespace. Starting with NuGet 5.7 & Visual Studio 2019 Update 7, equivalent to ProjectReference, PackageReference supports [`Aliases`](/dotnet/api/microsoft.codeanalysis.projectreference.aliases). +By default, no aliases are provided. When an alias is specified, *all* assemblies coming from the annotated package need to be referenced with an alias. -You can look at sample usage at [NuGet\Samples](https://github.com/NuGet/Samples/tree/main/PackageReferenceAliasesExample) +You can look at sample usage at [NuGet\Samples](https://github.com/NuGet/Samples/tree/main/PackageReferenceAliasesExample). In the project file, specify the aliases as follows: @@ -221,7 +221,7 @@ In the project file, specify the aliases as follows: ``` -and in the code use it as follows: +And in the code, use it as follows: ```cs extern alias ExampleAlias; @@ -246,8 +246,8 @@ For many pack and restore scenarios, all NuGet warnings and errors are coded, an NuGet observes the following warning properties: -- `TreatWarningsAsErrors`, treat all warnings as errors -- `WarningsAsErrors`, treat specific warnings as errors +- `TreatWarningsAsErrors`, treat all warnings as errors. +- `WarningsAsErrors`, treat specific warnings as errors. - `NoWarn`, hide specific warnings, either project-wide or package-wide. Examples: @@ -285,7 +285,7 @@ To suppress a warning project wide, consider doing: ``` -Sometimes warnings apply only to a certain package in the graph. We can choose to suppress that warning more selectively by adding a `NoWarn` on the PackageReference item. +Sometimes warnings apply only to a certain package in the graph. You can choose to suppress that warning more selectively by adding a `NoWarn` on the PackageReference item. ```xml @@ -307,19 +307,19 @@ When in Visual Studio, you can also [suppress warnings](/visualstudio/ide/how-to Input to NuGet restore is a set of `PackageReference` items from the project file (top-level or direct dependencies) and the output is a full closure of all the package dependencies including transitive dependencies. NuGet tries to always produce the same full closure of package dependencies if the input PackageReference list has not changed. However, there are some scenarios where it is unable to do so. For example: -* When you use floating versions like ``. While the intention here is to float to the latest version on every restore of packages, there are scenarios where users require the graph to be locked to a certain latest version and float to a later version, if available, upon an explicit gesture. -* A newer version of the package matching PackageReference version requirements is published. E.g. +- When you use floating versions like ``. While the intention here is to float to the latest version on every restore of packages, there are scenarios where users require the graph to be locked to a certain latest version and float to a later version, if available, upon an explicit gesture. +- A newer version of the package matching PackageReference version requirements is published. For example: - * Day 1: if you specified `` but the versions available on the - NuGet repositories were 4.1.0, 4.2.0 and 4.3.0. In this case, NuGet would have resolved to 4.1.0 (nearest minimum version) + - Day 1: if you specified `` but the versions available on the + NuGet repositories were 4.1.0, 4.2.0, and 4.3.0. In this case, NuGet would have resolved to 4.1.0 (nearest minimum version). - * Day 2: Version 4.0.0 gets published. NuGet will now find the exact match and start resolving to 4.0.0 + - Day 2: Version 4.0.0 gets published. NuGet will now find the exact match and start resolving to 4.0.0. -* A given package version is removed from the repository. Though nuget.org does not allow package deletions, not all package repositories have this constraint. This results in NuGet finding the best match when it cannot resolve to the deleted version. +- A given package version is removed from the repository. Though nuget.org does not allow package deletions, not all package repositories have this constraint. This results in NuGet finding the best match when it cannot resolve to the deleted version. ### Enabling the lock file -In order to persist the full closure of package dependencies you can opt-in to the lock file feature by setting the MSBuild property `RestorePackagesWithLockFile` for your project: +In order to persist the full closure of package dependencies, you can opt-in to the lock file feature by setting the MSBuild property `RestorePackagesWithLockFile` for your project: ```xml @@ -329,13 +329,14 @@ In order to persist the full closure of package dependencies you can opt-in to t ``` -If this property is set, NuGet restore will generate a lock file - `packages.lock.json` file at the project root directory that lists all the package dependencies. +If this property is set, NuGet restore will generate a lock file (`packages.lock.json`) at the project root directory that lists all the package dependencies. > [!Note] > Once a project has `packages.lock.json` file in its root directory, the lock file is always used with restore even if the property `RestorePackagesWithLockFile` is not set. So another way to opt-in to this feature is to create a dummy blank `packages.lock.json` file in the project's root directory. ### `restore` behavior with lock file -If a lock file is present for project, NuGet uses this lock file to run `restore`. NuGet does a quick check to see if there were any changes in the package dependencies as mentioned in the project file (or dependent projects' files) and if there were no changes it just restores the packages mentioned in the lock file. There is no re-evaluation of package dependencies. + +If a lock file is present for a project, NuGet uses this lock file to run `restore`. NuGet does a quick check to see if there were any changes in the package dependencies as mentioned in the project file (or dependent projects' files), and if there were no changes, it just restores the packages mentioned in the lock file. There is no re-evaluation of package dependencies. If NuGet detects a change in the defined dependencies as mentioned in the project file(s), it re-evaluates the package graph and updates the lock file to reflect the new package closure for the project. @@ -353,7 +354,7 @@ For msbuild.exe, run: > msbuild.exe -t:restore -p:RestoreLockedMode=true ``` -You may also set this conditional MSBuild property in your project file: +You can also set this conditional MSBuild property in your project file: ```xml @@ -365,12 +366,21 @@ You may also set this conditional MSBuild property in your project file: If locked mode is `true`, restore will either restore the exact packages as listed in the lock file or fail if you updated the defined package dependencies for the project after lock file was created. +#### Lock files and PrunePackageReference + +[PrunePackageReference](#prunepackagereference) changes the dependencies of a project, by removing unnecessary transitive packages. +While removing these packages should not have an impact at runtime, it will affect lock files. +If you enable pruning for an existing project, whenever the lock file gets regenerated, it may lead to fewer packages than before pruning. +The lock file up to date check that powers locked mode is pruning aware, which means if you enabled pruning on a project, the check will account for packages that are pruned. +However the next time the lock file is regenerated, it will exclude the pruned packages, so you may see a diff that's larger than usual. + ### Make lock file part of your source repository -If you are building an application, an executable and the project in question is at the start of the dependency chain then do check in the lock file to the source code repository so that NuGet can make use of it during restore. -However, if your project is a library project that you do not ship or a common code project on which other projects depend upon, you **should not** check in the lock file as part of your source code. There is no harm in keeping the lock file but the locked package dependencies for the common code project may not be used, as listed in the lock file, during the restore/build of a project that depends on this common-code project. +If you are building an application, an executable, and the project in question is at the start of the dependency chain, then do check in the lock file to the source code repository so that NuGet can make use of it during restore. -Eg. +However, if your project is a library project that you do not ship or a common code project on which other projects depend, you **should not** check in the lock file as part of your source code. There is no harm in keeping the lock file, but the locked package dependencies for the common code project can't be used, as listed in the lock file, during the restore/build of a project that depends on this common-code project. + +Example: ``` ProjectA @@ -388,10 +398,47 @@ You can control various behaviors of restore with lock file as described below: | NuGet.exe option | dotnet option | MSBuild equivalent option | Description | |:--- |:--- |:--- |:--- | | `-UseLockFile` |`--use-lock-file` | RestorePackagesWithLockFile | Opts into the usage of a lock file. | -| `-LockedMode` | `--locked-mode` | RestoreLockedMode | Enables locked mode for restore. This is useful in CI/CD scenarios where you want repeatable builds.| +| `-LockedMode` | `--locked-mode` | RestoreLockedMode | Enables locked mode for restore. This is useful in CI/CD scenarios where you want repeatable builds.| | `-ForceEvaluate` | `--force-evaluate` | RestoreForceEvaluate | This option is useful with packages with floating version defined in the project. By default, NuGet restore will not update the package version automatically upon each restore unless you run restore with this option. | | `-LockFilePath` | `--lock-file-path` | NuGetLockFilePath | Defines a custom lock file location for a project. By default, NuGet supports `packages.lock.json` at the root directory. If you have multiple projects in the same directory, NuGet supports project specific lock file `packages..lock.json` | +## NuGet Dependency Resolver + +The NuGet dependency resolver follows the [four rules as described in the dependency resolution document](../../docs/concepts/Dependency-Resolution.md). + +In order to improve the performance and scalability of the restore operation, the restore algorithm was rewritten in the 6.12 release. +As of the 6.12 release, the new restore algorithm is enabled by default for all PackageReference projects. +While the new restore algorithm is is functionally equivalent to the previous one, as with any software, bugs are possible. +To revert to the previous implementation, set the MSBuild property `RestoreUseLegacyDependencyResolver` to `true`. + +Should you face restore failures in 6.12, .NET 9 or 17.12, that weren't reproducing in earlier versions, please [file an issue on GitHub](https://github.com/NuGet/Home/issues/). +Any differences between the old and new algorithms may have different impacts, such as during compilation or at runtime. +There's also a chance that changes don't lead to failures, but different package versions being restored. +If you think you might be impacted by any changes, here are the steps you can take to verify whether the changes in the NuGet restore algorithm are the root cause. + +Restore writes its results in the `MSBuildProjectExtensionsPath` directory, which can be compared with the new and old algorithms to find differences. +Usually this is the `obj` folder of your build. +You can use `msbuild.exe` or `dotnet.exe` for the next steps. + +1. Remove the `obj` folder for your project. +1. Run `msbuild -t:restore` +1. Save the contents of the `obj` to a location indicating that it's the `new` behavior. +1. Run `msbuild -t:restore -p:RestoreUseLegacyDependencyResolver="true"`. +1. Save the contents of the `obj` to a location indicating that it's the `legacy` behavior. +1. Compare the files in the two directories, particularly *project.assets.json*. + + Tools that can highlight differences are especially useful for this (for example, in Visual Studio Code, open both files, and use the right-click "select for compare" and "compare to selected"). + +If you follow the above method, there should be exactly 1 difference between the `project.assets.json` files: + +```diff + "projectStyle": "PackageReference", ++ "restoreUseLegacyDependencyResolver": true, + "fallbackFolders": [ +``` + +If there are any more differences, please [file an issue on GitHub](https://github.com/NuGet/Home/issues/) with all the details. + ## AssetTargetFallback The `AssetTargetFallback` property lets you specify additional compatible framework versions for projects that your project references and NuGet packages that your project consumes. @@ -422,3 +469,90 @@ You can leave off `$(AssetTargetFallback)` if you wish to overwrite, instead of > If you are using a [.NET SDK based project](/dotnet/core/sdk), appropriate `$(AssetTargetFallback)` values are configured and you do not need to set them manually. > > `$(PackageTargetFallback)` was an earlier feature that attempted to address this challenge, but it is fundamentally broken and *should* not be used. To migrate from `$(PackageTargetFallback)` to `$(AssetTargetFallback)`, simply change the property name. + +## PrunePackageReference + +The .NET Runtime is constantly evolving, with performance improvements and new APIs each release. +New features added to .NET are also sometimes provided as packages, so that developers using older target frameworks can use the library, such as [System.Text.Json](https://www.nuget.org/packages/System.Text.Json). +This can often lead to a `System.Text.Json 8.0.0` in a project targeting `.NET 9` or `.NET 8`. This dependency is unnecessary and the build conflict resolution would not use the assembly coming from the package since it's already available in the .NET Runtime. +Starting in [NuGet version 6.13](..\release-notes\NuGet-6.13.md) and .NET SDK 9.0.200, `PrunePackageReference` enables the pruning of these packages at restore time for .NET SDK based projects. +The first iteration of pruning affected transitive packages only, but starting with .NET SDK 10, package pruning affects direct packages as well. + +Package pruning is available as an opt-in feature with the .NET 9 SDK, and is enabled by default for all frameworks of a project that targets `>= .NET 10.0` in the .NET 10 SDK. + +Package pruning is only available with the default dependency resolver as [released in 6.12](#nuget-dependency-resolver). + +### PrunePackageReference specification + +The list of packages to be pruned is defined with the `PrunePackageReference` item. + +| Attributes | Description | +|------------|-------------| +| Version | Specifies the maximum version to be pruned. `1.0.0` means that all packages up to and including 1.0.0 will be pruned. For `1.0.0`, `0.9.0` and `1.0.0` will be pruned, but `1.0.1` would not. | + +The following properties can be used to modify the pruning behavior. + +| PropertyName | Description | +|--------------|-------------| +| RestoreEnablePackagePruning | Enables package pruning for the packages specified with `PrunePackageReference`. This property is per target framework and the valid values are `true` and `false`. Defaults may differ based on the .NET SDK as defined above. | + +The .NET SDK predefines the list of packages to be pruned for you. + +### How PrunePackageReference works + +When a package is specified to be pruned during restore, it is removed from the dependency graph. +When a package is pruned, there is a message, visible at detailed verbosity, indicating that the package has been removed for the given target framework. + +For transitive packages, meaning dependencies of other packages or projects, the packages are not downloaded and do not appear in any of the outputs of NuGet. + +For direct packages, `PrivateAssets='all'` and `IncludeAssets='none'` are implicitly applied. + +- `IncludeAssets='none'` ensures that the assemblies from this package are not used during the build. Before pruning existed, the conflict resolution during the build ensured that platform assemblies were preferred over those coming from the packages. +- `PrivateAssets='all'` ensures that the packages aren't included in packages or through project references. + +Example: + +A project like below: + +```xml + + net9.0;netstandard2.0 + + + + + +``` + +will have a nuspec with the following dependencies: + +```xml + + + + + + + +``` + +When a direct PackageReference can be completely removed from your project, and one of the project frameworks are .NET 10 or newer, [NU1510](../reference/errors-and-warnings/NU1510.md) will be raised asking you to remove the package. +Following this suggestion will reduce the complexity of your project graph. + +The following table summarizes all the package pruning behaviors. + +| Dependency disposition | Behavior | +|-----------------|----------| +| Matches the ID of a transitive package coming through another package | Prune | +| Matches the ID of a transitive package coming through another project | Prune | +| Matches the ID of a direct `PackageReference` | Apply `PrivateAssets='all'` and `IncludeAssets='none'` and raise the [NU1510](../reference/errors-and-warnings/NU1510.md) warning when the package can be removed from all frameworks and the project targets .NET 10. | +| Matches the ID of a `ProjectReference` | Do not prune and raise the [NU1511](../reference/errors-and-warnings/NU1511.md) warning when the project targets .NET 10 | + +### PrunePackageReference applications + +The benefits of package pruning are two-fold: + +- Performance benefits, by virtue of reducing the number of packages within a dependency graph +- Reduction of false positives by component scanners such as `NuGetAudit` + +Pruning is particularly valuable when [auditing](./../concepts/Auditing-Packages.md) packages with `NuGetAuditMode` set to `all`. If you are using .NET 9, we recommend you try out pruning by setting `RestoreEnablePackagePruning` to `true`. diff --git a/docs/consume-packages/Package-Restore.md b/docs/consume-packages/Package-Restore.md index 765f6ea9b..62f1f673f 100644 --- a/docs/consume-packages/Package-Restore.md +++ b/docs/consume-packages/Package-Restore.md @@ -4,7 +4,7 @@ description: See an overview of how NuGet restores packages a project depends on author: JonDouglas ms.author: jodou ms.date: 10/20/2023 -ms.topic: conceptual +ms.topic: how-to --- # Restore packages with NuGet Package Restore @@ -44,6 +44,7 @@ If the package references in your project file or your *packages.config* file ar If you have missing packages or package-related errors after you run Package Restore, such as error icons in Solution Explorer, follow the instructions in [Troubleshooting Package Restore errors](package-restore-troubleshooting.md), or [reinstall or update](../consume-packages/reinstalling-and-updating-packages.md) the packages. In Visual Studio, the Package Manager Console provides several options for reinstalling packages. For more information, see [Use Package-Update](reinstalling-and-updating-packages.md#update-package-command). + ## Restore packages in Visual Studio In Visual Studio on Windows, you can restore packages automatically or manually. First, configure Package Restore through **Tools** > **Options** > **NuGet Package Manager**. @@ -52,9 +53,10 @@ In Visual Studio on Windows, you can restore packages automatically or manually. Configure the following Package Restore options at **Tools** > **Options** > **NuGet Package Manager** > **General**. -![Screenshot that shows the NuGet Package Manager options.](media/Restore-01-AutoRestoreOptions.png) +![Screenshot that shows the NuGet Package Manager options.](media/vsoptions/general.png) + #### Allow NuGet to download missing packages Select **Allow NuGet to download missing packages** to enable package restore and the **Restore NuGet Packages** command. This selection sets the `packageRestore/enabled` setting to `True` in the [packageRestore section](../reference/nuget-config-file.md#packagerestore-section) of the global *NuGet.Config* file, at *%AppData%\\Roaming\\NuGet* on Windows or *~/.nuget/NuGet/* on Mac or Linux. @@ -87,20 +89,23 @@ Select **Automatically check for missing packages during build in Visual Studio* ``` -For non-SDK-style projects, you must select **Allow NuGet to download missing packages** as well as **Automatically check for missing packages during build in Visual Studio** in **Options** to enable automatic restore. +You must select **Allow NuGet to download missing packages** as well as **Automatically check for missing packages during build in Visual Studio** in **Options** to enable package restore during build. + #### Choose the default package management format NuGet has two package management formats, [PackageReference](Package-References-in-Project-Files.md) and [packages.config](../reference/packages-config.md). Select the format you want to use from the dropdown list under **Package Management**. You can also select whether to allow format selection on first package install. > [!Note] +> > - If a project doesn't support both package management formats, NuGet uses the package management format that's compatible with the project, which might not be the default you set in the options. NuGet then won't prompt for selection on first install, even if you selected that option. > > - If you use Package Manager Console to install the first package in a project, NuGet doesn't prompt for format selection, even if that option is selected in **Options**. + ### Restore packages manually or automatically After you enable package restore in **Options**, you can right-click the solution in **Solution Explorer** and select **Restore NuGet Packages** to restore packages anytime. @@ -112,6 +117,7 @@ For projects that use ``, you can see the package references i If you see the error **This project references NuGet package(s) that are missing on this computer**, or **One or more NuGet packages need to be restored but couldn't be because consent has not been granted**, make sure you enabled automatic restore. For older projects, see [Migrate to automatic package restore](#migrate-to-automatic-package-restore-visual-studio). Also see [Troubleshooting package restore errors](Package-restore-troubleshooting.md). + ## Restore by using the dotnet CLI [!INCLUDE [restore-dotnet-cli](includes/restore-dotnet-cli.md)] @@ -120,11 +126,13 @@ If you see the error **This project references NuGet package(s) that are missing > To add a missing package reference to the project file, use [dotnet add package](/dotnet/core/tools/dotnet-add-package), which also runs `restore`. + ## Restore by using the NuGet CLI [!INCLUDE [restore-nuget-exe-cli](includes/restore-nuget-exe-cli.md)] + ## Restore by using MSBuild You can use [msbuild -t:restore](../reference/msbuild-targets.md#restore-target) to restore packages in NuGet 4.x+ and MSBuild 15.1+, which are included with Visual Studio 2017 and higher. @@ -144,6 +152,7 @@ To use MSBuild restore: + ## Restore with Azure Pipelines or Azure DevOps Server When you create a build definition in Azure Pipelines, you can include the [NuGet CLI restore](/azure/devops/pipelines/tasks/package/nuget#restore-nuget-packages) or [dotnet CLI restore](/azure/devops/pipelines/tasks/build/dotnet-core-cli) task in the definition before any build tasks. Some build templates include the restore task by default. @@ -192,6 +201,7 @@ To avoid using packages in the HTTP cache: - For `nuget restore`, use the `-NoHttpCache` option, or for `dotnet restore`, use the `--no-http-cache` option. These options don't affect restore operations through the Visual Studio Package Manager or Console. + ## Migrate to automatic package restore Earlier versions of NuGet supported an MSBuild-integrated package restore. Projects that use the deprecated MSBuild-integrated package restore should migrate to automatic package restore. diff --git a/docs/consume-packages/Package-Source-Mapping.md b/docs/consume-packages/Package-Source-Mapping.md index ca6707525..5386bb61d 100644 --- a/docs/consume-packages/Package-Source-Mapping.md +++ b/docs/consume-packages/Package-Source-Mapping.md @@ -4,9 +4,7 @@ description: Describes package source mapping functionality and how to onboard author: nkolev92 ms.author: nikolev ms.date: 10/18/2023 -ms.topic: conceptual -f1_keywords: - - "vs.toolsoptionspages.nuget_package_manager.package_source_mapping" +ms.topic: how-to --- # Package Source Mapping @@ -21,6 +19,7 @@ We also have suggestions for other [best practices](..\concepts\Security-Best-Pr Package Source Mapping was added in [NuGet 6.0](..\release-notes\NuGet-6.0.md). Starting with Visual Studio 17.5, you can add and remove Package Source Mappings with the Visual Studio Options Dialog. +For detailed information on all Visual Studio NuGet options, see [NuGet Options in Visual Studio](nuget-visual-studio-options.md). ### Visual Studio support @@ -55,34 +54,23 @@ To opt into this feature, you must have a `nuget.config` file. Having a single ` _From the Package Manager UI_ -- Select a package from the list to show it in the Details Pane. -- Press the `Configure` button to open the Package Source Mappings options page. +* Select a package from the list to show it in the Details Pane. +* Press the `Configure` button to open the Package Source Mappings options page. ![The NuGet Package Manager window in Visual Studio showing a selected package, and a highlight around the "Package source mapping is off" status with a `Configure` button.](media/packageSourceMapping_PMUI_Status_Off_Annotated.png) _From the Visual Studio Options Dialog_ - - Go to the `Tools` menu in the main Visual Studio toolbar, and choose `NuGet Package Manager` -> `Package Manager Settings`. - - Navigate to the `Package Source Mappings` page. +* Go to the `Tools` menu in the main Visual Studio toolbar, and choose `NuGet Package Manager` -> `Package Manager Settings`. +* Navigate to the `Package Source Mappings` page. -![The Visual Studio `Package Source Mappings` Options Dialog showing no package source mappings, with an `Add` button to create a new mapping.](media/packageSourceMapping_VSOptions_NoMappings.png) +For details about managing NuGet package source mappings, see [NuGet Options in Visual Studio](nuget-visual-studio-options.md#package-source-mapping). -3. Press the `Add` button in the `Package Source Mappings` page to open the `Add Package Source Mappings` dialog. - -![The `Add Package Source Mappings` dialog](media/packageSourceMapping_VSOptions_AddMappingOpened.png) -4. Enter a Package ID or Package Pattern, and select one or more package source(s) by toggling the checkbox for your desired source(s). - -![The `Add Package Source Mappings` dialog with a filled package pattern and selected package source.](media/packageSourceMapping_VSOptions_AddMappingFilled.png) - -5. The `Package Source Mapping` options page will show the newly created source mapping. - -![The `Package Source Mapping` options page showing the newly created source mapping](media/packageSourceMapping_VSOptions_AddMappingCompleted.png) - -6. Press `OK` on the Options Dialog to save changes to the applicable `nuget.config`. -7. The NuGet Package Manager window will refresh and reflect the new status of the selected package's source mappings. +The NuGet Package Manager window will refresh and reflect the new status of the selected package's source mappings. ![The NuGet Package Manager window in Visual Studio showing a selected package with the "Package source mapping found" status with a `Configure` button.](media/packageSourceMapping_PMUI_Status_Mapped.png) ### Enable by manually editing `nuget.config` + * Declare your desired package sources in your `nuget.config` file. * Following your source declarations, add a `` element that specifies the desired mappings for each source. * Declare exactly one `packageSource` element for each source in use. @@ -124,9 +112,9 @@ For maximum flexibility and control, NuGet requires that all packages match a pa ### Package Pattern requirements -All requested packages must map to one or more sources by matching a defined package pattern. In other words, once you have defined a `packageSourceMapping` element you must explicitly define which sources *every* package - *including transitive packages* - will be restored from. +All requested packages must map to one or more sources by matching a defined package pattern. In other words, once you have defined a `packageSourceMapping` element you must explicitly define which sources _every_ package - _including transitive packages_ - will be restored from. -* Both top-level *and transitive* packages must match defined patterns. There is no requirement that a top level package and its dependencies come from the same source. +* Both top-level _and transitive_ packages must match defined patterns. There is no requirement that a top level package and its dependencies come from the same source. * The same ID pattern can be defined on multiple sources, allowing matching package IDs to be restored from any of the feeds that define the pattern. However, this isn't recommended due to the impact on restore predictability (a given package could come from multiple sources). This may be a valid configuration if you trust all respective sources. ### Package Pattern Syntax @@ -165,7 +153,7 @@ For manual onboarding you may take the following steps: 1. Run [dotnet restore](/dotnet/core/tools/dotnet-restore) to restore dependencies. 1. Run [`dotnet list package --include-transitive`](/dotnet/core/tools/dotnet-list-package#synopsis) to view all top-level and transitive packages in your solution. * For .NET framework projects using [`packages.config`](../reference/packages-config.md), the `packages.config` file will have a flat list of all direct and transitive packages. -1. Define mappings such that every package ID in your solution - *including transitive packages* - matches a pattern for the target source. +1. Define mappings such that every package ID in your solution - _including transitive packages_ - matches a pattern for the target source. 1. Run [dotnet nuget locals global-packages -c](/dotnet/core/tools/dotnet-nuget-locals) to clear global-packages directory. 1. Run restore to validate that you have configured your mappings correctly. If your mappings don't fully cover every package ID in your solution, the error messages will help you identify the issue. 1. When restore succeeds, you are done! Optionally consider: @@ -174,7 +162,7 @@ For manual onboarding you may take the following steps: #### Automated onboarding using tool -Many repositories have a large number of packages and doing the work manually can be time consuming. The [NuGet.PackageSourceMapper tool](https://www.nuget.org/packages/NuGet.PackageSourceMapper) can automatically generate a NuGet.config for you, based on your project's known packages and sources. +Many repositories have a large number of packages and doing the work manually can be time consuming. The [NuGet.PackageSourceMapper tool](https://www.nuget.org/packages/NuGet.PackageSourceMapper) can automatically generate a NuGet.config for you, based on your project's known packages and sources. The package source mapper tool requires you to have completed a successful package restore in which it will read each respective `.nupkg.metadata` file generated as part of your build to best understand how you map your respective packages and sources. Tool not only covers top dependencies it also considers all the transitive dependencies when generating mapping. @@ -183,6 +171,7 @@ Tool has several option how to generate mapping pattern depending on your need, For an idea of how your source mappings may look like, refer to our [samples repo](https://github.com/NuGet/Samples/tree/main/PackageSourceMappingExample). > [!Note] +> > * There are no nuget.exe or dotnet.exe commands for managing the package source mapping configuration, see [NuGet/Home#10735](https://github.com/NuGet/Home/issues/10735). > * There are no means of mapping packages at package installation time, see [NuGet/Home#10730](https://github.com/NuGet/Home/issues/10730). > * There is a limitation when using the `DotNetCoreCLI@2` Azure Pipelines task which can be worked around by using `feed-` prefixes in your source mapping configuration. It is recommended however to use `NuGetAuthenticate` for your authentication needs and call the dotnet cli directly from a script task. See [microsoft/azure-pipelines-tasks#15542](https://github.com/microsoft/azure-pipelines-tasks/issues/15542). diff --git a/docs/consume-packages/Package-restore-troubleshooting.md b/docs/consume-packages/Package-restore-troubleshooting.md index 704e12429..1bac3ac4f 100644 --- a/docs/consume-packages/Package-restore-troubleshooting.md +++ b/docs/consume-packages/Package-restore-troubleshooting.md @@ -4,12 +4,12 @@ description: A description of common NuGet restore errors in Visual Studio and h author: JonDouglas ms.author: jodou ms.date: 05/25/2018 -ms.topic: conceptual +ms.topic: troubleshooting-general --- # Troubleshooting package restore errors -This article focuses on common errors when restoring packages and steps to resolve them. +This article focuses on common errors when restoring packages and steps to resolve them. Package Restore tries to install all package dependencies to the correct state matching the package references in your project file (*.csproj*) or your *packages.config* file. (In Visual Studio, the references appear in Solution Explorer under the **Dependencies \ NuGet** or the **References** node.) To follow the required steps to restore packages, see [Restore packages](../consume-packages/package-restore.md#restore-packages). If the package references in your project file (*.csproj*) or your *packages.config* file are incorrect (they do not match your desired state following Package Restore), then you need to either install or update packages instead of using Package Restore. @@ -24,7 +24,7 @@ If you're using Visual Studio, first enable package restore as follows. Otherwis 1. Select **OK**. 1. Build your project again. -![Enable NuGet package restore in Tool/Options](../consume-packages/media/restore-01-autorestoreoptions.png) +![Enable NuGet package restore in Tool/Options](../consume-packages/media/vsoptions/general.png) These settings can also be changed in your `NuGet.Config` file; see the [consent](#consent) section. If your project is an older project that uses the MSBuild-integrated package restore, you may need to [migrate](package-restore.md#migrate-to-automatic-package-restore-visual-studio) to automatic package restore. diff --git a/docs/consume-packages/PackageDownload-Functionality.md b/docs/consume-packages/PackageDownload-Functionality.md index 2d926ad2e..8b5bb01b3 100644 --- a/docs/consume-packages/PackageDownload-Functionality.md +++ b/docs/consume-packages/PackageDownload-Functionality.md @@ -4,7 +4,7 @@ description: Describes the PackageDownload feature, which is a complement to Pac author: nkolev92 ms.author: nikolev ms.date: 12/22/2021 -ms.topic: conceptual +ms.topic: article --- # PackageDownload diff --git a/docs/consume-packages/Packages-and-Source-Control.md b/docs/consume-packages/Packages-and-Source-Control.md index dd01f03a7..2d7cb5516 100644 --- a/docs/consume-packages/Packages-and-Source-Control.md +++ b/docs/consume-packages/Packages-and-Source-Control.md @@ -4,7 +4,7 @@ description: Considerations for how to treat NuGet packages within version contr author: JonDouglas ms.author: jodou ms.date: 03/16/2018 -ms.topic: conceptual +ms.topic: how-to --- # Omitting NuGet packages in source control systems diff --git a/docs/consume-packages/Reinstalling-and-Updating-Packages.md b/docs/consume-packages/Reinstalling-and-Updating-Packages.md index 574b5257c..f4465e821 100644 --- a/docs/consume-packages/Reinstalling-and-Updating-Packages.md +++ b/docs/consume-packages/Reinstalling-and-Updating-Packages.md @@ -4,7 +4,7 @@ description: Learn how to reinstall and update NuGet packages to address broken author: JonDouglas ms.author: jodou ms.date: 11/03/2023 -ms.topic: conceptual +ms.topic: how-to --- # Reinstall and update NuGet packages in Visual Studio diff --git a/docs/consume-packages/Team-Foundation-Build.md b/docs/consume-packages/Team-Foundation-Build.md index 8d8fb405a..7b631ef7e 100644 --- a/docs/consume-packages/Team-Foundation-Build.md +++ b/docs/consume-packages/Team-Foundation-Build.md @@ -4,7 +4,7 @@ description: A walkthrough of how NuGet package restore with with Team Foundatio author: JonDouglas ms.author: jodou ms.date: 01/09/2017 -ms.topic: conceptual +ms.topic: concept-article --- # Setting up package restore with Team Foundation Build diff --git a/docs/consume-packages/configuring-nuget-behavior.md b/docs/consume-packages/configuring-nuget-behavior.md index fbc236e25..388cafd94 100644 --- a/docs/consume-packages/configuring-nuget-behavior.md +++ b/docs/consume-packages/configuring-nuget-behavior.md @@ -4,12 +4,12 @@ description: NuGet.Config files control NuGet's behavior, and can be modified wi author: JonDouglas ms.author: jodou ms.date: 01/10/2022 -ms.topic: conceptual +ms.topic: article --- # Common NuGet configurations -NuGet's behavior is driven by the accumulated settings in one or more `NuGet.Config` (XML) files that can exist at solution- (project if no solution is used), user-, and computer-wide levels. A global `NuGetDefaults.Config` file also specifically configures package sources. Settings apply to all commands issued in the CLI, the Package Manager Console, and the Package Manager UI. +NuGet's behavior is driven by the accumulated settings in one or more config (XML) files that can exist at solution- (project if no solution is used), user-, and computer-wide levels. ## Config file locations and uses @@ -58,29 +58,35 @@ Settings are managed using the NuGet CLI [config command](../reference/cli-refer Windows: ```cli -# Set repositoryPath in the user-level config file -nuget config -set repositoryPath=c:\packages +# Set globalPackagesFolder in the user-level config file +dotnet nuget config set globalPackagesFolder "C:\packages" + +# Set repositoryPath (available for packages.config only) in the user-level config file +dotnet nuget config set repositoryPath "C:\packages" # Set repositoryPath in solution-level files -nuget config -set repositoryPath=c:\packages -configfile c:\my.Config -nuget config -set repositoryPath=c:\packages -configfile .\myApp\NuGet.Config +dotnet nuget config set repositoryPath "C:\packages" --configfile "C:\my.config" +dotnet nuget config set repositoryPath "c:\packages" --configfile "..\..\my.config" # Set repositoryPath in the computer-level file (requires elevation) -nuget config -set repositoryPath=c:\packages -configfile %ProgramFiles(x86)%\NuGet\Config\NuGet.Config +dotnet nuget config set repositoryPath "c:\packages" --configfile "%appdata%\NuGet\NuGet.Config" ``` Mac/Linux: ```cli -# Set repositoryPath in the user-level config file -nuget config -set repositoryPath=/home/packages +# Set globalPackagesFolder in the user-level config file +dotnet nuget config set globalPackagesFolder /home/packages + +# Set repositoryPath (available for packages.config only) in the user-level config file +dotnet nuget config set repositoryPath /home/packages # Set repositoryPath in solution-level files -nuget config -set repositoryPath=/home/projects/packages -configfile /home/my.Config -nuget config -set repositoryPath=/home/packages -configfile home/myApp/NuGet.Config +dotnet nuget config set repositoryPath /home/projects/packages --configfile /home/my.Config +dotnet nuget config set repositoryPath /home/packages --configfile home/myApp/NuGet.Config # Set repositoryPath in the computer-level file (requires elevation) -nuget config -set repositoryPath=/home/packages -configfile $XDG_DATA_HOME/NuGet.Config +dotnet nuget config set repositoryPath /home/packages --configfile $XDG_DATA_HOME/NuGet.Config ``` > [!Note] @@ -100,7 +106,10 @@ nuget config -set repositoryPath= -configfile /home/my.Config ### Creating a new config file -Copy the template below into the new file and then use `nuget config -configFile ` to set values: +Using the .NET CLI, create a default nuget.config by running `dotnet new nugetconfig`. +For more information, see [dotnet CLI commands](../reference/dotnet-commands.md#package-consumption). + +Alternatively, manually copy the template below into the new file and then use `nuget config -configFile ` to set values: ```xml @@ -116,7 +125,7 @@ If a command line tool is used on a project file, rather than a solution file, t Specifically, when a config file is not specified explicitly on the command line, NuGet loads settings from the different config files in the following order: -1. The [`NuGetDefaults.Config` file](#nuget-defaults-file), which contains settings related only to package sources. +1. (*Uncommon*) The [`NuGetDefaults.Config` file](#nuget-defaults-file), which contains settings related only to package sources. 1. The computer-level file. 1. The user-level file. 1. Files found in every folder in the path from the drive root to the current folder (where `nuget.exe` is invoked or the folder containing the Visual Studio solution). For example, if a command is invoked in `c:\A\B\C`, NuGet looks for and loads config files in `c:\`, then `c:\A`, then `c:\A\B`, and finally `c:\A\B\C`. @@ -154,9 +163,9 @@ File A. User-level file, (`%appdata%\NuGet\NuGet.Config` on Windows, `~/.config/ ```xml - - - + + + ``` @@ -226,7 +235,9 @@ These files cannot be edited by the standard tooling. ## NuGet defaults file -The `NuGetDefaults.Config` file exists to specify package sources from which packages are installed and updated, and to control the default target for publishing packages with `nuget push`. Because administrators can conveniently (using Group Policy, for example) deploy consistent `NuGetDefaults.Config` files to developer and build machines, they can ensure that everyone in the organization is using the correct package sources rather than nuget.org. +The `NuGetDefaults.Config` is uncommon and can only specify package sources from which packages are installed and updated, or control the default target for publishing packages with `nuget push`. + +Because administrators can conveniently (using Group Policy, for example) deploy consistent `NuGetDefaults.Config` files to developer and build machines, they can ensure that everyone in the organization is using consistent package sources, whether or not that includes nuget.org. > [!Important] > The `NuGetDefaults.Config` file never causes a package source to be removed from a developer's NuGet configuration. That means if the developer has already used NuGet and therefore has the nuget.org package source registered, it won't be removed after the creation of a `NuGetDefaults.Config` file. diff --git a/docs/consume-packages/consuming-packages-authenticated-feeds.md b/docs/consume-packages/consuming-packages-authenticated-feeds.md index 6382c6b95..126662636 100644 --- a/docs/consume-packages/consuming-packages-authenticated-feeds.md +++ b/docs/consume-packages/consuming-packages-authenticated-feeds.md @@ -4,12 +4,17 @@ description: Consuming packages from authenticated feeds in all NuGet client sce author: nkolev92 ms.author: nikolev ms.date: 12/22/2023 -ms.topic: conceptual +ms.topic: how-to +ms.custom: sfi-ropc-nochange --- # Consuming packages from authenticated feeds Many NuGet operations, such as restore and install, require communication with one or more package sources, which [can be configured in *nuget.config* files](../reference/nuget-config-file.md#packagesources). + +> [!NOTE] +> Use package sources that you trust. + For HTTP feeds, NuGet will make an unauthenticated request, and if the server responds with an HTTP 401 response, NuGet will search for credentials in the following order: 1. [An environment variable `NuGetPackageSourceCredentials_{name}`](#credentials-in-environment-variables). @@ -37,11 +42,11 @@ This approach provides an extra layer of security by storing the credentials in For more information, refer to the section on [credentials in *nuget.config* files](#credentials-in-nugetconfig-files). > [!NOTE] - > Be aware that encrypted passwords are only supported on Windows. + > Be aware that encrypted passwords are only supported on Windows. > Moreover, they can only be decrypted on the same machine and by the same user who originally encrypted them. 1. **Using Environment Variable Macros in nuget.config**: If using encrypted credentials is not possible, consider storing the credentials in the *nuget.config* file with environment variable macros. -This approach allows you to reference environment variables that contain the actual credentials. +This approach allows you to reference environment variables that contain the actual credentials. It enhances transparency and helps end users understand how their credentials are configured. For more information, refer to the section on [credentials in *nuget.config* files](#credentials-in-nugetconfig-files). @@ -137,8 +142,7 @@ However, the credential provider for the .NET SDK is not included by Visual Stud ### List of credential providers -There is a [feature request to make credential providers installable via .NET tools](https://github.com/NuGet/Home/issues/12567), and this will likely make it easier to discover other credential providers. -Until this is implemented, here is a list of credential providers we are aware of: +Here is a list of credential providers we are aware of: * [AWS CodeArtifact NuGet Credential Provider](https://docs.aws.amazon.com/codeartifact/latest/ug/nuget-cli.html#nuget-configure-cli) * [Azure Artifacts Credential Provider](https://github.com/microsoft/artifacts-credprovider). This link is just for the command line credential provider. diff --git a/docs/consume-packages/install-use-packages-dotnet-cli.md b/docs/consume-packages/install-use-packages-dotnet-cli.md index 92712417d..44e878149 100644 --- a/docs/consume-packages/install-use-packages-dotnet-cli.md +++ b/docs/consume-packages/install-use-packages-dotnet-cli.md @@ -3,8 +3,8 @@ title: Install and manage NuGet packages with the dotnet CLI description: See how to use the dotnet CLI to install, list, remove, and update NuGet packages. author: mikejo5000 ms.author: mikejo -ms.date: 08/21/2023 -ms.topic: conceptual +ms.date: 03/03/2025 +ms.topic: install-set-up-deploy --- # Install and manage NuGet packages with the dotnet CLI diff --git a/docs/consume-packages/install-use-packages-nuget-cli.md b/docs/consume-packages/install-use-packages-nuget-cli.md index 53daddfd0..3b6639dc4 100644 --- a/docs/consume-packages/install-use-packages-nuget-cli.md +++ b/docs/consume-packages/install-use-packages-nuget-cli.md @@ -3,8 +3,8 @@ title: Manage NuGet packages with the NuGet CLI description: Instructions for using the NuGet CLI, nuget.exe, to manage NuGet packages. author: mikejo5000 ms.author: mikejo -ms.date: 08/21/2023 -ms.topic: conceptual +ms.date: 03/03/2025 +ms.topic: how-to --- # Manage NuGet packages with the NuGet CLI diff --git a/docs/consume-packages/install-use-packages-powershell.md b/docs/consume-packages/install-use-packages-powershell.md index 262a8d3ac..0e7881326 100644 --- a/docs/consume-packages/install-use-packages-powershell.md +++ b/docs/consume-packages/install-use-packages-powershell.md @@ -3,8 +3,8 @@ title: Manage NuGet packages with the Visual Studio Package Manager Console description: See how to work with NuGet packages by using PowerShell commands in the Visual Studio Package Manager Console. author: JonDouglas ms.author: jodou -ms.date: 08/21/2023 -ms.topic: conceptual +ms.date: 03/03/2025 +ms.topic: how-to f1_keywords: - "vs.nuget.packagemanager.console" --- diff --git a/docs/consume-packages/install-use-packages-visual-studio.md b/docs/consume-packages/install-use-packages-visual-studio.md index a86db3085..db1eb5d54 100644 --- a/docs/consume-packages/install-use-packages-visual-studio.md +++ b/docs/consume-packages/install-use-packages-visual-studio.md @@ -3,12 +3,9 @@ title: Install and manage packages in Visual Studio using the NuGet Package Mana description: Learn how to use the NuGet Package Manager UI in Visual Studio for working with NuGet packages. author: JonDouglas ms.author: jodou -ms.date: 08/21/2023 -ms.topic: conceptual +ms.date: 03/03/2025 +ms.topic: install-set-up-deploy f1_keywords: - - "vs.toolsoptionspages.nuget_package_manager" - - "vs.toolsoptionspages.nuget_package_manager.general" - - "vs.toolsoptionspages.nuget_package_manager.package_sources" - "vs.nuget.packagemanager.ui" --- @@ -38,9 +35,24 @@ To find and install a NuGet package with Visual Studio, follow these steps: The **NuGet Package Manager** window opens. -1. Select the **Browse** tab to display packages by popularity from the currently selected source (see [Package sources](#package-sources)). To search for a specific package, use the search box on the upper left. Select a package from the list to display its information on the right pane, which enables you to select a version to install. +1. Select the **Browse** tab to display packages by popularity from the currently selected source (see [Package sources](#package-sources)). - :::image type="content" source="media/package-manager-install-tab.png" alt-text="Screenshot showing the NuGet Package Manager window with the Browse tab selected."::: + - To search for a specific package, use the search box on the upper left. + - Abbreviated information may be shown beside each package ID to help identify the correct package, and varies based on the selected package source(s). + Examples include package download count, author, or owner profile hyperlinks. + + > [!Note] + > In Visual Studio 17.11 and higher, package owners are shown as profile hyperlinks when supported by the selected package source. + > Package ownership is defined by the package source. For example, see [Manage package owners on nuget.org](../nuget-org/publish-a-package.md#manage-package-owners-on-nugetorg). + > + > In Visual Studio 17.10 and earlier, the package *author* metadata is shown, which appears as plain-text. + > For more information, see [Authors package metadata](../create-packages/package-authoring-best-practices.md#authors). + + - Select a package to see detailed package information. + The details pane on the right appears and enables you to select a version to install. + ![Screenshot showing the NuGet Package Manager window with the Browse tab, details pane, and "Package Details" tab selected.](media/package-manager-package-details.png) + You can see package metadata, information about the owner(s), author(s), license, etc., in the Package Details tab and the package README file (if it is provided by the package author) in the README tab. + ![Screenshot showing the NuGet Package Manager window with the README tab selected.](media/package-manager-package-readme.png) 1. In the right pane, select a **Version** from the dropdown list. If you want to include prerelease versions in the **Version** list, select **Include prerelease**. @@ -114,8 +126,6 @@ In this example, the ClassLibrary1 project is using EntityFramework 6.2.0, where Visual Studio ignores the order of package sources, and uses the package from whichever source is the first to respond to a request. For more information, see [Restore packages](package-restore.md). For information about how to load a package from a specific source, see [Package source mapping](package-source-mapping.md). -To manage NuGet package sources, follow these steps: - 1. To change the source from which Visual Studio loads package metadata, select a source from the **Package source** selector. ![Screenshot showing the Package source selector highlighted.](media/package-source-selector.png) @@ -124,21 +134,7 @@ To manage NuGet package sources, follow these steps: ![Screenshot showing the Package source settings icon highlighted.](media/package-source-settings.png) -1. In the **Options** window, expand the **NuGet Package Manager** node and select **Package Sources**. - - ![Screenshot showing the Options window with Package Sources selected.](media/package-sources.png) - -1. To add a source, select **+**, edit the **Name**, enter the URL or path in **Source**, and then select **Update**. - - The source now appears in the **Package source** dropdown list. - -1. To change a package source, select it, make edits in the **Name** and **Source** boxes, and select **Update**. - -1. To disable a package source, clear the box to the left of the name in the list. - -1. To remove a package source, select it, and then select the **X** button. - - If a package source reappears after you delete it, it might be listed in a computer-level or user-level *NuGet.config* file. For the location of these files, see [Common NuGet configurations](../consume-packages/configuring-nuget-behavior.md). Remove the package source in the files by editing them manually or using the [nuget sources command](../reference/nuget-exe-CLI-reference.md). +1. To manage NuGet package sources, see [NuGet Options in Visual Studio](nuget-visual-studio-options.md#package-sources). ## NuGet Package Manager Options control @@ -182,8 +178,7 @@ These options are available only for certain project types: ## Related video -- [Install and Use a NuGet Package with Visual Studio](/shows/nuget-101/install-and-use-a-nuget-package-with-visual-studio-2-of-5/player) -- Find more NuGet videos on [Channel 9](/shows/nuget-101/) and [YouTube](https://www.youtube.com/playlist?list=PLdo4fOcmZ0oVLvfkFk8O9h6v2Dcdh2bh_). +- Find NuGet videos on [Channel 9](/shows/nuget-101/) and [YouTube](https://www.youtube.com/playlist?list=PLdo4fOcmZ0oVLvfkFk8O9h6v2Dcdh2bh_). ## See also diff --git a/docs/consume-packages/installing-signed-packages.md b/docs/consume-packages/installing-signed-packages.md index 0814218f4..ad5e83f29 100644 --- a/docs/consume-packages/installing-signed-packages.md +++ b/docs/consume-packages/installing-signed-packages.md @@ -4,7 +4,7 @@ description: Describes the process of installing signed NuGet packages and confi author: JonDouglas ms.author: jodou ms.date: 11/29/2018 -ms.topic: conceptual +ms.topic: install-set-up-deploy --- # Manage package trust boundaries diff --git a/docs/consume-packages/managing-the-global-packages-and-cache-folders.md b/docs/consume-packages/managing-the-global-packages-and-cache-folders.md index aedb1a967..faac424cd 100644 --- a/docs/consume-packages/managing-the-global-packages-and-cache-folders.md +++ b/docs/consume-packages/managing-the-global-packages-and-cache-folders.md @@ -4,19 +4,19 @@ description: How to manage the global package installation folder, the package c author: JonDouglas ms.author: jodou ms.date: 03/19/2018 -ms.topic: conceptual +ms.topic: how-to --- # Managing the global packages, cache, and temp folders Whenever you install, update, or restore a package, NuGet manages packages and package information in several folders outside of your project structure: -| Name | Description and Location (per user)| +| Name | Location | | --- | --- | -| global-packages | The *global-packages* folder is where NuGet installs any downloaded package. Each package is fully expanded into a subfolder that matches the package identifier and version number. Projects using the [PackageReference](package-references-in-project-files.md) format always use packages directly from this folder. When using the [packages.config](../reference/packages-config.md), packages are installed to the *global-packages* folder, then copied into the project's `packages` folder.
  • Windows: `%userprofile%\.nuget\packages`
  • Mac/Linux: `~/.nuget/packages`
  • Override using the NUGET_PACKAGES environment variable, the `globalPackagesFolder` or `repositoryPath` [configuration settings](../reference/nuget-config-file.md#config-section) (when using PackageReference and `packages.config`, respectively), or the `RestorePackagesPath` MSBuild property (MSBuild only). The environment variable takes precedence over the configuration setting.
| -| http-cache | The Visual Studio Package Manager (NuGet 3.x+) and the `dotnet` tool store copies of downloaded packages in this cache (saved as `.dat` files), organized into subfolders for each package source. Packages are not expanded, and the cache has an expiration time of 30 minutes.
  • Windows: `%localappdata%\NuGet\v3-cache`
  • Mac/Linux: `~/.local/share/NuGet/v3-cache`
  • Override using the NUGET_HTTP_CACHE_PATH environment variable.
| -| temp | A folder where NuGet stores temporary files during its various operations.
  • Windows: `%temp%\NuGetScratch`
  • Mac: `/tmp/NuGetScratch`
  • Linux: `/tmp/NuGetScratch`
  • Override using the NUGET_SCRATCH environment variable.
    • | -| plugins-cache **4.8+** | A folder where NuGet stores the results from the operation claims request.
    • Windows: `%localappdata%\NuGet\plugins-cache`
    • Mac/Linux: `~/.local/share/NuGet/plugins-cache`
    • Override using the NUGET_PLUGINS_CACHE_PATH environment variable.
    | +| [global-packages](#global-packages) |
    • Windows: `%userprofile%\.nuget\packages`
    • Mac/Linux: `~/.nuget/packages`
    • Override using the NUGET_PACKAGES environment variable, the `globalPackagesFolder` or `repositoryPath` [configuration settings](../reference/nuget-config-file.md#config-section) (when using PackageReference and `packages.config`, respectively), or the `RestorePackagesPath` MSBuild property (MSBuild only). The environment variable takes precedence over the configuration setting.
    | +| [http-cache](#http-cache) |
    • Windows: `%localappdata%\NuGet\v3-cache`
    • Mac/Linux: `~/.local/share/NuGet/v3-cache`
    • Override using the NUGET_HTTP_CACHE_PATH environment variable.
    | +| [temp](#temp) |
  • Windows: `%temp%\NuGetScratch`
  • Mac: `/tmp/NuGetScratch`
  • Linux: `/tmp/NuGetScratch`
  • Override using the NUGET_SCRATCH environment variable.
    • | +| [plugins-cache](#plugin-cache) **4.8+** |
    • Windows: `%localappdata%\NuGet\plugins-cache`
    • Mac/Linux: `~/.local/share/NuGet/plugins-cache`
    • Override using the NUGET_PLUGINS_CACHE_PATH environment variable.
    | > [!Note] > NuGet 3.5 and earlier uses *packages-cache* instead of the *http-cache*, which is located in `%localappdata%\NuGet\Cache`. @@ -27,6 +27,54 @@ When asked to retrieve a package, NuGet first looks in the *global-packages* fol For more information, see [What happens when a package is installed?](../concepts/package-installation-process.md). +## global-packages + +The *global-packages* folder is where NuGet installs any downloaded package. +Each package is fully expanded into a subfolder that matches the package identifier and version number. +Projects using the [PackageReference](package-references-in-project-files.md) format always use packages directly from this folder. +When using the [packages.config](../reference/packages-config.md), packages are installed to the *global-packages* folder, then copied into the project's `packages` folder. + +### Cleaning the global-packages directory + +The global-packages directory needs to be manually cleaned to remove packages that are no longer used. +You can do this with the `dotnet nuget locals global-packages --clean` command, or the "clear NuGet local resources" button in Visual Studio's options (equivalent to `dotnet nuget locals all --clear`). +After clearing the global-packages directory, you will need to restore your projects again to redownload all required packages. +In Visual Studio, you may need to reload your solution to clear NuGet's "up to date restores" cache, or alternatively do a command line restore (for example, within Visual Studio's terminal window) with `msbuild -t:restore your.sln`. + +To clean only unused packages, it's a two step process. +First, there is a [nuget.config setting `updatePackageLastAccessTime`](../reference/nuget-config-file.md) that should be enabled. +This setting will cause NuGet to update each package's `.nupkg.metadata` file when it is used in a restore. +When restore runs, but a project is considered already up to date, the package timestamps are *not* updated. +The `.nupkg.metadata` file is the last file that NuGet will create when downloading and extracting packages during a restore or install, and is the file that restore uses to check if a package has been extracted successfully. + +Second, run a tool to perform the cleanup. +After the `updatePackageLastAccessTime` setting is enabled, we recommend waiting a few days to make sure that all the packages you use regularly have had their timestamps updated. + +At this time, NuGet does not provide a tool or command to do this. +You can [add a 👍 reaction to this GitHub issue](https://github.com/NuGet/Home/issues/4980) to signal your interest. +Some community members have created their own open source NuGet cleaner tools that you can search for. + +If you are going to write your own cleanup tool, it is important that the `.nupkg.metadata` file is deleted if any of the other package files are deleted, so we recommend that this file is deleted first. +Otherwise projects referencing the package may have unexpected behavior. +If writing a cleanup tool in .NET, consider using `ConcurrencyUtilities.ExecuteWithFileLocked[Async](..)` from the [NuGet.Common package](https://www.nuget.org/packages/NuGet.Common), passing the full nupkg path of the package directory you're going to delete as the key, to avoid deleting a package that restore is trying to extract at the same time. +The global packages directory can be programatically found with the [NuGet.Configuration package](https://www.nuget.org/packages/NuGet.Configuration). +Use `Settings.LoadDefaultSettings(path)` to get an `ISettings` instance (you can pass `null` as the path, or pass a directory if you want to handle solutions with a nuget.config that redirects the global-packages directory), and then use `SettingsUtility.GetGlobalPackagesFolder(settings)`. +Alternatively, you can run `dotnet nuget locals global-packages --list` as a child process and parse the output. + +## http-cache + +NuGet will cache copies of most NuGet feed communications (excluding search), organized into subfolders for each package source. +Packages are not expanded, and files with a last modified date older than 30 minutes are typically considered expired. + +## temp + +A folder where NuGet may store temporary files during its various operations. + +## plugin-cache + +A folder where NuGet stores the results from the operation claims request. +See the [cross platform plugins reference](../reference/extensibility/NuGet-Cross-Platform-Plugins.md) for more information. + ## Viewing folder locations You can view locations using the [nuget locals command](../reference/cli-reference/cli-ref-locals.md): @@ -70,10 +118,13 @@ info : global-packages: /home/user1/.nuget/packages/ info : temp: /tmp/NuGetScratchuser1 info : plugins-cache: /home/user1/.local/share/NuGet/plugins-cache ``` + To display the location of a single folder, use `http-cache`, `global-packages`, `temp`, or `plugins-cache` instead of `all`. ## Clearing local folders +### Command-line + If you encounter package installation problems or otherwise want to ensure that you're installing packages from a remote gallery, use the `locals --clear` option (dotnet.exe) or `locals -clear` (nuget.exe), specifying the folder to clear, or `all` to clear all folders: ```cli @@ -103,9 +154,23 @@ nuget locals all -clear Any packages used by projects that are currently open in Visual Studio are not cleared from the *global-packages* folder. -Starting in Visual Studio 2017, use the **Tools > NuGet Package Manager > Package Manager Settings** menu command, then select **Clear All NuGet Cache(s)**. Managing the cache isn't presently available through the Package Manager Console. In Visual Studio 2015, use the CLI commands instead. +### Visual Studio + +Visual Studio supports clearing all local folders in the "NuGet Package Manager" options found under the **Tools > NuGet Package Manager > Package Manager Settings** menu command. + +On the General page, select **Clear NuGet local resources**. +Once started, this action cannot be cancelled. +A progress bar will be shown and will contain the final status of the command. + +The [Output Window](/visualstudio/ide/output-window) when selecting Show output from "Package Manager" will show additional details about the clear command, including any error messages. + +### Clear NuGet Local Resources + +![Clear NuGet local resources button highlighted in the General page of NuGet options](media/vsoptions/general.png) + +Managing the cache isn't presently available through the Package Manager Console. -![NuGet option command for clearing caches](media/options-clear-caches.png) +For more information, see [NuGet Options in Visual Studio](nuget-visual-studio-options.md#clear-nuget-local-resources). ## Troubleshooting errors diff --git a/docs/consume-packages/media/Restore-01-AutoRestoreOptions.png b/docs/consume-packages/media/Restore-01-AutoRestoreOptions.png deleted file mode 100644 index 4283c072e..000000000 Binary files a/docs/consume-packages/media/Restore-01-AutoRestoreOptions.png and /dev/null differ diff --git a/docs/consume-packages/media/Restore-02-PackageFormatOptions.png b/docs/consume-packages/media/Restore-02-PackageFormatOptions.png deleted file mode 100644 index 204b39e0e..000000000 Binary files a/docs/consume-packages/media/Restore-02-PackageFormatOptions.png and /dev/null differ diff --git a/docs/consume-packages/media/options-clear-caches.png b/docs/consume-packages/media/options-clear-caches.png deleted file mode 100644 index 0a99c9b38..000000000 Binary files a/docs/consume-packages/media/options-clear-caches.png and /dev/null differ diff --git a/docs/consume-packages/media/package-manager-browse-tab.png b/docs/consume-packages/media/package-manager-browse-tab.png new file mode 100644 index 000000000..d48ddbd1b Binary files /dev/null and b/docs/consume-packages/media/package-manager-browse-tab.png differ diff --git a/docs/consume-packages/media/package-manager-package-details.png b/docs/consume-packages/media/package-manager-package-details.png new file mode 100644 index 000000000..4ec7cc9a7 Binary files /dev/null and b/docs/consume-packages/media/package-manager-package-details.png differ diff --git a/docs/consume-packages/media/package-manager-package-readme.png b/docs/consume-packages/media/package-manager-package-readme.png new file mode 100644 index 000000000..855595145 Binary files /dev/null and b/docs/consume-packages/media/package-manager-package-readme.png differ diff --git a/docs/consume-packages/media/package-sources.png b/docs/consume-packages/media/package-sources.png deleted file mode 100644 index 507114bb8..000000000 Binary files a/docs/consume-packages/media/package-sources.png and /dev/null differ diff --git a/docs/consume-packages/media/packageSourceMapping_VSOptions_AddMappingCompleted.png b/docs/consume-packages/media/packageSourceMapping_VSOptions_AddMappingCompleted.png deleted file mode 100644 index 15324be78..000000000 Binary files a/docs/consume-packages/media/packageSourceMapping_VSOptions_AddMappingCompleted.png and /dev/null differ diff --git a/docs/consume-packages/media/packageSourceMapping_VSOptions_AddMappingFilled.png b/docs/consume-packages/media/packageSourceMapping_VSOptions_AddMappingFilled.png deleted file mode 100644 index 6e0e9390f..000000000 Binary files a/docs/consume-packages/media/packageSourceMapping_VSOptions_AddMappingFilled.png and /dev/null differ diff --git a/docs/consume-packages/media/packageSourceMapping_VSOptions_AddMappingOpened.png b/docs/consume-packages/media/packageSourceMapping_VSOptions_AddMappingOpened.png deleted file mode 100644 index 7795c7351..000000000 Binary files a/docs/consume-packages/media/packageSourceMapping_VSOptions_AddMappingOpened.png and /dev/null differ diff --git a/docs/consume-packages/media/packageSourceMapping_VSOptions_NoMappings.png b/docs/consume-packages/media/packageSourceMapping_VSOptions_NoMappings.png deleted file mode 100644 index 15b05fcf5..000000000 Binary files a/docs/consume-packages/media/packageSourceMapping_VSOptions_NoMappings.png and /dev/null differ diff --git a/docs/consume-packages/media/vsoptions/configuration-files.png b/docs/consume-packages/media/vsoptions/configuration-files.png new file mode 100644 index 000000000..73d576337 Binary files /dev/null and b/docs/consume-packages/media/vsoptions/configuration-files.png differ diff --git a/docs/consume-packages/media/vsoptions/general.png b/docs/consume-packages/media/vsoptions/general.png new file mode 100644 index 000000000..debce051c Binary files /dev/null and b/docs/consume-packages/media/vsoptions/general.png differ diff --git a/docs/consume-packages/media/vsoptions/package-source-add.png b/docs/consume-packages/media/vsoptions/package-source-add.png new file mode 100644 index 000000000..69113b750 Binary files /dev/null and b/docs/consume-packages/media/vsoptions/package-source-add.png differ diff --git a/docs/consume-packages/media/vsoptions/package-source-http-error.png b/docs/consume-packages/media/vsoptions/package-source-http-error.png new file mode 100644 index 000000000..9ce2f2722 Binary files /dev/null and b/docs/consume-packages/media/vsoptions/package-source-http-error.png differ diff --git a/docs/consume-packages/media/vsoptions/package-source-http-warn.png b/docs/consume-packages/media/vsoptions/package-source-http-warn.png new file mode 100644 index 000000000..f1a4569d4 Binary files /dev/null and b/docs/consume-packages/media/vsoptions/package-source-http-warn.png differ diff --git a/docs/consume-packages/media/vsoptions/package-source-machine-wide.png b/docs/consume-packages/media/vsoptions/package-source-machine-wide.png new file mode 100644 index 000000000..aae8df7eb Binary files /dev/null and b/docs/consume-packages/media/vsoptions/package-source-machine-wide.png differ diff --git a/docs/consume-packages/media/vsoptions/package-source-mapping-add.png b/docs/consume-packages/media/vsoptions/package-source-mapping-add.png new file mode 100644 index 000000000..7c9fc5183 Binary files /dev/null and b/docs/consume-packages/media/vsoptions/package-source-mapping-add.png differ diff --git a/docs/consume-packages/media/vsoptions/package-source-mapping-missing-source.png b/docs/consume-packages/media/vsoptions/package-source-mapping-missing-source.png new file mode 100644 index 000000000..120c2374b Binary files /dev/null and b/docs/consume-packages/media/vsoptions/package-source-mapping-missing-source.png differ diff --git a/docs/consume-packages/media/vsoptions/package-source-mapping.png b/docs/consume-packages/media/vsoptions/package-source-mapping.png new file mode 100644 index 000000000..eb4c24d0b Binary files /dev/null and b/docs/consume-packages/media/vsoptions/package-source-mapping.png differ diff --git a/docs/consume-packages/media/vsoptions/package-sources-page.png b/docs/consume-packages/media/vsoptions/package-sources-page.png new file mode 100644 index 000000000..8edf71c39 Binary files /dev/null and b/docs/consume-packages/media/vsoptions/package-sources-page.png differ diff --git a/docs/consume-packages/migrate-packages-config-to-package-reference.md b/docs/consume-packages/migrate-packages-config-to-package-reference.md index 59fb31f35..1bb9a436f 100644 --- a/docs/consume-packages/migrate-packages-config-to-package-reference.md +++ b/docs/consume-packages/migrate-packages-config-to-package-reference.md @@ -4,7 +4,7 @@ description: Details on how to migrate a project from the packages.config manage author: JonDouglas ms.author: jodou ms.date: 08/23/2021 -ms.topic: conceptual +ms.topic: upgrade-and-migration-article --- # Migrate from packages.config to PackageReference @@ -87,7 +87,9 @@ You should now be able to see the migration option. Note that this option is not ## Create a package after migration -Once the migration is complete, we recommend that you add a reference to the [nuget.build.tasks.pack](https://www.nuget.org/packages/nuget.build.tasks.pack) nuget package, and then use [msbuild -t:pack](../reference/msbuild-targets.md#pack-target) to create the package. Although in some scenarios you could use `dotnet.exe pack` instead of `msbuild -t:pack`, it is not recommended. +Once the migration is complete, we recommend that you copy your package metadata from a `.nuspec` file to [MSBuild properties](../reference/msbuild-targets.md#pack-target), and then you can use `msbuild -t:pack` to create the package. +If you are using Visual Studio 2022 or earlier, you will also need to install the NuGet.Build.Tasks.Pack package. +From Visual Studio 2026, pack is built into MSBuild. ## Package compatibility issues diff --git a/docs/consume-packages/nuget-https-everywhere.md b/docs/consume-packages/nuget-https-everywhere.md new file mode 100644 index 000000000..47c97e01d --- /dev/null +++ b/docs/consume-packages/nuget-https-everywhere.md @@ -0,0 +1,97 @@ +--- +title: NuGet HTTPS Everywhere +description: Learn why NuGet enforces HTTPS connections for package sources, what errors like NU1302 mean, and how to safely allow HTTP feeds when necessary. +author: Nigusu-Allehu +ms.author: nyenework +ms.date: 10/28/2025 +ms.topic: conceptual +ai-usage: ai-generated +--- + +# NuGet HTTPS Everywhere + +NuGet requires all package sources to use **HTTPS** instead of **HTTP**. +This enforcement protects the software supply chain by preventing tampering and interception during package restore and related operations. +NuGet enforces this requirement by producing an error and stopping the operation when an HTTP source is used. + +## Understanding the HTTP Error + +This error occurs when one or more package sources in your configuration use an **HTTP** URL instead of **HTTPS**. + +In earlier NuGet versions, this scenario produced a **warning** ([`NU1803`](../reference/errors-and-warnings/nu1803.md)). +Beginning with [**NuGet 6.12**](../release-notes/NuGet-6.12.md) and later, it now results in an **error** unless the use of HTTP sources is explicitly permitted. + +### Recommended Resolution + +Before allowing HTTP connections, confirm whether your package source supports HTTPS. +If it does, update the feed URL to use the secure protocol: + +```xml + +``` + +Switching to HTTPS ensures end-to-end encryption and is the recommended and more secure approach. + +### Allowing Insecure HTTP Feeds (Opt-Out) + +If HTTPS is not available and you operate in a trusted or isolated environment, you can explicitly allow HTTP sources. + +#### Option 1: Set allowInsecureConnections in your `NuGet.Config` + +* **Use Visual Studio** + + Enable or disable allowing insecure HTTP connections with the [Package Sources settings](/nuget/consume-packages/nuget-visual-studio-options#allow-insecure-connections) under the Visual Studio options > **NuGet Package Manager**. + +* **Edit `NuGet.Config` manually** + + Add the `allowInsecureConnections="true"` attribute to the affected source: + + ```xml + + + + + + + ``` + +#### Option 2: Use the Command-Line Parameter + +For commands that support it, include the following flag to temporarily permit HTTP connections: + +For **dotnet** commands: + +```bash +--allow-insecure-connections +``` + +For **NuGet.exe** commands, use: + +```powershell +-AllowInsecureConnections +``` + +#### Commands that support opt-out options + +| Tool | Commands | Support for Allow Insecure Connection | +| -------------- | ------------------------- | ------------------------------------- | +| **nuget.exe** | `push` | NuGet **7.0** | +| **dotnet CLI** | `dotnet nuget push` | .NET **10.0.1xx** and newer | +| **dotnet CLI** | `dotnet nuget add source` | .NET **9.0.1xx** and newer | + +## HTTPS Enforcement Rollout Across Tools + +NuGet’s HTTPS enforcement was introduced gradually across releases. +The following table summarizes the progression from [**warnings (NU1803)**](../reference/errors-and-warnings/nu1803.md) to [**errors (NU1302)**](../reference/errors-and-warnings/nu1302.md). + +| Versions Affected | Behavior | +| ----------------------------------------------------- | --------------------------------------------------------------------- | +| [NuGet.exe 6.3](../release-notes/NuGet-6.3.md)+, Visual Studio 17.3+, .NET 6.0.100+ | ⚠️ **Warning (NU1803)** – HTTP sources allowed but discouraged | +| [NuGet.exe 6.12](../release-notes/NuGet-6.12.md)+, Visual Studio 17.12+, .NET 9.0.100+ | ❌ **Error (NU1302)** – HTTP sources blocked unless explicitly allowed| + +## See Also + +* [NU1302](../reference/errors-and-warnings/nu1302.md) +* [NU1803](../reference/errors-and-warnings/nu1803.md) +* [NuGet.Config Reference](../reference/nuget-config-file.md#packagesources) +* [NuGet Visual Studio Options](../consume-packages/nuget-visual-studio-options.md) diff --git a/docs/consume-packages/nuget-visual-studio-options.md b/docs/consume-packages/nuget-visual-studio-options.md new file mode 100644 index 000000000..b773e33e8 --- /dev/null +++ b/docs/consume-packages/nuget-visual-studio-options.md @@ -0,0 +1,161 @@ +--- +title: NuGet Options in Visual Studio +description: Reference guide for NuGet Package Manager options in Visual Studio, including General, Configuration Files, Package Sources, and Package Source Mapping settings. +author: donnie-msft +ms.author: eagoodso +ms.date: 10/03/2025 +ms.topic: reference +f1_keywords: + - "vs.toolsoptionspages.nuget_package_manager" + - "vs.toolsoptionspages.nuget_package_manager.general" + - "vs.toolsoptionspages.nuget_package_manager.configuration_files" + - "vs.toolsoptionspages.nuget_package_manager.package_sources" + - "vs.toolsoptionspages.nuget_package_manager.package_source_mapping" +--- + +# NuGet Package Manager Options in Visual Studio + +Visual Studio provides several options pages for configuring NuGet Package Manager behavior. +Configuration settings for NuGet are stored in your [NuGet.Config file(s)](../reference/nuget-config-file.md). + +## Accessing NuGet Options + +There are multiple ways to access NuGet Package Manager options: + +1. **From the main menu**: Go to **Tools > Options**, then expand **NuGet Package Manager** in the left pane. +1. **From the NuGet menu** found under the **Tools > NuGet Package Manager > Package Manager Settings** menu command. +1. **Quick search**: Use [Visual Studio search](/visualstudio/ide/visual-studio-search) to search for "NuGet" or a NuGet-related setting name to quickly jump to its Options page. +1. **From Package Manager UI**: Press the settings (gear) icon in the Package Manager UI toolbar. +1. **From Package Manager Console**: Click the settings (gear) icon in the Package Manager Console toolbar. + +## General + +The General options page contains settings that control NuGet's package management behavior. + +![Clear NuGet local resources button highlighted in the General page of NuGet options](media/vsoptions/general.png) + +### Package Restore + +Settings for automatic package restore during build operations: + +- **Allow NuGet to download missing packages**: Select to enable package restore and the Restore NuGet Packages command. +- **Automatically check for missing packages during build in Visual Studio**: Select to automatically restore any missing packages when you run a build from Visual Studio. + +See [Package Restore](Package-Restore.md) for more information on package restore behavior. + +### Binding Redirects + +- **Skip applying binding redirects**: When enabled, NuGet will not automatically add or update binding redirects in app.config or web.config files during package installation or updates + +### Package Management + +- **Default package management format**: Choose between the NuGet formats [PackageReference](package-references-in-project-files.md) (recommended for most projects) and [packages.config](../reference/packages-config.md) (legacy format for older projects). + For more information, see [Choose default package management format](package-restore.md#choose-default-package-management-format). + + - **PackageReference**: Stores package references directly in project files. This is the modern format that supports better dependency resolution and is required for SDK-style projects + - **packages.config**: Legacy XML file format that stores package information separately from the project file + +- **Prompt for format selection on first package install**: When enabled, Visual Studio will ask you to choose between PackageReference and packages.config the first time you install a package in a project that doesn't already have packages. + +### Clear NuGet Local Resources + +The **Clear NuGet Local Resources** command button allows you to clear NuGet's local caches, including: + +- **http-cache**: Downloaded package metadata and packages +- **global-packages**: Installed packages folder +- **temp**: Temporary files +- **plugins-cache**: Plugin operation results + +For more information on NuGet caches and folders, see [Managing the global packages, cache, and temp folders](managing-the-global-packages-and-cache-folders.md). + +## Configuration Files + +The Configuration Files options page displays the NuGet.Config files that apply to your current solution and allows you to open them directly in Visual Studio for editing. + +To edit a file, select a File Path and press the "Open" button. +The file will open in a new tab in Visual Studio where it may be edited directly. + +![Configuration files page of NuGet options with the Open button highlighted](media/vsoptions/configuration-files.png) + +Configuration files are listed in order from highest to lowest priority. +NuGet uses a hierarchical configuration system where settings from multiple config files are merged. +For more information, see [Common NuGet configurations](configuring-nuget-behavior.md). + +## Package Sources + +The Package Sources options page allows you to manage the sources from which NuGet downloads packages. + +![Package Sources page of NuGet options](media/vsoptions/package-sources-page.png) + +### Managing Package Sources + +Lists all configured package sources according to your NuGet.Config files. + +- **Name**: Display name for the source +- **Source**: URL or file path for the package source +- **Enabled checkbox**: Enable or disable a source without removing it. +- **Allow Insecure Connections**: Enable or disable allowing insecure HTTP connections + +To modify, use the **Add, Edit, and Remove buttons** below the table. +Checkboxes may be toggled directly in the table. +Press "Save" on the Add/Edit dialog and the changes will be updated in the relevant NuGet.Config file. + +![Add dialog on the Package Sources page](media/vsoptions/package-source-add.png) + +### Machine-wide Package Sources + +Package sources defined at the machine level appear in a dedicated section below. +These are generally provisioned by Visual Studio workloads and can only be enabled or disabled using the checkbox in the Enabled column. + +![Machine-wide sources table on the Package Sources page](media/vsoptions/package-source-machine-wide.png) + +### Allow Insecure Connections + +For security reasons, NuGet enforces the use of HTTPS sources by default. +If you need to use an HTTP source, you must explicitly allow it. +When an HTTP source is used, the first column of the Package Sources table will show an icon with information about a warning or an error with the package source in that row. + +⚠️ When an HTTP package source is used and Allow Insecure Connections is enabled, a warning is shown in the leftmost status column: + +> HTTP sources are insecure. Consider using HTTPS instead. 'AllowInsecureConnections' is enabled, permitting HTTP access. + +![Package Sources page with an HTTP source Warning and Allow Insecure Connections enabled](media/vsoptions/package-source-http-warn.png) + +❌ When an HTTP source is used and Allow Insecure Connections is disabled, an error is shown in the leftmost status column and NuGet restore will fail: + +> NuGet requires HTTPS sources. To use an HTTP source, you must explicitly set 'allowInsecureConnections' to true in your NuGet.Config file. + +![Package Sources page with an HTTP source Error and Allow Insecure Connections disabled](media/vsoptions/package-source-http-error.png) + +For more information on configuring HTTP source permissions, see . + +## Package Source Mapping + +Package Source Mapping allows you to control which package sources are used for specific packages, improving supply chain security. + +![Package Source Mapping page of NuGet options](media/vsoptions//package-source-mapping.png) + +To modify, use the **Add, Edit, and Remove buttons** below the table. + +### Managing Package Source Mappings + +Lists all configured package source mappings according to your NuGet.Config files. + +- **Package pattern**: Package pattern that is currently mapped (e.g., `Microsoft.*` or `Contoso.Contracts`) +- **Source**: One or more package sources mapped to the package pattern. + Package sources must be enabled to be shown. + +To modify, use the **Add, Edit, and Remove buttons** below the table. +Press "Save" on the Add/Edit dialog and the changes will be updated in the relevant NuGet.Config file. + +![Package Source Mapping add dialog](media/vsoptions/package-source-mapping-add.png) + +For more information, see [Package Source Mapping](Package-Source-Mapping.md). + +### Invalid Source Mappings + +If a package source listed in your existing source mapping isn't enabled in your NuGet.Config file(s), an error will appear in the leftmost column. + +Make sure all Source values in your mappings refer to package sources that are both available and enabled. Otherwise, the mapping may not work as expected. + +![Package Source Mapping with an invalid package source](media/vsoptions/package-source-mapping-missing-source.png) diff --git a/docs/create-packages/Creating-Localized-Packages.md b/docs/create-packages/Creating-Localized-Packages.md index e232765ba..92f7e6d15 100644 --- a/docs/create-packages/Creating-Localized-Packages.md +++ b/docs/create-packages/Creating-Localized-Packages.md @@ -4,7 +4,7 @@ description: Details on the two ways to create localized NuGet packages, either author: JonDouglas ms.author: jodou ms.date: 01/18/2018 -ms.topic: conceptual +ms.topic: how-to --- # Creating localized NuGet packages diff --git a/docs/create-packages/Creating-a-Package.md b/docs/create-packages/Creating-a-Package.md index 45714c6c8..d853b0e8b 100644 --- a/docs/create-packages/Creating-a-Package.md +++ b/docs/create-packages/Creating-a-Package.md @@ -3,8 +3,8 @@ title: Create a NuGet package using nuget.exe CLI description: A detailed guide on designing and creating a NuGet package, including files and versioning. author: JonDouglas ms.author: jodou -ms.date: 07/14/2022 -ms.topic: conceptual +ms.date: 03/03/2025 +ms.topic: how-to --- # Create a package using the nuget.exe CLI diff --git a/docs/create-packages/Overview-and-Workflow.md b/docs/create-packages/Overview-and-Workflow.md index 96984557b..ddda6fd80 100644 --- a/docs/create-packages/Overview-and-Workflow.md +++ b/docs/create-packages/Overview-and-Workflow.md @@ -4,7 +4,7 @@ description: An overview of the process of creating and publishing a NuGet packa author: JonDouglas ms.author: jodou ms.date: 07/26/2017 -ms.topic: conceptual +ms.topic: concept-article --- # Package creation workflow diff --git a/docs/create-packages/Package-authoring-best-practices.md b/docs/create-packages/Package-authoring-best-practices.md index 9d45b8bc1..f4451cbe0 100644 --- a/docs/create-packages/Package-authoring-best-practices.md +++ b/docs/create-packages/Package-authoring-best-practices.md @@ -4,7 +4,7 @@ description: A general guide of best practices for creating high quality NuGet p author: nkolev92 ms.author: nikolev ms.date: 11/15/2021 -ms.topic: conceptual +ms.topic: best-practice --- # Package authoring best practices diff --git a/docs/create-packages/Prerelease-Packages.md b/docs/create-packages/Prerelease-Packages.md index b8a08be74..89ffc0d19 100644 --- a/docs/create-packages/Prerelease-Packages.md +++ b/docs/create-packages/Prerelease-Packages.md @@ -4,7 +4,7 @@ description: Guidance for building pre-release packages author: JonDouglas ms.author: jodou ms.date: 08/14/2017 -ms.topic: conceptual +ms.topic: concept-article --- # Building pre-release packages diff --git a/docs/create-packages/Select-assemblies-referenced-by-projects.md b/docs/create-packages/Select-assemblies-referenced-by-projects.md index c984846e1..6eebd9a66 100644 --- a/docs/create-packages/Select-assemblies-referenced-by-projects.md +++ b/docs/create-packages/Select-assemblies-referenced-by-projects.md @@ -4,7 +4,7 @@ description: Make a subset of assemblies in the package available to the compile author: zivkan ms.author: zivkan ms.date: 05/24/2019 -ms.topic: conceptual +ms.topic: how-to --- # Select Assemblies Referenced By Projects diff --git a/docs/create-packages/Sign-a-Package.md b/docs/create-packages/Sign-a-Package.md index fffc365a1..098353fe7 100644 --- a/docs/create-packages/Sign-a-Package.md +++ b/docs/create-packages/Sign-a-Package.md @@ -4,8 +4,9 @@ description: Explains how signed packages can be used to enable content integrit author: rido-min ms.author: rmpablos ms.date: 03/06/2018 -ms.topic: conceptual +ms.topic: how-to ms.reviewer: anangaur +ms.custom: sfi-image-nochange --- # Sign a NuGet package diff --git a/docs/create-packages/Source-and-Config-File-Transformations.md b/docs/create-packages/Source-and-Config-File-Transformations.md index 79402e54c..65f9f7659 100644 --- a/docs/create-packages/Source-and-Config-File-Transformations.md +++ b/docs/create-packages/Source-and-Config-File-Transformations.md @@ -4,7 +4,7 @@ description: Details on the ability for NuGet packages to transform source code author: JonDouglas ms.author: jodou ms.date: 04/24/2017 -ms.topic: conceptual +ms.topic: how-to ms.reviewer: anangaur --- @@ -174,4 +174,4 @@ To remove only the `MyNuModule` element during package uninstall, the `web.confi -``` \ No newline at end of file +``` diff --git a/docs/create-packages/Supporting-Multiple-Target-Frameworks.md b/docs/create-packages/Supporting-Multiple-Target-Frameworks.md index 91576a3c8..14fc9ffe4 100644 --- a/docs/create-packages/Supporting-Multiple-Target-Frameworks.md +++ b/docs/create-packages/Supporting-Multiple-Target-Frameworks.md @@ -4,7 +4,7 @@ description: Description of the various methods to target multiple .NET Framewor author: JonDouglas ms.author: jodou ms.date: 07/15/2019 -ms.topic: conceptual +ms.topic: concept-article --- # Support multiple .NET versions @@ -189,4 +189,4 @@ With `packages.config`, content files and PowerShell scripts can be grouped by t If a framework folder is left empty, NuGet doesn't add assembly references or content files or run the PowerShell scripts for that framework. > [!Note] -> Because `init.ps1` is executed at the solution level and not dependent on project, it must be placed directly under the `tools` folder. It's ignored if placed under a framework folder. \ No newline at end of file +> Because `init.ps1` is executed at the solution level and not dependent on project, it must be placed directly under the `tools` folder. It's ignored if placed under a framework folder. diff --git a/docs/create-packages/Symbol-Packages.md b/docs/create-packages/Symbol-Packages.md index 3226ec766..ae6f7387b 100644 --- a/docs/create-packages/Symbol-Packages.md +++ b/docs/create-packages/Symbol-Packages.md @@ -4,7 +4,7 @@ description: How to create NuGet packages that contain only symbols to support d author: JonDouglas ms.author: jodou ms.date: 09/12/2017 -ms.topic: conceptual +ms.topic: how-to ms.reviewer: anangaur --- diff --git a/docs/create-packages/author-packages-with-COM-interop-assemblies.md b/docs/create-packages/author-packages-with-COM-interop-assemblies.md index e37c68ce4..6c4a61385 100644 --- a/docs/create-packages/author-packages-with-COM-interop-assemblies.md +++ b/docs/create-packages/author-packages-with-COM-interop-assemblies.md @@ -4,7 +4,7 @@ description: Describes how to create packages that contain COM interop assemblie author: JonDouglas ms.author: jodou ms.date: 07/09/2019 -ms.topic: conceptual +ms.topic: article --- # Create NuGet packages that contain COM interop assemblies @@ -25,4 +25,4 @@ Note that when using the `packages.config` management format, adding references Additionally, by default the [build assets do not flow transitively](../consume-packages/package-references-in-project-files.md#controlling-dependency-assets). Packages authored as described here work differently when they are pulled as a transitive dependency from a project to project reference. The package consumer can allow them to flow by modifying the PrivateAssets default value to not include build. - \ No newline at end of file + diff --git a/docs/create-packages/creating-a-package-dotnet-cli.md b/docs/create-packages/creating-a-package-dotnet-cli.md index 15e2d1006..2917a2ec0 100644 --- a/docs/create-packages/creating-a-package-dotnet-cli.md +++ b/docs/create-packages/creating-a-package-dotnet-cli.md @@ -3,8 +3,8 @@ title: Create a NuGet package with the dotnet CLI description: Read a detailed guide about the process of designing and creating a NuGet package, including key decision points like files and versioning. author: JonDouglas ms.author: jodou -ms.date: 08/21/2023 -ms.topic: conceptual +ms.date: 03/03/2025 +ms.topic: how-to --- # Create a NuGet package with the dotnet CLI diff --git a/docs/create-packages/creating-a-package-msbuild.md b/docs/create-packages/creating-a-package-msbuild.md index 6aa91b1f5..48f58e902 100644 --- a/docs/create-packages/creating-a-package-msbuild.md +++ b/docs/create-packages/creating-a-package-msbuild.md @@ -4,7 +4,7 @@ description: A detailed guide to the process of designing and creating a NuGet p author: JonDouglas ms.author: jodou ms.date: 08/17/2023 -ms.topic: conceptual +ms.topic: how-to --- # Create a NuGet package using MSBuild @@ -13,9 +13,12 @@ When you create a NuGet package from your code, you package that functionality i For .NET Core and .NET Standard projects that use the [SDK-style format](../resources/check-project-format.md), and any other SDK-style projects, NuGet uses information in the project file directly to create a package. For a non-SDK-style project that uses ``, NuGet also uses the project file to create a package. -SDK-style projects have the pack functionality available by default. For non SDK-style PackageReference projects, you need to add the NuGet.Build.Tasks.Pack package to the project dependencies. For detailed information about MSBuild pack targets, see [NuGet pack and restore as MSBuild targets](../reference/msbuild-targets.md). +SDK-style projects have the pack functionality available by default. +For non-SDK-style PackageReference projects, it is also available by default starting from Visual Studio 2026. +In earlier versions of Visual Studio you need to add the NuGet.Build.Tasks.Pack package to the project dependencies and we recommend removing this package reference when upgrading to Visual Studio 2026. +For detailed information about MSBuild pack targets, see [NuGet pack and restore as MSBuild targets](../reference/msbuild-targets.md). -The command that creates a package, `msbuild -t:pack`, is functionally equivalent to `dotnet pack`. +For SDK-style projects, `msbuild -t:pack` is functionally equivalent to `dotnet pack`. > [!IMPORTANT] > This topic applies to [SDK-style](../resources/check-project-format.md) projects, typically .NET Core and .NET Standard projects, and to non-SDK-style projects that use PackageReference. @@ -77,16 +80,33 @@ For details on declaring dependencies and specifying version numbers, see [Packa [!INCLUDE [choose-package-id](includes/choose-package-id.md)] -## Add the NuGet.Build.Tasks.Pack package +## Configure project for pack -If you are using MSBuild with a non-SDK-style project and PackageReference, add the NuGet.Build.Tasks.Pack package to your project. +SDK-style projects do not require any additional configuration. -1. Open the project file and add the following after the `` element: +Non-SDK-style projects either need at least one package installed (via PackageReference, not packages.config), or the project explicitly needs to instruct NuGet to treat the project as a PackageReference project via the `RestoreProjectStyle` property. + +Visual Studio 2022 and earlier does not have pack built-in, so you also need to install the NuGet.Build.Tasks.Pack package. +When upgrading to Visual Studio 2026 or later, we recommend uninstalling the package, so that you benefit from new features and bug fixes. + +1. Edit the project file. + + If you want to explicitly instruct NuGet to treat the project as PackageReference (the project does not have any packages installed), find or add a `` that does not have any `Condition` statement, and add: + + ```xml + + + PackageReference + + + ``` + + If you are using Visual Studio 2022 or earlier, add the following after the `` element: ```xml - + ``` @@ -98,7 +118,7 @@ If you are using MSBuild with a non-SDK-style project and PackageReference, add You typically want to start the Developer Command Prompt for Visual Studio from the **Start** menu, as it will be configured with all the necessary paths for MSBuild. -3. Switch to the folder containing the project file and type the following command to install the NuGet.Build.Tasks.Pack package. +3. Switch to the folder containing the project file and type the following command to restore the NuGet.Build.Tasks.Pack package. ```cmd # Uses the project file in the current folder by default diff --git a/docs/create-packages/multiple-target-frameworks-project-file.md b/docs/create-packages/multiple-target-frameworks-project-file.md index 326dc1e6f..bd321d0d1 100644 --- a/docs/create-packages/multiple-target-frameworks-project-file.md +++ b/docs/create-packages/multiple-target-frameworks-project-file.md @@ -4,7 +4,7 @@ description: Description of the various methods to target multiple .NET Framewor author: JonDouglas ms.author: jodou ms.date: 07/15/2019 -ms.topic: conceptual +ms.topic: how-to --- # Support multiple .NET Framework versions in your project file diff --git a/docs/create-packages/native-files-in-net-packages.md b/docs/create-packages/native-files-in-net-packages.md index db39ba523..2b4d6ef95 100644 --- a/docs/create-packages/native-files-in-net-packages.md +++ b/docs/create-packages/native-files-in-net-packages.md @@ -4,7 +4,7 @@ description: How to pack native libraries in .NET packages author: zivkan ms.author: zivkan ms.date: 09/26/2023 -ms.topic: conceptual +ms.topic: concept-article --- # Including native libraries in .NET packages @@ -162,7 +162,7 @@ Finally, the managed library, that uses P/Invoke to call into the native library ### SDK style projects targeting .NET Framework When the .NET SDK builds a project targeting the .NET Framework, if one of `RuntimeIdentifier` or `PlatformTarget` is set, the .NET SDK will set the other property to an appropriate value, and package `runtimes/` contents (that [follow NuGet's conventions](#understanding-nuget-package-asset-selection)) will be copied to the output directory. -If the the project does not set either `RuntimeIdentifier` or `PlatformTarget`, but any package contains RID specific contents, then the .NET SDK will set `PlatformTarget` to `x86`. +If the project does not set either `RuntimeIdentifier` or `PlatformTarget`, but any package contains RID specific contents, then the .NET SDK will set `PlatformTarget` to `x86`. Therefore, SDK style projects targeting .NET Framework will only use `AnyCPU` by default when none of the packages contain RID specific content. `dotnet build -r `, or the `publish` equivalent (for example, `dotnet publish -r win-arm64`) can be used to explicitly build or publish for a specific platform. diff --git a/docs/create-packages/set-package-type.md b/docs/create-packages/set-package-type.md index 2fc834ac8..ee8847234 100644 --- a/docs/create-packages/set-package-type.md +++ b/docs/create-packages/set-package-type.md @@ -4,7 +4,7 @@ description: Describes packages types to indicate intended use of a package. author: JonDouglas ms.author: jodou ms.date: 07/09/2019 -ms.topic: conceptual +ms.topic: how-to --- # Set a NuGet package type @@ -21,6 +21,8 @@ Packages can be marked with one more more *package types* to indicate its intend - `Template` type packages provide [custom templates](/dotnet/core/tools/custom-templates) that can be used to create files or projects like an app, service, tool, or class library. +- `McpServer` type packages contain MCP servers. This package type is always accompanied by the `DotnetTool` package type, because a local MCP server is distributed as a .NET tool. For information on MCP server and NuGet, see [MCP servers in NuGet packages](../concepts/nuget-mcp.md). + Packages not marked with a type, including all packages created with earlier versions of NuGet, default to the `Dependency` type. > [!NOTE] diff --git a/docs/guides/Native-Packages.md b/docs/guides/Native-Packages.md index 14f5c5353..68f42f4a7 100644 --- a/docs/guides/Native-Packages.md +++ b/docs/guides/Native-Packages.md @@ -4,7 +4,7 @@ description: Details on creating native NuGet packages that contains C++ code in author: JonDouglas ms.author: jodou ms.date: 01/09/2017 -ms.topic: conceptual +ms.topic: concept-article --- # Creating native packages diff --git a/docs/guides/analyzers-conventions.md b/docs/guides/analyzers-conventions.md index 8122c81dc..78156098d 100644 --- a/docs/guides/analyzers-conventions.md +++ b/docs/guides/analyzers-conventions.md @@ -4,7 +4,7 @@ description: Conventions for .NET analyzers that are packaged and distributed wi author: JonDouglas ms.author: jodou ms.date: 01/09/2017 -ms.topic: conceptual +ms.topic: article --- # Analyzer NuGet formats diff --git a/docs/guides/create-packages-for-xamarin.md b/docs/guides/create-packages-for-xamarin.md deleted file mode 100644 index 0ec741a5f..000000000 --- a/docs/guides/create-packages-for-xamarin.md +++ /dev/null @@ -1,279 +0,0 @@ ---- -title: Create NuGet Packages for Xamarin (for iOS, Android, and Windows) with Visual Studio 2017 or 2019 -description: An end-to-end walkthrough of creating NuGet packages for Xamarin that use native APIs on iOS, Android, and Windows. -author: JonDouglas -ms.author: jodou -ms.date: 11/05/2019 -ms.topic: tutorial ---- - -# Create packages for Xamarin with Visual Studio 2017 or 2019 - -A package for Xamarin contains code that uses native APIs on iOS, Android, and Windows, depending on the run-time operating system. Although this is straightforward to do, it's preferable to let developers consume the package from a PCL or .NET Standard libraries through a common API surface area. - -In this walkthrough you use Visual Studio 2017 or 2019 to create a cross-platform NuGet package that can be used in mobile projects on iOS, Android, and Windows. - -1. [Prerequisites](#prerequisites) -1. [Create the project structure and abstraction code](#create-the-project-structure-and-abstraction-code) -1. [Write your platform-specific code](#write-your-platform-specific-code) -1. [Create and update the .nuspec file](#create-and-update-the-nuspec-file) -1. [Package the component](#package-the-component) -1. [Related topics](#related-topics) - -## Prerequisites - -1. Visual Studio 2017 or 2019 with Universal Windows Platform (UWP) and Xamarin. Install the Community edition for free from [visualstudio.com](https://www.visualstudio.com/); you can use the Professional and Enterprise editions as well, of course. To include UWP and Xamarin tools, select a Custom install and check the appropriate options. -1. NuGet CLI. Download the latest version of nuget.exe from [nuget.org/downloads](https://nuget.org/downloads), saving it to a location of your choice. Then add that location to your PATH environment variable if it isn't already. - -> [!Note] -> nuget.exe is the CLI tool itself, not an installer, so be sure to save the downloaded file from your browser instead of running it. - -## Create the project structure and abstraction code - -1. Download and run the [Cross-Platform .NET Standard Plugin Templates extension](https://marketplace.visualstudio.com/items?itemName=vs-publisher-473885.PluginForXamarinTemplates) for Visual Studio. These templates will make it easy to create the necessary project structure for this walkthrough. -1. In Visual Studio 2017, **File > New > Project**, search for `Plugin`, select the **Cross-Platform .NET Standard Library Plugin** template, change the name to LoggingLibrary, and click OK. - - ![New Blank App (Xamarin.Forms Portable) project in VS 2017](media/CrossPlatform-NewProject.png) - - In Visual Studio 2019, **File > New > Project**, search for `Plugin`, select the **Cross-Platform .NET Standard Library Plugin** template, and click Next. - - ![New Blank App (Xamarin.Forms Portable) project in VS 2019](media/CrossPlatform-NewProject19-Part1.png) - - Change the name to LoggingLibrary, and click Create. - - ![New Blank App (Xamarin.Forms Portable) configuration in VS 2019](media/CrossPlatform-NewProject19-Part2.png) - -The resulting solution contains two Shared projects, along with a variety of platform-specific projects: - -- The `ILoggingLibrary` project, which is contained in the `ILoggingLibrary.shared.cs` file, defines the public interface (the API surface area) of the component. This is where you define the interface to your library. -- The other Shared project contains code in `CrossLoggingLibrary.shared.cs` that will locate a platform-specific implementation of the abstract interface at run time. You typically don't need to modify this file. -- The platform-specific projects, such as `LoggingLibrary.android.cs`, each contain a native implementation of the interface in their respective `LoggingLibraryImplementation.cs` (VS 2017) or `LoggingLibrary..cs` (VS 2019) files. This is where you build out your library's code. - -By default, the ILoggingLibrary.shared.cs file of the `ILoggingLibrary` project contains an interface definition, but no methods. For the purposes of this walkthrough, add a `Log` method as follows: - -```cs -using System; -using System.Collections.Generic; -using System.Text; - -namespace Plugin.LoggingLibrary -{ - /// - /// Interface for LoggingLibrary - /// - public interface ILoggingLibrary - { - /// - /// Log a message - /// - void Log(string text); - } -} -``` - -## Write your platform-specific code - -To implement a platform-specific implementation of the `ILoggingLibrary` interface and its methods, do the following: - -1. Open the `LoggingLibraryImplementation.cs` (VS 2017) or `LoggingLibrary..cs` (VS 2019) file of each platform project and add the necessary code. For example (using the `Android` platform project): - - ```cs - using System; - using System.Collections.Generic; - using System.Text; - - namespace Plugin.LoggingLibrary - { - /// - /// Implementation for Feature - /// - public class LoggingLibraryImplementation : ILoggingLibrary - { - /// - /// Log a message - /// - public void Log(string text) - { - throw new NotImplementedException("Called Log on Android"); - } - } - } - ``` - -1. Repeat this implementation in the projects for each platform you want to support. -1. Right-click the solution and select **Build Solution** to check your work and produce the artifacts that you package next. If you get errors about missing references, right-click the solution, select **Restore NuGet Packages** to install dependencies, and rebuild. - -> [!Note] -> If you are using Visual Studio 2019, before selecting **Restore NuGet Packages** and trying to rebuild, you need to change the version of `MSBuild.Sdk.Extras` to `2.0.54` in `LoggingLibrary.csproj`. This file can only be accessed by first right-clicking the project (below the solution) and selecting `Unload Project`, after which you right-click on the unloaded project and select `Edit LoggingLibrary.csproj`. - -> [!Note] -> To build for iOS you need a networked Mac connected to Visual Studio as described on [Introduction to Xamarin.iOS for Visual Studio](https://developer.xamarin.com/guides/ios/getting_started/installation/windows/introduction_to_xamarin_ios_for_visual_studio/). If you don't have a Mac available, clear the iOS project in the configuration manager (step 3 above). - -## Create and update the .nuspec file - -1. Open a command prompt, navigate to the `LoggingLibrary` folder that's one level below where the `.sln` file is, and run the NuGet `spec` command to create the initial `Package.nuspec` file: - - ```cli - nuget spec - ``` - -1. Rename this file to `LoggingLibrary.nuspec` and open it in an editor. -1. Update the file to match the following, replacing YOUR_NAME with an appropriate value. The `` value, specifically, must be unique across nuget.org (see the naming conventions described in [Creating a package](../create-packages/creating-a-package.md#choose-a-unique-package-identifier-and-setting-the-version-number)). Also note that you must also update the author and description tags or you get an error during the packing step. - - ```xml - - - - LoggingLibrary.YOUR_NAME - 1.0.0 - LoggingLibrary - YOUR_NAME - YOUR_NAME - false - Awesome application logging utility - First release - Copyright 2018 - logger logging logs - - - ``` - -> [!Tip] -> You can suffix your package version with `-alpha`, `-beta` or `-rc` to mark your package as pre-release, check [Pre-release versions](../create-packages/prerelease-packages.md) for more information about pre-release versions. - -### Add reference assemblies - -To include platform-specific reference assemblies, add the following to the `` element of `LoggingLibrary.nuspec` as appropriate for your supported platforms: - -```xml - - - - - - - - - - - - - - - - - - - - -``` - -> [!Note] -> To shorten the names of the DLL and XML files, right-click on any given project, select the **Library** tab, and change the assembly names. - -### Add dependencies - -If you have specific dependencies for native implementations, use the `` element with `` elements to specify them, for example: - -```xml - - - - - - - - - - - - -``` - -For example, the following would set iTextSharp as a dependency for the UAP target: - -```xml - - - - - -``` - -### Final .nuspec - -Your final `.nuspec` file should now look like the following, where again YOUR_NAME should be replaced with an appropriate value: - -```xml - - - - LoggingLibrary.YOUR_NAME - 1.0.0 - LoggingLibrary - YOUR_NAME - YOUR_NAME - false - Awesome application logging utility - First release - Copyright 2018 - logger logging logs - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -``` - -## Package the component - -With the completed `.nuspec` referencing all the files you need to include in the package, you're ready to run the `pack` command: - -```cli -nuget pack LoggingLibrary.nuspec -``` - -This will generate `LoggingLibrary.YOUR_NAME.1.0.0.nupkg`. Opening this file in a tool like the [NuGet Package Explorer](https://github.com/NuGetPackageExplorer/NuGetPackageExplorer) and expanding all the nodes, you see the following contents: - -![NuGet Package Explorer showing the LoggingLibrary package](media/Cross-Platform-PackageExplorer.png) - -> [!Tip] -> A `.nupkg` file is just a ZIP file with a different extension. You can also examine package contents, then, by changing `.nupkg` to `.zip`, but remember to restore the extension before uploading a package to nuget.org. - -To make your package available to other developers, follow the instructions on [Publish a package](../nuget-org/publish-a-package.md). - -## Related topics - -- [Nuspec Reference](../reference/nuspec.md) -- [Symbol packages](../create-packages/symbol-packages.md) -- [Package versioning](../concepts/package-versioning.md) -- [Supporting Multiple .NET Framework Versions](../create-packages/supporting-multiple-target-frameworks.md) -- [Include MSBuild props and targets in a package](../create-packages/creating-a-package.md#include-msbuild-props-and-targets-in-a-package) -- [Creating Localized Packages](../create-packages/creating-localized-packages.md) diff --git a/docs/guides/media/CrossPlatform-NewProject.png b/docs/guides/media/CrossPlatform-NewProject.png deleted file mode 100644 index 449fa4d0c..000000000 Binary files a/docs/guides/media/CrossPlatform-NewProject.png and /dev/null differ diff --git a/docs/guides/media/CrossPlatform-NewProject19-Part1.png b/docs/guides/media/CrossPlatform-NewProject19-Part1.png deleted file mode 100644 index 25418b39a..000000000 Binary files a/docs/guides/media/CrossPlatform-NewProject19-Part1.png and /dev/null differ diff --git a/docs/guides/media/CrossPlatform-NewProject19-Part2.png b/docs/guides/media/CrossPlatform-NewProject19-Part2.png deleted file mode 100644 index 373e8ff4d..000000000 Binary files a/docs/guides/media/CrossPlatform-NewProject19-Part2.png and /dev/null differ diff --git a/docs/hosting-packages/Local-Feeds.md b/docs/hosting-packages/Local-Feeds.md index de95954d3..6b422460f 100644 --- a/docs/hosting-packages/Local-Feeds.md +++ b/docs/hosting-packages/Local-Feeds.md @@ -4,7 +4,7 @@ description: How to create a local feed for NuGet packages using folders on your author: JonDouglas ms.author: jodou ms.date: 12/06/2017 -ms.topic: conceptual +ms.topic: how-to --- # Local feeds diff --git a/docs/hosting-packages/NuGet-Server.md b/docs/hosting-packages/NuGet-Server.md index 3c237ab33..b79f0a22e 100644 --- a/docs/hosting-packages/NuGet-Server.md +++ b/docs/hosting-packages/NuGet-Server.md @@ -4,7 +4,7 @@ description: How to create and host a NuGet package feed on any server running I author: JonDouglas ms.author: jodou ms.date: 07/11/2023 -ms.topic: conceptual +ms.topic: how-to --- # NuGet.Server diff --git a/docs/hosting-packages/Overview.md b/docs/hosting-packages/Overview.md index b016cef0d..9d98050e0 100644 --- a/docs/hosting-packages/Overview.md +++ b/docs/hosting-packages/Overview.md @@ -1,10 +1,10 @@ --- title: Overview of Hosting Your Own NuGet Feeds -description: An overview of opens for hosting your own NuGet package feeds or galleries either locally or remotely. +description: An overview of options for hosting your own NuGet package feeds or galleries either locally or remotely. author: JonDouglas ms.author: jodou ms.date: 3/2/2022 -ms.topic: conceptual +ms.topic: concept-article ms.reviewer: anangaur --- @@ -33,11 +33,16 @@ There are also several other NuGet hosting products such as [Azure Artifacts](ht - [JetBrains Space](https://www.jetbrains.com/help/space/nuget-feed.html) - [LiGet](https://github.com/ai-traders/liget), an open-source implementation of NuGet V2 server that runs on kestrel in docker - [MyGet](https://myget.org) -- [Nexus Repository OSS](https://www.sonatype.com/nexus-repository-oss) from Sonatype. +- [Nexus Repository OSS](https://www.sonatype.com/products/sonatype-nexus-oss-download) from Sonatype. - [NuGet Server (Open Source)](https://github.com/svenkle/nuget-server), an open-source implementation similar to Inedo's NuGet Server - [NuGet Server](http://nugetserver.net/), a community project from Inedo - [ProGet](https://inedo.com/proget) from Inedo - [Sleet](https://github.com/emgarten/sleet), an open-source NuGet V3 static feed generator - [TeamCity](https://www.jetbrains.com/teamcity/) from JetBrains. +- [RepoFlow](https://www.repoflow.io), a simple and easy-to-use package management platform. Regardless of how packages are hosted, you access them by adding them to the list of available sources in `NuGet.Config`. This can be done in Visual Studio as described in [Package Sources](../consume-packages/install-use-packages-visual-studio.md#package-sources), or from the command line using [`nuget sources`](../reference/cli-reference/cli-ref-sources.md). The path to a source can be a local folder pathname, a network name, or a URL. + +[NuGet's V3 protocol](../api/overview.md) uses a [service index](../api//service-index.md) that contains a list of URLs used by various NuGet operations. +All of the URLs in the service index must be accessible by developer and CI machines to avoid unexpected errors. +When installing any NuGet feed, it is important to validate that none of the service index resources are blocked by a company firewall, or if your network is disconnected from the Internet, that all service index resources are available on your private network. diff --git a/docs/index.yml b/docs/index.yml index 0ca90f01a..602660403 100644 --- a/docs/index.yml +++ b/docs/index.yml @@ -9,7 +9,7 @@ metadata: ms.topic: hub-page author: JonDouglas ms.author: jodou - ms.date: 05/26/2023 + ms.date: 03/03/2025 highlightedContent: items: diff --git a/docs/install-nuget-client-tools.md b/docs/install-nuget-client-tools.md index 0c18a13ef..1a2915b63 100644 --- a/docs/install-nuget-client-tools.md +++ b/docs/install-nuget-client-tools.md @@ -3,7 +3,7 @@ title: Install NuGet client tools description: Learn how to install and use the dotnet and NuGet client command-line interface (CLI) tools and the Package Manager tool for Visual Studio. author: JonDouglas ms.author: jodou -ms.date: 11/03/2023 +ms.date: 03/03/2025 ms.topic: quickstart --- @@ -40,7 +40,7 @@ Package Manager Console commands work only within Visual Studio on Windows and d ## Support policy -The Visual Studio for Windows support policy can be found at [Visual Studio Product Lifecycle and Servicing](https://learn.microsoft.com/visualstudio/productinfo/vs-servicing). +The Visual Studio for Windows support policy can be found at [Visual Studio Product Lifecycle and Servicing](/visualstudio/productinfo/vs-servicing). The most recent version of NuGet.exe is fully supported and can be relied on for bug fixes, updates, and enhancements. @@ -105,18 +105,18 @@ The following table compares the available features for the dotnet and `nuget.ex | Feature | dotnet CLI | nuget CLI (Windows) | nuget CLI (Mono) | Visual Studio (Windows) | Visual Studio for Mac | | --- | --- | --- | --- | --- | --- | -| Search packages | | ✔ | ✔ | ✔ | ✔ | +| Search packages | ✔ | ✔ | ✔ | ✔ | ✔ | | Install/uninstall packages | ✔ | ✔ (1) | ✔ | ✔ | ✔ | | Update packages | ✔ | ✔ | | ✔ | ✔ | | Restore packages | ✔ | ✔ | ✔ (2) | ✔ | ✔ | -| Manage package feeds (sources) | | ✔ | ✔ | ✔ | ✔ | +| Manage package feeds (sources) | ✔ | ✔ | ✔ | ✔ | ✔ | | Manage packages on a feed | ✔ | ✔ | ✔ | | | | Set API keys for feeds | | ✔ | ✔ | | | | Create packages (3) | ✔ | ✔ | ✔ (4) | ✔ | | | Publish packages | ✔ | ✔ | ✔ | ✔ | | | Replicate packages | | ✔ | ✔ | | | | Manage *global-package* and cache folders | ✔ | ✔ | ✔ | | | -| Manage NuGet configuration | | ✔ | ✔ | | | +| Manage NuGet configuration | ✔ | ✔ | ✔ | | | **Feature notes** diff --git a/docs/nuget-org/Deprecate-packages.md b/docs/nuget-org/Deprecate-packages.md index c9189ce99..e3a365978 100644 --- a/docs/nuget-org/Deprecate-packages.md +++ b/docs/nuget-org/Deprecate-packages.md @@ -4,7 +4,7 @@ description: Detailed description on the process of deprecating packages and how author: anangaur ms.author: anangaur ms.date: 09/23/2019 -ms.topic: conceptual +ms.topic: how-to ms.reviewer: karann-msft --- diff --git a/docs/nuget-org/Publish-a-package.md b/docs/nuget-org/Publish-a-package.md index 36ce9f614..3dfe32091 100644 --- a/docs/nuget-org/Publish-a-package.md +++ b/docs/nuget-org/Publish-a-package.md @@ -4,7 +4,7 @@ description: See detailed instructions about how to publish a NuGet package and author: JonDouglas ms.author: jodou ms.date: 8/29/2022 -ms.topic: conceptual +ms.topic: how-to ms.reviewer: anangaur --- diff --git a/docs/nuget-org/TOC.md b/docs/nuget-org/TOC.md index b102dd1e7..4c01db05f 100644 --- a/docs/nuget-org/TOC.md +++ b/docs/nuget-org/TOC.md @@ -8,6 +8,7 @@ ## [Package ID prefix reservation](id-prefix-reservation.md) ## [Package deprecation](deprecate-packages.md) ## [Package readme](package-readme-on-nuget-org.md) +## [Package sponsorship](package-sponsorship-on-nuget-org.md) # Policies ## [Data Requests](policies/Data-requests.md) ## [Dispute resolution](policies/dispute-resolution.md) diff --git a/docs/nuget-org/individual-accounts.md b/docs/nuget-org/individual-accounts.md index a1a1b95a7..f45e1b841 100644 --- a/docs/nuget-org/individual-accounts.md +++ b/docs/nuget-org/individual-accounts.md @@ -4,7 +4,8 @@ description: Individual acccounts on NuGet.org are required to publish packages author: mikejo5000 ms.author: mikejo ms.date: 06/05/2019 -ms.topic: conceptual +ms.topic: article +ms.custom: sfi-image-nochange --- # Individual accounts on NuGet.org diff --git a/docs/nuget-org/licenses.nuget.org.md b/docs/nuget-org/licenses.nuget.org.md index 9f82c2b95..f1c85a295 100644 --- a/docs/nuget-org/licenses.nuget.org.md +++ b/docs/nuget-org/licenses.nuget.org.md @@ -4,6 +4,7 @@ description: Protocol and display information for licenses.nuget.org. Describes author: agr ms.author: angrigor ms.date: 03/02/2023 +ms.topic: article --- # licenses.nuget.org @@ -88,4 +89,4 @@ license exception identifier may present in the path portion of the URL. Licenses.nuget.org responds to a request with a known license exception identifier with a HTTP 200 response and a web page containing the reference text for the specified license exception. -Any request containing an unsupported license exception identifier results in an HTTP 404 response. \ No newline at end of file +Any request containing an unsupported license exception identifier results in an HTTP 404 response. diff --git a/docs/nuget-org/media/nuget-org-permissions.png b/docs/nuget-org/media/nuget-org-permissions.png index 024b5ecce..6ab466f4d 100644 Binary files a/docs/nuget-org/media/nuget-org-permissions.png and b/docs/nuget-org/media/nuget-org-permissions.png differ diff --git a/docs/nuget-org/media/nuget-org-register-2fa.png b/docs/nuget-org/media/nuget-org-register-2fa.png deleted file mode 100644 index eadbdcb64..000000000 Binary files a/docs/nuget-org/media/nuget-org-register-2fa.png and /dev/null differ diff --git a/docs/nuget-org/media/nuget-org-register.png b/docs/nuget-org/media/nuget-org-register.png index b159da110..bed06b459 100644 Binary files a/docs/nuget-org/media/nuget-org-register.png and b/docs/nuget-org/media/nuget-org-register.png differ diff --git a/docs/nuget-org/media/sponsorship-add-link.png b/docs/nuget-org/media/sponsorship-add-link.png new file mode 100644 index 000000000..3274427db Binary files /dev/null and b/docs/nuget-org/media/sponsorship-add-link.png differ diff --git a/docs/nuget-org/media/sponsorship-button-package-details-page.png b/docs/nuget-org/media/sponsorship-button-package-details-page.png new file mode 100644 index 000000000..a01f0644f Binary files /dev/null and b/docs/nuget-org/media/sponsorship-button-package-details-page.png differ diff --git a/docs/nuget-org/media/sponsorship-display-links.png b/docs/nuget-org/media/sponsorship-display-links.png new file mode 100644 index 000000000..c959b3972 Binary files /dev/null and b/docs/nuget-org/media/sponsorship-display-links.png differ diff --git a/docs/nuget-org/media/sponsorship-link-error-manage-package.png b/docs/nuget-org/media/sponsorship-link-error-manage-package.png new file mode 100644 index 000000000..8862f267a Binary files /dev/null and b/docs/nuget-org/media/sponsorship-link-error-manage-package.png differ diff --git a/docs/nuget-org/media/sponsorship-section-manage-package-page.png b/docs/nuget-org/media/sponsorship-section-manage-package-page.png new file mode 100644 index 000000000..7f9acd289 Binary files /dev/null and b/docs/nuget-org/media/sponsorship-section-manage-package-page.png differ diff --git a/docs/nuget-org/media/trusted-publishing.png b/docs/nuget-org/media/trusted-publishing.png new file mode 100644 index 000000000..8cd0ecfbf Binary files /dev/null and b/docs/nuget-org/media/trusted-publishing.png differ diff --git a/docs/nuget-org/media/unmanaged-aad-tenant.png b/docs/nuget-org/media/unmanaged-aad-tenant.png index 03e74d160..166896024 100644 Binary files a/docs/nuget-org/media/unmanaged-aad-tenant.png and b/docs/nuget-org/media/unmanaged-aad-tenant.png differ diff --git a/docs/nuget-org/nuget-org-faq.yml b/docs/nuget-org/nuget-org-faq.yml index b08b51756..0a8f1bf36 100644 --- a/docs/nuget-org/nuget-org-faq.yml +++ b/docs/nuget-org/nuget-org-faq.yml @@ -5,7 +5,8 @@ metadata: author: shishirx34 ms.author: shishirh ms.date: 06/05/2019 - ms.topic: conceptual + ms.topic: faq + ms.custom: sfi-image-nochange title: NuGet.org frequently-asked questions summary: | @@ -79,20 +80,21 @@ sections: | Environment Variable | Description | Remarks | | --- | --- | --- | - | NUGET_ENABLE_ENHANCED_HTTP_RETRY | Enables or disables enhanced HTTP retry in NuGet. | Possible values are `true` (default since .NET CLI 6.0.300, NuGet CLI 6.2, Visual Studio 2022 version 17.2) or `false`. | | NUGET_ENHANCED_MAX_NETWORK_TRY_COUNT | Configures the maximum number of times an HTTP connection should be retried when enhanced retries are enabled. | A number representing how many retries to perform, the default value is `6`. | - | NUGET_ENHANCED_NETWORK_RETRY_DELAY_MILLISECONDS | Configures the amount of time to wait in milliseconds before retrying an HTTP connection when enhanced retries are enabled. | Number of millseconds to wait, the default value is `1000`. | + | NUGET_ENHANCED_NETWORK_RETRY_DELAY_MILLISECONDS | Configures the amount of time to wait in milliseconds before retrying an HTTP connection when enhanced retries are enabled. | Number of milliseconds to wait, the default value is `1000`. | > [!Note] > These environment variables are available since [.NET CLI](https://learn.microsoft.com/nuget/reference/dotnet-commands) (.NET SDK) 6.0.100, [NuGet CLI](https://learn.microsoft.com/nuget/reference/nuget-exe-cli-reference) 6.0, Visual Studio 2022 version 17.0 and corresponding MSBuild version. See [NuGet Release Notes](https://learn.microsoft.com/nuget/release-notes/). - If that version of NuGet client continues to fail, [contact support](https://www.nuget.org/policies/Contact) and provide additional connection troubleshooting information including: + > [!Important] + > NuGet.org recommends Alpine Linux users to upgrade to Alpine Linux 3.18.0 or newer. These versions support TCP fallback in the DNS resolver. If you use older versions of Alpine Linux that only support DNS over UDP, you may encounter DNS failures when accessing the [V3 API](https://learn.microsoft.com/nuget/nuget-org/overview-nuget-org#api-endpoint-for-nugetorg). + If that version of NuGet client continues to fail, [contact support](https://www.nuget.org/policies/Contact) and provide additional connection troubleshooting information including: + - !!! Your geographical area - The package sources you're using - The version of NuGet client you're using - A restore log with detailed verbosity - MTR or a Fiddler traces (see below) - - Your geographical area - Whether your machine is behind a proxy or firewall? - Is your machine located on a cloud providers' data center (Azure, AWS etc)? If yes, please provide the name of the provider and the region. diff --git a/docs/nuget-org/organizations-on-nuget-org.md b/docs/nuget-org/organizations-on-nuget-org.md index de008a8f4..36a65d2d3 100644 --- a/docs/nuget-org/organizations-on-nuget-org.md +++ b/docs/nuget-org/organizations-on-nuget-org.md @@ -4,10 +4,11 @@ description: Organizations on NuGet.org helps you to manage packages published b author: anangaur ms.author: anangaur ms.date: 04/10/2018 -ms.topic: conceptual +ms.topic: article ms.reviewer: - kraigb - camsoper +ms.custom: sfi-image-nochange --- # Your organization on NuGet.org diff --git a/docs/nuget-org/overview-nuget-org.md b/docs/nuget-org/overview-nuget-org.md index f0ac5eed3..aa160a850 100644 --- a/docs/nuget-org/overview-nuget-org.md +++ b/docs/nuget-org/overview-nuget-org.md @@ -4,7 +4,7 @@ description: Overview of NuGet.org author: mikejo5000 ms.author: mikejo ms.date: 06/05/2019 -ms.topic: conceptual +ms.topic: concept-article --- # Overview of NuGet.org @@ -33,6 +33,10 @@ Once you have a NuGet package (*.nupkg* file) to publish, you publish it to NuGe When you [publish a package](../create-packages/creating-a-package.md), you include the API key value in the CLI command. +## Trusted publishing + +NuGet.org supports [Trusted Publishing](trusted-publishing.md), which is a secure and streamlined way to publish NuGet packages. + ## ID prefixes When you publish packages, you can reserve and protect your identity by [reserving ID prefixes](id-prefix-reservation.md). When installing a package, package consumers are provided with additional information indicating that the package they are consuming is not deceptive in its identifying properties. diff --git a/docs/nuget-org/package-readme-on-nuget-org.md b/docs/nuget-org/package-readme-on-nuget-org.md index 2826cae28..f4ecd173c 100644 --- a/docs/nuget-org/package-readme-on-nuget-org.md +++ b/docs/nuget-org/package-readme-on-nuget-org.md @@ -4,7 +4,7 @@ description: Detailed explanation of how readme files on NuGet.org are rendered author: nkolev92 ms.author: nikolev ms.date: 08/31/2022 -ms.topic: conceptual +ms.topic: article ms.reviewer: anangaur --- @@ -27,6 +27,39 @@ Consider including the following items in your readme: * Where and how to leave feedback such as link to the project issues, Twitter, bug tracker, or other platform. * How to contribute, if applicable. +For example, you can start with this package README template: + +```text +# Package readme title, e.g., display name or title of the package (optional) + +Start with a clear and concise description: A brief overview of what your package is and does, also what problem it solves. + +## Getting started + +Explain how to use your package, provide clear and concise getting started instructions, including any necessary steps. + +### Prerequisites + +What are specific minimum requirements to use your packages? Consider excluding this section if your package works without any additional setup beyond simple package installation. + +## Usage + +Examples about how to use your package by providing code snippets/example images, or samples links on GitHub if applicable. + +- Provide sample code using code snippets +- Include screenshots, diagrams, or other visual help users better understand how to use your package + +## Additional documentation + +Provide links to more resources: List links such as detailed documentation, tutorial videos, blog posts, or any other relevant documentation to help users get the most out of your package. + +## Feedback + +Where and how users can leave feedback? + +- Links to a GitHub repository where could open issues, Twitter, a Discord channel, bug tracker, or other platforms where a package consumer can connect with the package author. +``` + Keep in mind, high quality readmes can come in a wide variety of formats, shapes, and sizes! If you already have a package available on NuGet.org, chances are that you already have a `readme.md` or other documentation file in your repository that would be a great addition to your NuGet.org details page. > [!Note] @@ -45,24 +78,22 @@ Due to security and privacy concerns, NuGet.org restricts the domains from which NuGet.org allows all images, including badges, from the following trusted domains to be rendered: * api.codacy.com -* app.codacy.com * api.codeclimate.com * api.dependabot.com -* api.travis-ci.com * api.reuse.software -* app.fossa.com -* app.fossa.io +* api.travis-ci.com +* app.codacy.com +* app.deepsource.com * avatars.githubusercontent.com -* badge.fury.io * badgen.net * badges.gitter.im -* buildstats.info -* caniuse.bitsofco.de * camo.githubusercontent.com +* caniuse.bitsofco.de * cdn.jsdelivr.net * cdn.syncfusion.com * ci.appveyor.com * circleci.com +* cloudback.it * codecov.io * codefactor.io * coveralls.io @@ -70,9 +101,11 @@ NuGet.org allows all images, including badges, from the following trusted domain * flat.badgen.net * github.com/.../workflows/.../badge.svg * gitlab.com -* img.shields.io * i.imgur.com +* img.shields.io +* infragistics.com * isitmaintained.com +* media.githubusercontent.com * opencollective.com * raw.github.com * raw.githubusercontent.com @@ -80,7 +113,6 @@ NuGet.org allows all images, including badges, from the following trusted domain * sonarcloud.io * travis-ci.com * travis-ci.org -* wakatime.com * user-images.githubusercontent.com If you feel that another domain should be added to the allow-list, please feel free to [file an issue](https://github.com/NuGet/NuGetGallery/issues) and it will be reviewed by our engineering team for privacy and security compliance. Images with relative local paths and images hosted from unsupported domains will not be rendered and will produce a warning on the readme file preview and package details page that is only visible to the package owners. diff --git a/docs/nuget-org/package-sponsorship-on-nuget-org.md b/docs/nuget-org/package-sponsorship-on-nuget-org.md new file mode 100644 index 000000000..af1f6e111 --- /dev/null +++ b/docs/nuget-org/package-sponsorship-on-nuget-org.md @@ -0,0 +1,118 @@ +--- +title: Package sponsorship on NuGet.org +description: Learn how to add sponsorship links to your NuGet packages and support package maintainers through NuGet.org's sponsorship feature. +author: pranathibora14 +ms.author: prabora +ms.date: 10/15/2025 +ms.topic: how-to +ai-usage: ai-generated +--- + +# Package sponsorship on NuGet.org + +The NuGet.org sponsorship feature makes it easier for package consumers to recognize and support the authors behind their favorite packages. + +NuGet.org enables package authors to add sponsorship URLs to their packages. These links appear when the "Sponsor" button on the package details page is selected. + + +## Setting up sponsorship for package publishers + +### Prerequisites + +- You must be the owner or co-owner of a package on NuGet.org +- Your sponsorship link platform must be from the approved list: + - GitHub Sponsors + - Patreon + - Open Collective + - Ko-fi + - Tidelift + - Liberapay + +### Navigate to your package management page + +1. Go to [NuGet.org](https://nuget.org) and sign in to your account. +2. Select your username in the top right corner. +3. Select **Manage Packages** from the dropdown menu. +4. Find the package you want to add sponsorship information for and select the edit button. + +### Access sponsorship settings + +1. On your package management page, scroll down to find the **Sponsorship Links** section. +2. Select to expand the collapsible **Sponsorship Links** section. +3. You'll see a form where you can add sponsorship URLs. + + ![Screenshot of the manage package page with the Sponsorship Links section](media/sponsorship-section-manage-package-page.png) + +### Add your sponsorship URLs + +1. Enter your sponsorship URL in the text field: + - Example: `https://github.com/sponsors/yourusername` + - Example: `https://www.patreon.com/yourusername` + + ![Screenshot of the sponsorship URL form with example URL filled in](media/sponsorship-add-link.png) + +2. Select the **Add** button. +3. The system automatically validates that your URL is from an approved platform. +4. If any URLs are invalid or from non-approved platforms, you'll see error messages to correct them. Otherwise, you'll see a confirmation message that your sponsorship link has been saved. + + ![Screenshot of a URL from a platform that is not approved](media/sponsorship-link-error-manage-package.png) + +5. Each added sponsorship URL will have a **Remove** button next to it if you need to delete it. +6. You can add up to 10 different sponsorship URLs per package ID. + +### Verify your sponsorship URLs display correctly + +1. Navigate to your package's public page on NuGet.org. +2. Look for the **Sponsor** button in the package details **About** section. +3. Select the **Sponsor** button to test that your URLs appear correctly in the popup. + + ![Screenshot of a package details page with the sponsorship links popup open](media/sponsorship-display-links.png) + +## Finding and supporting packages + +### Identify packages that need sponsorship + +1. Browse to any package page on NuGet.org. +2. Look for packages displaying a **Sponsor** button in the package details section. +3. The **Sponsor** button indicates that the package maintainer is seeking financial support. + + ![Screenshot of a package details page with a Sponsor button](media/sponsorship-button-package-details-page.png) + +### View available sponsorship options + +1. Select the **Sponsor** button on the package page. +2. A popup window appears showing all available sponsorship links for that package. + + ![Screenshot of a package details page with the sponsorship links popup open](media/sponsorship-display-links.png) + +### Choose your preferred sponsorship platform + +1. Review the available sponsorship options in the popup. +2. Select your preferred platform to be redirected to the external sponsorship page. +3. The link opens in a new tab or window, keeping the NuGet package page open. + +> [!IMPORTANT] +> These links take you to third-party platforms. Microsoft isn't affiliated with or responsible for the content or practices of third-party platforms, and we don't endorse them. Microsoft reserves the right to remove any allowed third-party platforms. + +## Frequently asked questions + +**Can I add sponsorship information to older versions of my package?** + +Yes! Sponsorship information is managed at the package ID level, so it automatically applies to all versions of your package, including previously published versions. + +**What happens if my sponsorship platform URL changes?** + +You can update your sponsorship URLs anytime through the package management page. Changes take effect immediately across all versions. + +**Can I see analytics on how many people selected my sponsorship links?** + +No, NuGet.org doesn't track sponsorship link selections. You'll need to check analytics on your sponsorship platform directly. + +**Can I add custom sponsorship platforms not on the approved list?** + +Currently, only the approved list of platforms is supported. This helps ensure security and legitimacy of sponsorship links. If you'd like to request a new platform to be added to the approved list, you can open an issue on the [NuGet Gallery repository](https://github.com/NuGet/NuGetGallery/issues). + +**Does NuGet.org store my financial information?** + +No personal or financial data is stored by NuGet.org. All transactions occur on secure external platforms that a maintainer chooses for sponsoring their packages. + diff --git a/docs/nuget-org/policies/data-requests.md b/docs/nuget-org/policies/data-requests.md index 57cab4356..9c29231ef 100644 --- a/docs/nuget-org/policies/data-requests.md +++ b/docs/nuget-org/policies/data-requests.md @@ -4,7 +4,7 @@ description: Policies for requesting user data export and delete author: JonDouglas ms.author: jodou ms.date: 05/01/2018 -ms.topic: conceptual +ms.topic: article --- # User Data Requests diff --git a/docs/nuget-org/policies/deleting-packages.md b/docs/nuget-org/policies/deleting-packages.md index 89fbd5a3b..9e99d39ab 100644 --- a/docs/nuget-org/policies/deleting-packages.md +++ b/docs/nuget-org/policies/deleting-packages.md @@ -4,7 +4,7 @@ description: Policies for unlisting packages from nuget.org; permanent deletion author: JonDouglas ms.author: jodou ms.date: 01/18/2018 -ms.topic: conceptual +ms.topic: how-to --- # Deleting packages diff --git a/docs/nuget-org/policies/dispute-resolution.md b/docs/nuget-org/policies/dispute-resolution.md index 94a1aea40..c9342a827 100644 --- a/docs/nuget-org/policies/dispute-resolution.md +++ b/docs/nuget-org/policies/dispute-resolution.md @@ -4,7 +4,7 @@ description: The process for resolving disputes between NuGet package publishers author: JonDouglas ms.author: jodou ms.date: 01/18/2018 -ms.topic: conceptual +ms.topic: how-to --- # Resolving disputes over NuGet package names diff --git a/docs/nuget-org/policies/export-control.md b/docs/nuget-org/policies/export-control.md index a0ce51d75..bc786531e 100644 --- a/docs/nuget-org/policies/export-control.md +++ b/docs/nuget-org/policies/export-control.md @@ -4,7 +4,7 @@ description: Policies governing export control laws author: JonDouglas ms.author: jodou ms.date: 06/27/2019 -ms.topic: conceptual +ms.topic: article --- # Export Control Policy diff --git a/docs/nuget-org/scoped-api-keys.md b/docs/nuget-org/scoped-api-keys.md index 6730218cf..f5b22ad84 100644 --- a/docs/nuget-org/scoped-api-keys.md +++ b/docs/nuget-org/scoped-api-keys.md @@ -4,7 +4,7 @@ description: Take control of API keys that you use to push packages author: mikejo5000 ms.author: mikejo ms.date: 06/04/2019 -ms.topic: conceptual +ms.topic: article --- # Scoped API keys @@ -99,4 +99,4 @@ You cannot modify the scope, but you can edit the package list it is applicable ### How do I know if any of my keys expired or are getting expired? -If any key expires, we will let you know through a warning message at the top of the page. We also send a warning e-mail to the account holder ten days before the expiration of the key so that you can act on it well in advance. \ No newline at end of file +If any key expires, we will let you know through a warning message at the top of the page. We also send a warning e-mail to the account holder ten days before the expiration of the key so that you can act on it well in advance. diff --git a/docs/nuget-org/trusted-publishing.md b/docs/nuget-org/trusted-publishing.md new file mode 100644 index 000000000..ca9faff1c --- /dev/null +++ b/docs/nuget-org/trusted-publishing.md @@ -0,0 +1,121 @@ +--- +title: Trusted Publishing +description: Trusted Publishing on nuget.org +author: etvorun +ms.author: evgenyt +ms.date: 07/01/2025 +ms.topic: article +--- + +# Trusted Publishing on nuget.org + +Trusted Publishing is a better way to publish NuGet packages. You don’t need to manage long-lived API keys anymore. Instead, you use short-lived credentials issued by your CI/CD system, like GitHub Actions. + +This makes your publishing process safer by reducing the risk of leaked credentials. It also makes automation easier because you don’t need to rotate or store secrets. This approach is part of a broader industry shift toward secure, keyless publishing. If you're curious, check out the OpenSSF initiative: https://repos.openssf.org/trusted-publishers-for-all-package-repositories. + +> ⚠️ **Heads up:** If you don’t see the **Trusted Publishing** option in your nuget.org account, it might not be available to you yet. We’re rolling it out gradually. + +## How it works + +When your GitHub Actions workflow runs, it requests an encrypted OIDC token from github.com. This token +includes information about your repository and workflow, and is cryptographically signed by GitHub Actions to prevent +tampering. The workflow forwards this token to nuget.org, which securely validates the token’s +authenticity with github.com using industry-standard cryptographic methods. A token exchange endpoint on nuget.org then checks +that the token’s details match a trusted publishing policy you’ve configured. If everything matches, +nuget.org issues a short-lived API key for your workflow to use when publishing your package. + +**Here’s the basic flow** + +1. Your CI/CD system (like GitHub Actions) runs a workflow. +2. It issues a short-lived token. +3. That token is sent to nuget.org. +4. NuGet verifies it and returns a temporary API key. +5. Your workflow uses that key to push the package. + +![Screenshot that shows Trusted Publishing page.](media/trusted-publishing.png) + +NuGet’s temporary API keys are valid for **1 hour**, so your workflow should request the key shortly before publishing. +If you request it too early, it might expire before the push happens. + +Each short-lived token can only be used once to obtain a single temporary API key—one token, one API key. + +This setup gives you a secure and automated way to publish packages, without the risks that come with long-lived secrets. + + +## GitHub Actions Setup + +To get started: + +1. Log into **nuget.org**. +2. Click your username and choose **Trusted Publishing**. +3. Add a new trusted publishing policy. For a GitHub repository `https://github.com/contoso/contoso-sdk` + with a workflow file `.github/workflows/build.yml` enter the following trusted policy details (case‑insensitive): + - **Repository Owner:** `contoso` + - **Repository:** `contoso-sdk` + - **Workflow File:** `build.yml` + > This corresponds to your workflow at `.github/workflows/build.yml`. Enter the **file name only** (`build.yml`)—do not include the `.github/workflows/` path. + - **Environment (optional):** `release` + > Enter environment if your workflow uses e.g. `environment: release` and you want to restrict this policy to that environment. Leave this empty if you do not use GitHub Actions environments. +4. In your **GitHub repo**, update your workflow to request a short‑lived API key and push your package. +Here’s a basic example: + +```yaml +jobs: + build-and-publish: + permissions: + id-token: write # enable GitHub OIDC token issuance for this job + + steps: + # Build your artifacts/my-sdk.nupkg package here + + # Get a short-lived NuGet API key + - name: NuGet login (OIDC → temp API key) + uses: NuGet/login@v1 + id: login + with: + user: contoso-bot # Recommended: use a secret like ${{ secrets.NUGET_USER }} for your nuget.org username (profile name), NOT your email address + + # Push the package + - name: NuGet push + run: dotnet nuget push artifacts/my-sdk.nupkg --api-key ${{steps.login.outputs.NUGET_API_KEY}} --source https://api.nuget.org/v3/index.json +``` + + +## Policy Ownership + +When you create a Trusted Publishing policy, you need to choose who owns it. The owner can be either: + +- **You (an individual user)** +- **An organization you belong to** + +The policy will apply to all packages owned by the selected owner. That means it controls who can publish or modify those packages using Trusted Publishing. + +If you choose an organization, make sure you're an active member. If you leave the org later, the policy may become inactive until you're added back. + +Choosing the right owner helps ensure your publishing setup stays secure and aligned with your team’s structure. + + +## Policies Pending Full Activation + +Sometimes when you create a Trusted Publishing policy, it starts out as temporarily active for 7 days. This usually happens with private GitHub repos. You’ll see this status in the UI. During that time, it behaves like a regular policy. But if no publish happens within those 7 days, the policy automatically becomes inactive. You can restart the 7-day window at any time—even after it expires. + +Why is this temporary period necessary? Because NuGet needs GitHub repository and owner IDs to lock the policy to the original repo and owner. That helps prevent resurrection attacks. Without those IDs, someone could delete a repo, recreate it with the same name, and try to publish as if nothing changed. + +Once a successful publish provides the IDs (as part of GitHub’s short-lived token), the policy becomes permanently active. + + +## Policy Ownership Warnings + +Trusted Publishing policies are tied to a specific owner—either an individual user or an organization. +If something changes with that ownership, the policy might become inactive. When that happens, you'll see a warning in the UI. + +### Common cases + +- **User removed from organization** + If a policy is owned by an organization and the user who created it is later removed from that org, the policy becomes inactive. + If the user is added back to the organization, the policy will be active again automatically. + +- **Organization is no longer active** + If the organization that owns the policy is locked or deleted, the policy becomes inactive. + +These warnings help make sure that only active, secure policies are used when publishing packages. diff --git a/docs/policies/Ecosystem.md b/docs/policies/Ecosystem.md index 4a4c52c4c..1431b870f 100644 --- a/docs/policies/Ecosystem.md +++ b/docs/policies/Ecosystem.md @@ -4,7 +4,7 @@ description: Comprehensive resources in the NuGet ecosystem including NuGet sour author: JonDouglas ms.author: jodou ms.date: 01/18/2018 -ms.topic: conceptual +ms.topic: concept-article --- # An overview of the NuGet ecosystem diff --git a/docs/policies/Governance.md b/docs/policies/Governance.md index fce9b9a5e..d1e4e1dc8 100644 --- a/docs/policies/Governance.md +++ b/docs/policies/Governance.md @@ -4,7 +4,7 @@ description: The governance model for NuGet, including roles and responsibilitie author: JonDouglas ms.author: jodou ms.date: 01/18/2018 -ms.topic: conceptual +ms.topic: article --- # NuGet governance diff --git a/docs/quickstart/create-and-publish-a-package-using-the-dotnet-cli.md b/docs/quickstart/create-and-publish-a-package-using-the-dotnet-cli.md index b8aadf5ba..1c662c94d 100644 --- a/docs/quickstart/create-and-publish-a-package-using-the-dotnet-cli.md +++ b/docs/quickstart/create-and-publish-a-package-using-the-dotnet-cli.md @@ -3,7 +3,7 @@ title: Create and publish a NuGet package with the dotnet CLI description: Walk through quickly creating and publishing a NuGet package by using the dotnet CLI. author: JonDouglas ms.author: jodou -ms.date: 08/21/2023 +ms.date: 03/03/2025 ms.topic: quickstart --- @@ -100,7 +100,7 @@ Congratulations on creating and publishing your first NuGet package! ## Related video -> [!Video https://learn.microsoft.com/shows/NuGet-101/Create-and-Publish-a-NuGet-Package-with-the-NET-CLI-5-of-5/player] +> [!VIDEO https://learn-video.azurefd.net/vod/player?show=dotnet-package-management-with-nuget-for-beginners&ep=creating-and-publishing-a-nuget-package-nuget-for-beginners] Find more NuGet videos on [Channel 9](/shows/NuGet-101/) and [YouTube](https://www.youtube.com/playlist?list=PLdo4fOcmZ0oVLvfkFk8O9h6v2Dcdh2bh_). diff --git a/docs/quickstart/create-and-publish-a-package-using-visual-studio-net-framework.md b/docs/quickstart/create-and-publish-a-package-using-visual-studio-net-framework.md index b8c21dabd..694fbab75 100644 --- a/docs/quickstart/create-and-publish-a-package-using-visual-studio-net-framework.md +++ b/docs/quickstart/create-and-publish-a-package-using-visual-studio-net-framework.md @@ -3,7 +3,7 @@ title: "Quickstart: Create and publish a package using Visual Studio (.NET Frame description: A quickstart that shows how to create and publish a .NET Framework NuGet package using Visual Studio on Windows. author: JonDouglas ms.author: jodou -ms.date: 08/21/2023 +ms.date: 03/03/2025 ms.topic: quickstart --- @@ -54,7 +54,7 @@ To create a class library project, follow these steps: } ``` - Within a real-world NuGet package, you'd likely implement many useful features with which others can build applications. You can also set the target frameworks. For examples, see [UWP](../guides/create-uwp-packages.md) and [Xamarin](../guides/create-packages-for-xamarin.md). + Within a real-world NuGet package, you'd likely implement many useful features with which others can build applications. You can also set the target frameworks. For an example, see [UWP](../guides/create-uwp-packages.md). ## Configure project properties for the package diff --git a/docs/quickstart/create-and-publish-a-package-using-visual-studio.md b/docs/quickstart/create-and-publish-a-package-using-visual-studio.md index 72cb9b772..dd1169c71 100644 --- a/docs/quickstart/create-and-publish-a-package-using-visual-studio.md +++ b/docs/quickstart/create-and-publish-a-package-using-visual-studio.md @@ -3,7 +3,7 @@ title: "Quickstart: Create and publish a NuGet package using Visual Studio (Wind description: A quickstart that shows how to create and publish a .NET NuGet package using Visual Studio for Windows. author: JonDouglas ms.author: jodou -ms.date: 08/21/2023 +ms.date: 03/03/2025 ms.topic: quickstart --- @@ -11,7 +11,7 @@ ms.topic: quickstart With Microsoft Visual Studio, you can create a NuGet package from a .NET class library, and then publish it to nuget.org using a CLI tool. -The quickstart is for Windows users only. If you're using Visual Studio for Mac, see [Create a NuGet package from existing library projects](/xamarin/cross-platform/app-fundamentals/nuget-multiplatform-libraries/existing-library) or use the [.NET CLI](create-and-publish-a-package-using-the-dotnet-cli.md). +The quickstart is for Windows users only. If you're using a Mac, use the [.NET CLI](create-and-publish-a-package-using-the-dotnet-cli.md). ## Prerequisites @@ -214,17 +214,17 @@ In this example, the property specifies a file named *readme.txt* in the project 3 ---------------------------------------------------- 4 5 ----Silverlight 4 and Windows Phone 7.1+ projects----- -6 To use XPATH features: System.Xml.Xpath.dll from the 3 Silverlight 4 SDK must be referenced. -7 This is normally found at -8 %ProgramFiles(x86)%\Microsoft SDKs\Microsoft SDKs\Silverlight\v4.0\Libraries\Client -9 or +6 To use XPATH features: System.Xml.Xpath.dll from the 3 Silverlight 4 SDK must be referenced. +7 This is normally found at +8 %ProgramFiles(x86)%\Microsoft SDKs\Microsoft SDKs\Silverlight\v4.0\Libraries\Client +9 or 10 %ProgramFiles%\Microsoft SDKs\Microsoft SDKs\Silverlight\v4.0\Libraries\Client 11 12 ----Silverlight 5 projects----- -13 To use XPATH features: System.Xml.Xpath.dll from the Silverlight 5 SDK must be referenced. -14 This is normally found at -15 %ProgramFiles(x86)%\Microsoft SDKs\Microsoft SDKs\Silverlight\v5.0\Libraries\Client -16 or +13 To use XPATH features: System.Xml.Xpath.dll from the Silverlight 5 SDK must be referenced. +14 This is normally found at +15 %ProgramFiles(x86)%\Microsoft SDKs\Microsoft SDKs\Silverlight\v5.0\Libraries\Client +16 or 17 %ProgramFiles%\Microsoft SDKs\Microsoft SDKs\Silverlight\v5.0\Libraries\Client ``` @@ -233,9 +233,7 @@ In this example, the property specifies a file named *readme.txt* in the project ## Related video -> [!VIDEO https://learn.microsoft.com/shows/NuGet-101/Create-and-Publish-a-NuGet-Package-with-Visual-Studio-4-of-5/player] - -Find more NuGet videos on [Channel 9](/shows/NuGet-101/) and [YouTube](https://www.youtube.com/playlist?list=PLdo4fOcmZ0oVLvfkFk8O9h6v2Dcdh2bh_). +Find NuGet videos on [Channel 9](/shows/NuGet-101/) and [YouTube](https://www.youtube.com/playlist?list=PLdo4fOcmZ0oVLvfkFk8O9h6v2Dcdh2bh_). Congratulations on creating a NuGet package by using a Visual Studio .NET class library. Advance to the next article to learn how to create a NuGet package with the Visual Studio .NET Framework. diff --git a/docs/quickstart/install-and-use-a-package-in-visual-studio-mac.md b/docs/quickstart/install-and-use-a-package-in-visual-studio-mac.md index 8151b05ee..4dd4766b6 100644 --- a/docs/quickstart/install-and-use-a-package-in-visual-studio-mac.md +++ b/docs/quickstart/install-and-use-a-package-in-visual-studio-mac.md @@ -9,7 +9,7 @@ ms.topic: quickstart # Quickstart: Install and use a package in Visual Studio for Mac -NuGet packages contain reusable code that other developers make available to you for use in your projects. See [What is NuGet?](../What-is-NuGet.md) for background. Packages are installed into a Visual Studio for Mac project using the NuGet Package Manager. This article demonstrates the process using the popular [Newtonsoft.Json](https://www.nuget.org/packages/Newtonsoft.Json/) package and a .NET Core console project. The same process applies to any other Xamarin or .NET Core project. +NuGet packages contain reusable code that other developers make available to you for use in your projects. See [What is NuGet?](../What-is-NuGet.md) for background. Packages are installed into a Visual Studio for Mac project using the NuGet Package Manager. This article demonstrates the process using the popular [Newtonsoft.Json](https://www.nuget.org/packages/Newtonsoft.Json/) package and a .NET Core console project. The same process applies to any other .NET Core project. Once installed, refer to the package in code with `using ` where \ is specific to the package you're using. Once the reference is made, you can call the package through its API. @@ -66,7 +66,7 @@ With the Newtonsoft.Json package in the project, you can call its `JsonConvert.S public string Email { get; set; } public DateTime DOB { get; set; } } - + class Program { static void Main(string[] args) diff --git a/docs/quickstart/install-and-use-a-package-in-visual-studio.md b/docs/quickstart/install-and-use-a-package-in-visual-studio.md index 3c41248df..5a73bf2cc 100644 --- a/docs/quickstart/install-and-use-a-package-in-visual-studio.md +++ b/docs/quickstart/install-and-use-a-package-in-visual-studio.md @@ -3,7 +3,7 @@ title: "Quickstart: Install and use a NuGet package in Visual Studio (Windows on description: In this quickstart, you learn how to install and use a NuGet package in a Visual Studio project for Windows. author: JonDouglas ms.author: jodou -ms.date: 08/21/2023 +ms.date: 03/03/2025 ms.topic: quickstart --- @@ -128,8 +128,7 @@ With the `Newtonsoft.Json` package in the project, call its `JsonConvert.Seriali ## Related video -- [Install and Use a NuGet Package with Visual Studio](/shows/nuget-101/install-and-use-a-nuget-package-with-visual-studio-2-of-5/player) -- Find more NuGet videos on [Channel 9](/shows/nuget-101/) and [YouTube](https://www.youtube.com/playlist?list=PLdo4fOcmZ0oVLvfkFk8O9h6v2Dcdh2bh_). +- Find NuGet videos on [Channel 9](/shows/nuget-101/) and [YouTube](https://www.youtube.com/playlist?list=PLdo4fOcmZ0oVLvfkFk8O9h6v2Dcdh2bh_). ## See also diff --git a/docs/quickstart/install-and-use-a-package-using-the-dotnet-cli.md b/docs/quickstart/install-and-use-a-package-using-the-dotnet-cli.md index 6e53cadac..b4ccfb956 100644 --- a/docs/quickstart/install-and-use-a-package-using-the-dotnet-cli.md +++ b/docs/quickstart/install-and-use-a-package-using-the-dotnet-cli.md @@ -3,7 +3,7 @@ title: Install and use a NuGet package with the dotnet CLI description: Get a quick tutorial on how to use the dotnet CLI to install and use a NuGet package in a .NET project. author: JonDouglas ms.author: jodou -ms.date: 08/21/2023 +ms.date: 03/03/2025 ms.topic: quickstart --- @@ -103,7 +103,7 @@ Congratulations on installing and using your first NuGet package! ## Related video -> [!VIDEO https://learn.microsoft.com/shows/NuGet-101/Install-and-Use-a-NuGet-Package-with-the-NET-CLI-3-of-5/player] +> [!VIDEO https://learn-video.azurefd.net/vod/player?show=dotnet-package-management-with-nuget-for-beginners&ep=installing-a-nuget-package-using-the-dotnet-cli-nuget-for-beginners] Find more NuGet videos on [Channel 9](/shows/NuGet-101/) and [YouTube](https://www.youtube.com/playlist?list=PLdo4fOcmZ0oVLvfkFk8O9h6v2Dcdh2bh_). diff --git a/docs/reference/Errors-and-Warnings.md b/docs/reference/Errors-and-Warnings.md index 66fd911fc..3abf97dd5 100644 --- a/docs/reference/Errors-and-Warnings.md +++ b/docs/reference/Errors-and-Warnings.md @@ -27,29 +27,29 @@ NuGet supports the following configuration properties. | Group | Error Numbers | | --- | --- | -| Invalid input errors | [NU1001](./errors-and-warnings/NU1001.md), [NU1002](./errors-and-warnings/NU1002.md), [NU1003](./errors-and-warnings/NU1003.md), [NU1004](./errors-and-warnings/NU1004.md), [NU1005](./errors-and-warnings/NU1005.md), [NU1006](./errors-and-warnings/NU1006.md), [NU1007](./errors-and-warnings/NU1007.md), [NU1008](./errors-and-warnings/NU1008.md), [NU1009](./errors-and-warnings/NU1009.md), [NU1010](./errors-and-warnings/NU1010.md), [NU1011](./errors-and-warnings/NU1011.md), [NU1012](./errors-and-warnings/NU1012.md), | +| Invalid input errors | [NU1001](./errors-and-warnings/NU1001.md), [NU1002](./errors-and-warnings/NU1002.md), [NU1003](./errors-and-warnings/NU1003.md), [NU1004](./errors-and-warnings/NU1004.md), [NU1005](./errors-and-warnings/NU1005.md), [NU1006](./errors-and-warnings/NU1006.md), [NU1007](./errors-and-warnings/NU1007.md), [NU1008](./errors-and-warnings/NU1008.md), [NU1009](./errors-and-warnings/NU1009.md), [NU1010](./errors-and-warnings/NU1010.md), [NU1011](./errors-and-warnings/NU1011.md), [NU1012](./errors-and-warnings/NU1012.md), [NU1013](./errors-and-warnings/NU1013.md), [NU1014](./errors-and-warnings/NU1014.md), [NU1015](./errors-and-warnings/NU1015.md), [NU1016](./errors-and-warnings/NU1016.md), [NU1017](./errors-and-warnings/NU1017.md) | | Missing package and project errors | [NU1100](./errors-and-warnings/NU1100.md), [NU1101](./errors-and-warnings/NU1101.md), [NU1102](./errors-and-warnings/NU1102.md), [NU1103](./errors-and-warnings/NU1103.md), [NU1104](./errors-and-warnings/NU1104.md), [NU1105](./errors-and-warnings/NU1105.md), [NU1106](./errors-and-warnings/NU1106.md), [NU1107](./errors-and-warnings/NU1107.md), [NU1108](./errors-and-warnings/NU1108.md), [NU1109](./errors-and-warnings/NU1109.md) | -| Package source mapping errors | [NU1110](./errors-and-warnings/NU1110.md) +| Package source mapping errors | [NU1110](./errors-and-warnings/NU1110.md) | | Compatibility errors | [NU1201](./errors-and-warnings/NU1201.md), [NU1202](./errors-and-warnings/NU1202.md), [NU1203](./errors-and-warnings/NU1203.md), [NU1204](./errors-and-warnings/NU1204.md), [NU1401](./errors-and-warnings/NU1401.md), [NU1402](./errors-and-warnings/NU1402.md), [NU1403](./errors-and-warnings/NU1403.md) | | Dotnet Tool restore errors | [NU1211](./errors-and-warnings/NU1211.md), [NU1212](./errors-and-warnings/NU1212.md), [NU1213](./errors-and-warnings/NU1213.md) | -| NuGet source errors | [NU1301](./errors-and-warnings/NU1301.md) | +| NuGet source errors | [NU1301](./errors-and-warnings/NU1301.md), [NU1302](./errors-and-warnings/NU1302.md) | | NuGet internal errors | [NU1000](./errors-and-warnings/NU1000.md) | | Signed packages errors (creation and verification) | [NU3001](./errors-and-warnings/NU3001.md), [NU3004](./errors-and-warnings/NU3004.md), [NU3005](./errors-and-warnings/NU3005.md), [NU3008](./errors-and-warnings/NU3008.md), [NU3034](./errors-and-warnings/NU3034.md)| -| Pack Errors | [NU5000](./errors-and-warnings/NU5000.md), [NU5001](./errors-and-warnings/NU5001.md), [NU5002](./errors-and-warnings/NU5002.md), [NU5003](./errors-and-warnings/NU5003.md), [NU5004](./errors-and-warnings/NU5004.md), [NU5005](./errors-and-warnings/NU5005.md), [NU5007](./errors-and-warnings/NU5007.md), [NU5008](./errors-and-warnings/NU5008.md), [NU5009](./errors-and-warnings/NU5009.md), [NU5010](./errors-and-warnings/NU5010.md), [NU5011](./errors-and-warnings/NU5011.md), [NU5012](./errors-and-warnings/NU5012.md), [NU5013](./errors-and-warnings/NU5013.md), [NU5014](./errors-and-warnings/NU5014.md), [NU5015](./errors-and-warnings/NU5015.md), [NU5016](./errors-and-warnings/NU5016.md), [NU5017](./errors-and-warnings/NU5017.md), [NU5018](./errors-and-warnings/NU5018.md), [NU5019](./errors-and-warnings/NU5019.md), [NU5020](./errors-and-warnings/NU5020.md), [NU5021](./errors-and-warnings/NU5021.md), [NU5022](./errors-and-warnings/NU5022.md), [NU5023](./errors-and-warnings/NU5023.md), [NU5024](./errors-and-warnings/NU5024.md), [NU5025](./errors-and-warnings/NU5025.md), [NU5026](./errors-and-warnings/NU5026.md), [NU5027](./errors-and-warnings/NU5027.md), [NU5028](./errors-and-warnings/NU5028.md), [NU5029](./errors-and-warnings/NU5029.md), [NU5036](./errors-and-warnings/NU5036.md), [NU5042](./errors-and-warnings/NU5042.md), [NU5049](./errors-and-warnings/NU5049.md) -| License specific Pack Errors | [NU5030](./errors-and-warnings/NU5030.md), [NU5031](./errors-and-warnings/NU5031.md), [NU5032](./errors-and-warnings/NU5032.md), [NU5033](./errors-and-warnings/NU5033.md), [NU5034](./errors-and-warnings/NU5034.md), [NU5035](./errors-and-warnings/NU5035.md) +| Pack Errors | [NU5000](./errors-and-warnings/NU5000.md), [NU5001](./errors-and-warnings/NU5001.md), [NU5002](./errors-and-warnings/NU5002.md), [NU5003](./errors-and-warnings/NU5003.md), [NU5004](./errors-and-warnings/NU5004.md), [NU5005](./errors-and-warnings/NU5005.md), [NU5007](./errors-and-warnings/NU5007.md), [NU5008](./errors-and-warnings/NU5008.md), [NU5009](./errors-and-warnings/NU5009.md), [NU5010](./errors-and-warnings/NU5010.md), [NU5011](./errors-and-warnings/NU5011.md), [NU5012](./errors-and-warnings/NU5012.md), [NU5013](./errors-and-warnings/NU5013.md), [NU5014](./errors-and-warnings/NU5014.md), [NU5015](./errors-and-warnings/NU5015.md), [NU5016](./errors-and-warnings/NU5016.md), [NU5017](./errors-and-warnings/NU5017.md), [NU5018](./errors-and-warnings/NU5018.md), [NU5019](./errors-and-warnings/NU5019.md), [NU5020](./errors-and-warnings/NU5020.md), [NU5021](./errors-and-warnings/NU5021.md), [NU5022](./errors-and-warnings/NU5022.md), [NU5023](./errors-and-warnings/NU5023.md), [NU5024](./errors-and-warnings/NU5024.md), [NU5025](./errors-and-warnings/NU5025.md), [NU5026](./errors-and-warnings/NU5026.md), [NU5027](./errors-and-warnings/NU5027.md), [NU5028](./errors-and-warnings/NU5028.md), [NU5029](./errors-and-warnings/NU5029.md), [NU5036](./errors-and-warnings/NU5036.md), [NU5042](./errors-and-warnings/NU5042.md), [NU5049](./errors-and-warnings/NU5049.md) | +| License specific Pack Errors | [NU5030](./errors-and-warnings/NU5030.md), [NU5031](./errors-and-warnings/NU5031.md), [NU5032](./errors-and-warnings/NU5032.md), [NU5033](./errors-and-warnings/NU5033.md), [NU5034](./errors-and-warnings/NU5034.md), [NU5035](./errors-and-warnings/NU5035.md) | | NuGetAudit specific warnings | [NU1014](./errors-and-warnings/NU1014.md), [NU1900](./errors-and-warnings/NU1900.md), [NU1901, NU1902, NU1903, NU1904](./errors-and-warnings/NU1901-NU1904.md), [NU1905](./errors-and-warnings/NU1905.md) | ## Warnings | Group | Warning numbers | | --- | --- | -| Invalid input warnings | [NU1501](./errors-and-warnings/NU1501.md), [NU1502](./errors-and-warnings/NU1502.md), [NU1503](./errors-and-warnings/NU1503.md), [NU1504](./errors-and-warnings/NU1504.md), [NU1505](./errors-and-warnings/NU1505.md), [NU1506](./errors-and-warnings/NU1506.md), [NU1507](./errors-and-warnings/NU1507.md) | +| Invalid input warnings | [NU1501](./errors-and-warnings/NU1501.md), [NU1502](./errors-and-warnings/NU1502.md), [NU1503](./errors-and-warnings/NU1503.md), [NU1504](./errors-and-warnings/NU1504.md), [NU1505](./errors-and-warnings/NU1505.md), [NU1506](./errors-and-warnings/NU1506.md), [NU1507](./errors-and-warnings/NU1507.md), [NU1508](./errors-and-warnings/NU1508.md), [NU1509](./errors-and-warnings/NU1509.md), [NU1510](./errors-and-warnings/NU1510.md), [NU1511](./errors-and-warnings/NU1511.md) | | Unexpected package version warnings | [NU1601](./errors-and-warnings/NU1601.md), [NU1602](./errors-and-warnings/NU1602.md), [NU1603](./errors-and-warnings/NU1603.md), [NU1604](./errors-and-warnings/NU1604.md), [NU1605](./errors-and-warnings/NU1605.md), [NU1606](./errors-and-warnings/NU1108.md), [NU1607](./errors-and-warnings/NU1107.md) | | Resolver conflict warnings | [NU1608](./errors-and-warnings/NU1608.md) | -| Package fallback warnings | [NU1701](./errors-and-warnings/NU1701.md) | +| Package fallback warnings | [NU1701](./errors-and-warnings/NU1701.md), [NU1702](./errors-and-warnings/NU1702.md), [NU1703](./errors-and-warnings/NU1703.md)| | Feed warnings | [NU1801](./errors-and-warnings/NU1801.md), [NU1802](./errors-and-warnings/NU1802.md), [NU1803](./errors-and-warnings/NU1803.md) | | NuGet internal warnings | [NU1500](./errors-and-warnings/NU1500.md) | -| Signed packages warnings (creation and verification) | [NU3000](./errors-and-warnings/NU3000.md), [NU3002](./errors-and-warnings/NU3002.md), [NU3003](./errors-and-warnings/NU3003.md), [NU3006](./errors-and-warnings/NU3006.md), [NU3007](./errors-and-warnings/NU3007.md), [NU3009](./errors-and-warnings/NU3009.md), [NU3010](./errors-and-warnings/NU3010.md), [NU3011](./errors-and-warnings/NU3011.md), [NU3012](./errors-and-warnings/NU3012.md), [NU3013](./errors-and-warnings/NU3013.md), [NU3014](./errors-and-warnings/NU3014.md), [NU3015](./errors-and-warnings/NU3015.md), [NU3016](./errors-and-warnings/NU3016.md), [NU3017](./errors-and-warnings/NU3017.md), [NU3018](./errors-and-warnings/NU3018.md), [NU3019](./errors-and-warnings/NU3019.md), [NU3020](./errors-and-warnings/NU3020.md), [NU3021](./errors-and-warnings/NU3021.md), [NU3022](./errors-and-warnings/NU3022.md), [NU3023](./errors-and-warnings/NU3023.md), [NU3024](./errors-and-warnings/NU3024.md), [NU3025](./errors-and-warnings/NU3025.md), [NU3026](./errors-and-warnings/NU3026.md), [NU3027](./errors-and-warnings/NU3027.md), [NU3028](./errors-and-warnings/NU3028.md), [NU3029](./errors-and-warnings/NU3029.md), [NU3030](./errors-and-warnings/NU3030.md), [NU3031](./errors-and-warnings/NU3031.md), [NU3032](./errors-and-warnings/NU3032.md), [NU3033](./errors-and-warnings/NU3033.md), [NU3035](./errors-and-warnings/NU3035.md), [NU3036](./errors-and-warnings/NU3036.md), [NU3037](./errors-and-warnings/NU3037.md), [NU3038](./errors-and-warnings/NU3038.md), [NU3040](./errors-and-warnings/NU3040.md), [NU3042](./errors-and-warnings/NU3042.md) | -| Pack Warnings | [NU5100](./errors-and-warnings/NU5100.md), [NU5101](./errors-and-warnings/NU5101.md), [NU5102](./errors-and-warnings/NU5102.md), [NU5103](./errors-and-warnings/NU5103.md), [NU5104](./errors-and-warnings/NU5104.md), [NU5105](./errors-and-warnings/NU5105.md), [NU5106](./errors-and-warnings/NU5106.md), [NU5107](./errors-and-warnings/NU5107.md), [NU5108](./errors-and-warnings/NU5108.md), [NU5109](./errors-and-warnings/NU5109.md), [NU5110](./errors-and-warnings/NU5110.md), [NU5111](./errors-and-warnings/NU5111.md), [NU5112](./errors-and-warnings/NU5112.md), [NU5114](./errors-and-warnings/NU5114.md), [NU5115](./errors-and-warnings/NU5115.md), [NU5116](./errors-and-warnings/NU5116.md), [NU5117](./errors-and-warnings/NU5117.md), [NU5118](./errors-and-warnings/NU5118.md), [NU5119](./errors-and-warnings/NU5119.md), [NU5120](./errors-and-warnings/NU5120.md), [NU5121](./errors-and-warnings/NU5121.md), [NU5122](./errors-and-warnings/NU5122.md), [NU5123](./errors-and-warnings/NU5123.md), [NU5127](./errors-and-warnings/NU5127.md), [NU5128](./errors-and-warnings/NU5128.md), [NU5129](./errors-and-warnings/NU5129.md), [NU5130](./errors-and-warnings/NU5130.md), [NU5131](./errors-and-warnings/NU5131.md), [NU5133](./errors-and-warnings/NU5133.md), [NU5500](./errors-and-warnings/NU5500.md), [NU5501](./errors-and-warnings/NU5501.md) -| License specific Pack Warnings | [NU5124](./errors-and-warnings/NU5124.md), [NU5125](./errors-and-warnings/NU5125.md) +| Signed packages warnings (creation and verification) | [NU3000](./errors-and-warnings/NU3000.md), [NU3002](./errors-and-warnings/NU3002.md), [NU3003](./errors-and-warnings/NU3003.md), [NU3006](./errors-and-warnings/NU3006.md), [NU3007](./errors-and-warnings/NU3007.md), [NU3009](./errors-and-warnings/NU3009.md), [NU3010](./errors-and-warnings/NU3010.md), [NU3011](./errors-and-warnings/NU3011.md), [NU3012](./errors-and-warnings/NU3012.md), [NU3013](./errors-and-warnings/NU3013.md), [NU3014](./errors-and-warnings/NU3014.md), [NU3015](./errors-and-warnings/NU3015.md), [NU3016](./errors-and-warnings/NU3016.md), [NU3017](./errors-and-warnings/NU3017.md), [NU3018](./errors-and-warnings/NU3018.md), [NU3019](./errors-and-warnings/NU3019.md), [NU3020](./errors-and-warnings/NU3020.md), [NU3021](./errors-and-warnings/NU3021.md), [NU3022](./errors-and-warnings/NU3022.md), [NU3023](./errors-and-warnings/NU3023.md), [NU3024](./errors-and-warnings/NU3024.md), [NU3025](./errors-and-warnings/NU3025.md), [NU3026](./errors-and-warnings/NU3026.md), [NU3027](./errors-and-warnings/NU3027.md), [NU3028](./errors-and-warnings/NU3028.md), [NU3029](./errors-and-warnings/NU3029.md), [NU3030](./errors-and-warnings/NU3030.md), [NU3031](./errors-and-warnings/NU3031.md), [NU3032](./errors-and-warnings/NU3032.md), [NU3033](./errors-and-warnings/NU3033.md), [NU3035](./errors-and-warnings/NU3035.md), [NU3036](./errors-and-warnings/NU3036.md), [NU3037](./errors-and-warnings/NU3037.md), [NU3038](./errors-and-warnings/NU3038.md), [NU3040](./errors-and-warnings/NU3040.md), [NU3042](./errors-and-warnings/NU3042.md), [NU3043](./errors-and-warnings/NU3043.md) | +| Pack Warnings | [NU5100](./errors-and-warnings/NU5100.md), [NU5101](./errors-and-warnings/NU5101.md), [NU5102](./errors-and-warnings/NU5102.md), [NU5103](./errors-and-warnings/NU5103.md), [NU5104](./errors-and-warnings/NU5104.md), [NU5105](./errors-and-warnings/NU5105.md), [NU5106](./errors-and-warnings/NU5106.md), [NU5107](./errors-and-warnings/NU5107.md), [NU5108](./errors-and-warnings/NU5108.md), [NU5109](./errors-and-warnings/NU5109.md), [NU5110](./errors-and-warnings/NU5110.md), [NU5111](./errors-and-warnings/NU5111.md), [NU5112](./errors-and-warnings/NU5112.md), [NU5114](./errors-and-warnings/NU5114.md), [NU5115](./errors-and-warnings/NU5115.md), [NU5116](./errors-and-warnings/NU5116.md), [NU5117](./errors-and-warnings/NU5117.md), [NU5118](./errors-and-warnings/NU5118.md), [NU5119](./errors-and-warnings/NU5119.md), [NU5120](./errors-and-warnings/NU5120.md), [NU5121](./errors-and-warnings/NU5121.md), [NU5122](./errors-and-warnings/NU5122.md), [NU5123](./errors-and-warnings/NU5123.md), [NU5127](./errors-and-warnings/NU5127.md), [NU5128](./errors-and-warnings/NU5128.md), [NU5129](./errors-and-warnings/NU5129.md), [NU5130](./errors-and-warnings/NU5130.md), [NU5131](./errors-and-warnings/NU5131.md), [NU5133](./errors-and-warnings/NU5133.md), [NU5500](./errors-and-warnings/NU5500.md), [NU5501](./errors-and-warnings/NU5501.md) | +| License specific Pack Warnings | [NU5124](./errors-and-warnings/NU5124.md), [NU5125](./errors-and-warnings/NU5125.md) | | Icon specific Pack Warnings | [NU5046](./errors-and-warnings/NU5046.md), [NU5047](./errors-and-warnings/NU5047.md), [NU5048](./errors-and-warnings/NU5048.md) | diff --git a/docs/reference/NuGet-Client-SDK.md b/docs/reference/NuGet-Client-SDK.md index fd0e3eee4..e58bee9bf 100644 --- a/docs/reference/NuGet-Client-SDK.md +++ b/docs/reference/NuGet-Client-SDK.md @@ -4,7 +4,7 @@ description: The API is evolving and not yet documented, but examples are availa author: JonDouglas ms.author: jodou ms.date: 01/09/2018 -ms.topic: conceptual +ms.topic: article --- # NuGet Client SDK diff --git a/docs/reference/cli-reference/cli-ref-environment-variables.md b/docs/reference/cli-reference/cli-ref-environment-variables.md index 1c4efb851..e0c993671 100644 --- a/docs/reference/cli-reference/cli-ref-environment-variables.md +++ b/docs/reference/cli-reference/cli-ref-environment-variables.md @@ -33,10 +33,9 @@ The list of properties documented in [NuGet pack and restore as MSBuild targets] | NUGET_RETRY_HTTP_429 | Change retry behavior on HTTP 429 responses | Prior to NuGet 6.5, NuGet would not retry requests that result in HTTP 429 on 408. The default value is `true`, and this environment variable can be set to `false` to opt-in to older NuGet behaviour (don't retry the request) | | NUGET_RESTORE_MSBUILD_VERBOSITY | Sets the MSBuild log verbosity. | Default is *quiet* ("/v:q"). Possible values *q[uiet]*, *m[inimal]*, *n[ormal]*, *d[etailed]*, and *diag[nostic]*. | | NUGET_SHOW_STACK | Determines whether the full exception (including stack trace) should be displayed to the user. | Specified as *true* or *false* (default). | -| NUGET_UPDATEFILETIME_MAXRETRIES | Sets the number of times NuGet will attempt to set the file timestamp when extracting packages. | On Windows anti-virus software might temporarily open files, preventing NuGet from changing the timestamp. NuGet uses an exponential back-off where the wait duration between attempts is `Math.Pow(2, retryNumber)`. The default max retries is 9, meaning the default total wait duration before failure will be approximately one second. | +| NUGET_UPDATEFILETIME_MAXRETRIES | Sets the number of times NuGet will attempt to retry seting the file timestamp when extracting packages when the first attempt failed. | On Windows anti-virus software might temporarily open files, preventing NuGet from changing the timestamp. NuGet uses an exponential back-off where the wait duration between attempts is `Math.Pow(2, retryNumber)`. The default max retries is 9, meaning the default total wait duration before failure will be approximately one second. | | NUGET_XMLDOC_MODE | Determines how assemblies XML documentation file extraction should be handled. | Supported modes are *skip* (do not extract XML documentation files), *compress* (store XML doc files as a zip archive) or *none* (default, treat XML doc files as regular files). | | NUGET_CERT_REVOCATION_MODE | Determines how the revocation status check of the certificate used to sign a package, is performed when a signed package is installed or restored. When not set, defaults to `online`.| Possible values *online* (default), *offline*. Related to [NU3028](../errors-and-warnings/NU3028.md) | -| NUGET_ENABLE_ENHANCED_HTTP_RETRY | Enables or disables enhanced HTTP retry in NuGet. | Possible values are `true` (default) or `false`. | | NUGET_ENHANCED_MAX_NETWORK_TRY_COUNT | Configures the maximum number of times an HTTP connection should be retried when enhanced retries are enabled. | A number representing how many retries to perform, the default value is `6`. | | NUGET_ENHANCED_NETWORK_RETRY_DELAY_MILLISECONDS | Configures the amount of time to wait in milliseconds before retrying an HTTP connection when enhanced retries are enabled. | Number of millseconds to wait, the default value is `1000`. | -| NUGET_EXPERIMENTAL_USE_NJ_FOR_FILE_PARSING | Determines whether or not `Netwonsoft.Json` is used for parsing the assets file during restore | Possible values are `true` or `false` (default). | + diff --git a/docs/reference/cli-reference/cli-ref-push.md b/docs/reference/cli-reference/cli-ref-push.md index b8f7b4569..cdb3fef24 100644 --- a/docs/reference/cli-reference/cli-ref-push.md +++ b/docs/reference/cli-reference/cli-ref-push.md @@ -28,6 +28,9 @@ where `` identifies the package to push to the server. ## Options +- **`-AllowInsecureConnections`** + Allows pushing to HTTP sources (insecure). For more information, refer to https://aka.ms/nuget-https-everywhere. + - **`-ApiKey`** The API key for the target repository. If not present, the one specified in the config file is used. diff --git a/docs/reference/cli-reference/cli-ref-sign.md b/docs/reference/cli-reference/cli-ref-sign.md index 732a71b47..e2fda227a 100644 --- a/docs/reference/cli-reference/cli-ref-sign.md +++ b/docs/reference/cli-reference/cli-ref-sign.md @@ -29,7 +29,14 @@ where `` is one or more `.nupkg` files. - **`-CertificateFingerprint`** - Specifies the SHA-1 fingerprint of the certificate used to search a local certificate store for the certificate. + Specifies the fingerprint to be used to search for the certificate in a local certificate store. + + Starting with NuGet.exe 6.12, this option can be used to specify the SHA-1, SHA-256, SHA-384, or SHA-512 fingerprint of the certificate. + However, a `NU3043` warning is raised when a SHA-1 certificate fingerprint is used because it is no longer considered secure. + In NuGet.exe 7.0 and later versions, the warning is elevated to an error. + Only SHA-2 family fingerprints (SHA-256, SHA-384, and SHA-512) are supported. + + All the previous versions of the NuGet.exe continue to accept only SHA-1 certificate fingerprint. - **`-CertificatePassword`** diff --git a/docs/reference/cli-reference/cli-ref-sources.md b/docs/reference/cli-reference/cli-ref-sources.md index 1be5d5e6b..56935e51b 100644 --- a/docs/reference/cli-reference/cli-ref-sources.md +++ b/docs/reference/cli-reference/cli-ref-sources.md @@ -13,6 +13,9 @@ ms.topic: reference Manages the list of sources located in the user scope configuration file or a specified configuration file. The user scope configuration file is located at `%appdata%\NuGet\NuGet.Config` (Windows) and `~/.nuget/NuGet/NuGet.Config` (Mac/Linux). +> [!NOTE] +> Use package sources that you trust. + Note that the source URL for nuget.org is `https://api.nuget.org/v3/index.json`. ## Usage @@ -54,7 +57,7 @@ where `` is one of *List, Add, Remove, Enable, Disable,* or *Update*, Specifies the password for authenticating with the source. > [!NOTE] - > Be aware that encrypted passwords are only supported on Windows. + > Be aware that encrypted passwords are only supported on Windows. > Moreover, they can only be decrypted on the same machine and by the same user who originally encrypted them. - **`-src|-Source`** @@ -87,6 +90,9 @@ where `` is one of *List, Add, Remove, Enable, Disable,* or *Update*, - **`-Verbosity [normal|quiet|detailed]`** Specifies the amount of detail displayed in the output: `normal` (the default), `quiet`, or `detailed`. + +- **`-AllowInsecureConnections`** + Allows HTTP connections for adding or updating packages. Note: This method is not secure. Available starting version 6.12. Also see [Environment variables](cli-ref-environment-variables.md) @@ -101,5 +107,7 @@ nuget sources Enable -Name "nuget.org" nuget sources add -name foo.bar -source C:\NuGet\local -username foo -password bar -StorePasswordInClearText -configfile %AppData%\NuGet\my.config +nuget sources add -name MyAzureDevOpsSource -source "https://pkgs.dev.azure.com/yourorgname/yourprojectname/_packaging/yourfeedname/nuget/v3/index.json" -username ignored -password + nuget sources Update -Name "nuget.org" -ProtocolVersion 3 ``` diff --git a/docs/reference/cli-reference/cli-ref-verify.md b/docs/reference/cli-reference/cli-ref-verify.md index ab6dda990..def7a7c90 100644 --- a/docs/reference/cli-reference/cli-ref-verify.md +++ b/docs/reference/cli-reference/cli-ref-verify.md @@ -13,6 +13,7 @@ ms.reviewer: rmpablos **Applies to:** package consumption • **Supported versions:** 4.6+ Verifies a package. +Starting with [NuGet 7.0](../../release-notes/NuGet-7.0.md), the package's content hash will also be displayed. Verification of signed packages is not yet supported under Mono. diff --git a/docs/reference/dotnet-Commands.md b/docs/reference/dotnet-Commands.md index 5b7f59b9f..945538842 100644 --- a/docs/reference/dotnet-Commands.md +++ b/docs/reference/dotnet-Commands.md @@ -4,7 +4,7 @@ description: A short reference for NuGet-related commands using the dotnet comma author: JonDouglas ms.author: jodou ms.date: 06/24/2019 -ms.topic: conceptual +ms.topic: article --- # dotnet CLI commands diff --git a/docs/reference/errors-and-warnings/NU1001.md b/docs/reference/errors-and-warnings/NU1001.md index 4b83c50c4..6d93d8643 100644 --- a/docs/reference/errors-and-warnings/NU1001.md +++ b/docs/reference/errors-and-warnings/NU1001.md @@ -12,7 +12,7 @@ f1_keywords: # NuGet Error NU1001 -
    The project 'Project' does not specify any target frameworks in 'ProjectFile'
    +> The project 'Project' does not specify any target frameworks in 'ProjectFile' ### Issue The project doesn't contain one or more frameworks. diff --git a/docs/reference/errors-and-warnings/NU1002.md b/docs/reference/errors-and-warnings/NU1002.md index 2b9e538cb..52f618153 100644 --- a/docs/reference/errors-and-warnings/NU1002.md +++ b/docs/reference/errors-and-warnings/NU1002.md @@ -12,7 +12,7 @@ f1_keywords: # NuGet Error NU1002 -
    'CLEAR' cannot be used in conjunction with other values
    +> 'CLEAR' cannot be used in conjunction with other values ### Issue Invalid combination of inputs along with a CLEAR keyword. diff --git a/docs/reference/errors-and-warnings/NU1003.md b/docs/reference/errors-and-warnings/NU1003.md index e23fe71e6..1f3802a3b 100644 --- a/docs/reference/errors-and-warnings/NU1003.md +++ b/docs/reference/errors-and-warnings/NU1003.md @@ -12,7 +12,7 @@ f1_keywords: # NuGet Error NU1003 -
    PackageTargetFallback and AssetTargetFallback cannot be used together. Remove PackageTargetFallback(deprecated) references from the project environment.
    +> PackageTargetFallback and AssetTargetFallback cannot be used together. Remove PackageTargetFallback(deprecated) references from the project environment. ### Issue `PackageTargetFallback` and `AssetTargetFallback` provide different behavior for selecting assets and cannot be used together. diff --git a/docs/reference/errors-and-warnings/NU1004.md b/docs/reference/errors-and-warnings/NU1004.md index c4350eb5e..bf015e828 100644 --- a/docs/reference/errors-and-warnings/NU1004.md +++ b/docs/reference/errors-and-warnings/NU1004.md @@ -13,8 +13,8 @@ f1_keywords: ## Scenario 1 -
    The project target frameworks are different than the lock file's target frameworks. Lock file target frameworks: net6.0,net5.0. Project target frameworks net6.0.
-The packages lock file is inconsistent with the project dependencies so restore can't be run in locked mode. Disable the RestoreLockedMode MSBuild property or pass an explicit --force-evaluate option to run restore to update the lock file.
    +> The project target frameworks are different than the lock file's target frameworks. Lock file target frameworks: net6.0,net5.0. Project target frameworks net6.0. +The packages lock file is inconsistent with the project dependencies so restore can't be run in locked mode. Disable the RestoreLockedMode MSBuild property or pass an explicit --force-evaluate option to run restore to update the lock file. ### Issue @@ -30,8 +30,8 @@ Consult the recommendations in the error message and do one of the following: ## Scenario 2 -
    The package reference Contoso.Library version has changed from [2.0.0, ) to [1.2.3, ).The packages lock file is inconsistent with the project dependencies so restore can't be run
- in locked mode. Disable the RestoreLockedMode MSBuild property or pass an explicit --force-evaluate option to run restore to update the lock file.
    +> The package reference Contoso.Library version has changed from [2.0.0, ) to [1.2.3, ).The packages lock file is inconsistent with the project dependencies so restore can't be run + in locked mode. Disable the RestoreLockedMode MSBuild property or pass an explicit --force-evaluate option to run restore to update the lock file. ### Issue diff --git a/docs/reference/errors-and-warnings/NU1005.md b/docs/reference/errors-and-warnings/NU1005.md index ac6b4e79d..456d2226d 100644 --- a/docs/reference/errors-and-warnings/NU1005.md +++ b/docs/reference/errors-and-warnings/NU1005.md @@ -13,7 +13,7 @@ f1_keywords: ## Scenario 1 -
    Invalid restore input where RestorePackagesWithLockFile property is set to false but a packages lock file exists at C:\SourceCode\ContosoProject\Contoso.Library\packages.lock.json
    +> Invalid restore input where RestorePackagesWithLockFile property is set to false but a packages lock file exists at C:\SourceCode\ContosoProject\Contoso.Library\packages.lock.json ### Issue @@ -27,7 +27,7 @@ There are 2 opt-in methods the lock file functionality, by setting the RestorePa ## Scenario 2 -
    RestoreForceEvaluate should not be used with RestoreLockedMode in the same command.
    +> RestoreForceEvaluate should not be used with RestoreLockedMode in the same command. ### Issue diff --git a/docs/reference/errors-and-warnings/NU1006.md b/docs/reference/errors-and-warnings/NU1006.md index 5f6094f6c..747177f2a 100644 --- a/docs/reference/errors-and-warnings/NU1006.md +++ b/docs/reference/errors-and-warnings/NU1006.md @@ -11,7 +11,7 @@ f1_keywords: # NuGet Error NU1006 -
    NuGet.Config has an invalid package source value 'C:\PackageSource>\'. Reason: Illegal characters in path.
    +> NuGet.Config has an invalid package source value 'C:\PackageSource>\'. Reason: Illegal characters in path. ### Issue diff --git a/docs/reference/errors-and-warnings/NU1007.md b/docs/reference/errors-and-warnings/NU1007.md index 987d8df27..907ce6836 100644 --- a/docs/reference/errors-and-warnings/NU1007.md +++ b/docs/reference/errors-and-warnings/NU1007.md @@ -11,8 +11,8 @@ f1_keywords: # NuGet Error NU1007 -
    The runtime.json specified in the project 'C:\Program Files\dotnet\sdk\X.Y.Z00\RuntimeIdentifierGraph.json
-' could not be parsed.
    +> The runtime.json specified in the project 'C:\Program Files\dotnet\sdk\X.Y.Z00\RuntimeIdentifierGraph.json +' could not be parsed. ### Issue diff --git a/docs/reference/errors-and-warnings/NU1008.md b/docs/reference/errors-and-warnings/NU1008.md index b8051432e..3be37802d 100644 --- a/docs/reference/errors-and-warnings/NU1008.md +++ b/docs/reference/errors-and-warnings/NU1008.md @@ -11,35 +11,49 @@ f1_keywords: # NuGet Error NU1008 -
    Projects that use central package version management should not define the version on the PackageReference items but on the PackageVersion items: PackageId.
    +> The following PackageReference items cannot define a value for Version: PackageName. Projects using Central Package Management must define a Version value on a PackageVersion item. -### Issue +## Issue -When using central package management, versions must be defined on the PackageVersion item. +A project is configured to use NuGet [Central Package Management](../../consume-packages/Central-Package-Management.md) and a `` item is defined which specifies a value for the `Version` attribute: -In your project file, you may see: +```xml + + + +``` +Alternatively, a `` item is defined with a child `` element that has a value specified: ```xml - - + + + 5.1.0 + + ``` -### Solution +Projects configured to use [Central Package Management](../../consume-packages/Central-Package-Management.md) should not define a version on `` items. +The version should be defined in on a corresponding `` item with the same identifier in [Directory.Packages.props](../../consume-packages/Central-Package-Management.md#enabling-central-package-management) file instead. -- Remove the version from the PackageId PackageReference. -- You may need to add or update the PackageVersion item for PackageId in Directory.Packages.props +## Solution -Example: +- Remove the `Version` attribute or child `` element from the `` item: -```xml - - -``` + ```xml + + + + ``` -```xml - - -``` +- Define a `` item that specifies the version in the [Directory.Packages.props](../../consume-packages/Central-Package-Management.md#enabling-central-package-management) file with the same identifier as the `` item: + + ```xml + + + + ``` + +Alternatively, Central Package Management allows overriding centrally defined package versions. See [Overriding Package Versions](../../consume-packages/Central-Package-Management.md#overriding-package-versions) for more information. > [!NOTE] > Note that metadata such as [IncludeAssets, PrivateAssets etc.](../../consume-packages/Package-References-in-Project-Files.md#controlling-dependency-assets) should remain on the PackageReference item. diff --git a/docs/reference/errors-and-warnings/NU1009.md b/docs/reference/errors-and-warnings/NU1009.md index c7e5e3d81..5c99ac709 100644 --- a/docs/reference/errors-and-warnings/NU1009.md +++ b/docs/reference/errors-and-warnings/NU1009.md @@ -11,13 +11,29 @@ f1_keywords: # NuGet Error NU1009 -
    The packages PackageId are implicitly referenced. You do not typically need to reference them from your project or in your central package versions management file. For more inform
-ation, see https://aka.ms/sdkimplicitrefs
    +> The following PackageReference items are implicitly defined and cannot define a PackageVersion item: PackageName. Projects using Central Package Management require that implicit package versions be specified by the PackageReference item. -### Issue +## Issue -Implicitly defined packages should not be managed centrally. +A project is configured to use NuGet [Central Package Management](../../consume-packages/Central-Package-Management.md) and a `` item is defined in the [Directory.Packages.props](../../consume-packages/Central-Package-Management.md#enabling-central-package-management) file for a package that is [implicitly defined](https://aka.ms/sdkimplicitrefs). +Implicitly defined packages are generally declared by an SDK to include packages on your behalf. +For these packages, the owner of the SDK controls the version being used and a user should not define a version with [Central Package Management](../../consume-packages/Central-Package-Management.md). -### Solution +```xml + + + +``` -Remove the PackageVersion for PackageId \ No newline at end of file +## Solution + +- Remove the `PackageVersion` item from the [Directory.Packages.props](../../consume-packages/Central-Package-Management.md#enabling-central-package-management) file that corresponds to the implicitly defined package: + + ```xml + + + + ``` + +> [!NOTE] +> Some SDKs allow you to override the implicitly defined package version by setting a specific MSBuild property for that package and the SDK may have documentation on how to do so. diff --git a/docs/reference/errors-and-warnings/NU1010.md b/docs/reference/errors-and-warnings/NU1010.md index c6a9e912d..046d4bdfb 100644 --- a/docs/reference/errors-and-warnings/NU1010.md +++ b/docs/reference/errors-and-warnings/NU1010.md @@ -11,12 +11,27 @@ f1_keywords: # NuGet Error NU1010 -
    The PackageReference items PackageId do not have corresponding PackageVersion.
    +> The following PackageReference items do not define a corresponding PackageVersion item: PackageName. Projects using Central Package Management must declare PackageReference and PackageVersion items with matching names -### Issue +## Issue -The PackageReference PackageId is missing a PackageVersion item. +A project is configured to use NuGet [Central Package Management](../../consume-packages/Central-Package-Management.md) and a `` item is defined but a corresponding `` item with the same name is not defined in the [Directory.Packages.props](../../consume-packages/Central-Package-Management.md#enabling-central-package-management) file: -### Solution +```xml + + + +``` -Add a PackageVersion item for PackageId in the [Directory.Packages.props](../../consume-packages/Central-Package-Management.md). +## Solution + +- Define a `` item that specifies the version in the [Directory.Packages.props](../../consume-packages/Central-Package-Management.md#enabling-central-package-management) file with the same identifier as the `` item: + + ```xml + + + + ``` +- If a `` item is properly defined and this error occurs in Visual Studio, check the Error List window for errors related to loading the project or failed [design time builds](https://github.com/dotnet/project-system/blob/main/docs/design-time-builds.md). +If Visual Studio is not able to successfully load the project or a design time build fails, NuGet may log this error because it does not have the required information to restore. +Resolving these underlying issues should fix this error. diff --git a/docs/reference/errors-and-warnings/NU1011.md b/docs/reference/errors-and-warnings/NU1011.md index ab5c76acf..c093a2ef8 100644 --- a/docs/reference/errors-and-warnings/NU1011.md +++ b/docs/reference/errors-and-warnings/NU1011.md @@ -11,23 +11,41 @@ f1_keywords: # NuGet Error NU1011 -
    Centrally defined floating package versions are not allowed.
    +> The following PackageVersion items cannot specify a floating version: PackageName. -### Issue +## Issue -`` items cannot contain floating versions. NuGet's central package management (CPM) is considered an enterprise-level feature which provides easier version -management at scale as well as deterministic and secure restores. The use of floating versions introduces the possibility for a bad package to be introduced into your build -after it has been pushed to a feed. This can lead to a situation where you made no changes in your repository but suddenly something is broken and there is no way for you to -get back into a good state without removing the floating version or pushing a newer version of the package which is fixed. Using non-floating versions means that every upgrade -to a package is backed by a commit in your repository making it easy to determine what change caused the break and to revert a commit to get back into a good state. +A project is configured to use NuGet [Central Package Management](../../consume-packages/Central-Package-Management.md) and a `` item is defined which specifies a [floating version](../../concepts/Package-Versioning.md#version-ranges) value for the `Version` attribute: -The [Transitive Pinning](../../consume-packages/Central-Package-Management.md#transitive-pinning) feature is designed to allow you to explicitly override the transitive versions in your graph for more control. Using a floating version as an override could make restores of different projects end up with different versions for the package that is supposed to be pinned, thus going against the promise of using the central version. +```xml + + + +``` +By default, `` items cannot specify floating versions. +NuGet's [Central Package Management](../../consume-packages/Central-Package-Management.md) provides users the ability to manage package versions in a single location as well as deterministic and secure restores. +The use of floating versions introduces the possibility for a bad package to be introduced into your build after it has been pushed to a feed. +This can lead to a situation where you made no changes in your repository but suddenly something is broken due to a problem in a new package and there is no way for you to get back into a good state without removing the floating version or pushing a newer version of the package which is fixed. +Using non-floating versions means that every upgrade to a package is backed by a commit in your repository, making it easy to determine what change caused the break and allows you to revert a commit to get back into a good state. + +Also, when using the [transitive pinning](../../consume-packages/Central-Package-Management.md#transitive-pinning) feature of [Central Package Management](../../consume-packages/Central-Package-Management.md), using a floating version as an override could make restores of different projects end up with different versions for the package that what is supposed to be pinned, thus going against the promise of using the centrally defined version. NuGet recommends you use automation like [Dependabot](https://docs.github.com/code-security/dependabot/working-with-dependabot) to keep package versions up-to-date which provides -a streamlined way of keeping packages updated while integrating into your existing developer workflow of a pull request, automated build validation, and testing all backed by a -commit in your repository. +a streamlined way of updating package versions while integrating into your existing developer workflow of a pull request, automated build validation, and testing all backed by a commit in your repository. + +## Solution +- It is recommended to change the floating version to a [non floating version range](../../concepts/Package-Versioning.md#version-ranges): +```xml + + + +``` -### Solution +- If that is not possible, or you wish to use floating versions with Central Package Management, you can do so by setting an MSBuild property: -Change the floating version to a [non floating version range](../../concepts/Package-Versioning.md#version-ranges). +```xml + + true + +``` diff --git a/docs/reference/errors-and-warnings/NU1012.md b/docs/reference/errors-and-warnings/NU1012.md index be74dc1fd..4d935401d 100644 --- a/docs/reference/errors-and-warnings/NU1012.md +++ b/docs/reference/errors-and-warnings/NU1012.md @@ -13,7 +13,7 @@ f1_keywords: ## Scenario 1 -Platform version is not present for one or more target frameworks, even though they have specified a platform: net6.0-android. +> Platform version is not present for one or more target frameworks, even though they have specified a platform: net6.0-android. ### Issue @@ -26,7 +26,7 @@ You have specified a target framework with a platform in your project file but t ## Scenario 2 -
    Some dependency group TFMs are missing a platform version: net6.0-android
    +> Some dependency group TFMs are missing a platform version: net6.0-android ### Issue diff --git a/docs/reference/errors-and-warnings/NU1013.md b/docs/reference/errors-and-warnings/NU1013.md new file mode 100644 index 000000000..d86b15dd9 --- /dev/null +++ b/docs/reference/errors-and-warnings/NU1013.md @@ -0,0 +1,38 @@ +--- +title: NuGet Error NU1013 +description: NU1013 error code +author: jeffkl +ms.author: jeffkl +ms.date: 03/24/2025 +ms.topic: reference +f1_keywords: + - "NU1013" +--- + +# NuGet Error NU1013 + +> The following PackageReference items cannot specify a value for VersionOverride: PackageName. Projects using Central Package Management are currently configured to disable this functionality. + +### Issue + +A project is configured to use NuGet [Central Package Management](../../consume-packages/Central-Package-Management.md) and a `` item is defined which specifies a value for the `VersionOverride` attribute but this functionality has been disabled: + +```xml + + false + + + + +``` + +### Solution +- Remove the `VersionOverride` attribute from the `` item: + +```xml + + + +``` + +- You can configure [Central Package Management](../../consume-packages/Central-Package-Management.md) to allow or disallow `VersionOverride` with the MSBuild property `CentralPackageVersionOverrideEnabled`. See [Overriding Package Versions](../../consume-packages/Central-Package-Management.md#overriding-package-versions) for more information. diff --git a/docs/reference/errors-and-warnings/NU1014.md b/docs/reference/errors-and-warnings/NU1014.md index 9b4503d0c..f4f601b8d 100644 --- a/docs/reference/errors-and-warnings/NU1014.md +++ b/docs/reference/errors-and-warnings/NU1014.md @@ -13,11 +13,11 @@ f1_keywords: ## Scenario -
    Invalid NuGetAudit value 'sample'. Valid values: true, false.
    +> Invalid NuGetAudit value 'sample'. Valid values: true, false. -
    Invalid NuGetAuditLevel value 'sample';. Valid values: low, moderate, high, critical.
    +> Invalid NuGetAuditLevel value 'sample';. Valid values: low, moderate, high, critical. -
    Invalid NuGetAuditMode value 'sample'. Valid values: direct, all.
    +> Invalid NuGetAuditMode value 'sample'. Valid values: direct, all. ### Issue diff --git a/docs/reference/errors-and-warnings/NU1015.md b/docs/reference/errors-and-warnings/NU1015.md new file mode 100644 index 000000000..e109d8636 --- /dev/null +++ b/docs/reference/errors-and-warnings/NU1015.md @@ -0,0 +1,34 @@ +--- +title: NuGet Error NU1015 +description: NU1015 error code +author: zivkan +ms.author: zivkan +ms.date: 06/04/2025 +ms.topic: reference +f1_keywords: + - "NU1015" +--- + +# NuGet Error NU1015 + +## Scenario + +> The following PackageReference item(s) do not have a version specified: Contoso.Utilities + +### Issue + +Your project file, or a file it imports (for example `Directory.Build.props`) has defined a `PackageReference` without a version. + +Projects using [Central Package Management (CPM)](../../consume-packages/Central-Package-Management.md) do not define a version on the PackageReference item, so this error could happen if a project has CPM disabled by accident, or if a project or `PackageReference` using CPM is copied into another solution that is not using CPM. + +### Solution + +- Add a version to the package reference + +If you edit your project, a package reference will generally look similar to ``, although [MSBuild allows multiple syntaxes to define item metadata](/visualstudio/msbuild/msbuild-items). +Add the `Version="1.2.3"` item metadata as defined. + +- Check Central Package Management configuration + +This NU1015 error only happens when CPM is disabled. +If Central Package Management (CPM) is intended to be enabled, check your configuration files to investigate why it is disabled. diff --git a/docs/reference/errors-and-warnings/NU1016.md b/docs/reference/errors-and-warnings/NU1016.md new file mode 100644 index 000000000..f8f297de7 --- /dev/null +++ b/docs/reference/errors-and-warnings/NU1016.md @@ -0,0 +1,38 @@ +--- +title: NuGet Error NU1016 +description: NU1016 error code +author: donnie-msft +ms.author: eagoodso +ms.date: 01/28/2025 +ms.topic: reference +f1_keywords: + - "NU1016" +--- + +# NuGet Error NU1016 + +> Managing packages with project.json is deprecated. Migrate to PackageReference. + +### Issue + +Managing packages with project.json is deprecated. Migrate to PackageReference. + +### Solution + +[Migrate your project from project.json to PackageReference](../../archive/project-json.md#migrate-projectjson-to-packagereference). + +**Visual Studio 2026 or later:** + +Your project.json project will be automatically migrated to PackageReference when you open the solution. Visual Studio will create a backup of the original files in a `Backup` folder in the project directory. + +**Visual Studio 2022:** + +You need to use the built-in migrator: + +1. Open your project.json project in Visual Studio +1. In Solution Explorer, find the project's Dependencies node +1. Right-click and select **Migrate project.json to PackageReference...** + +For detailed migration guidance, see the [project.json reference documentation](../../archive/project-json.md). + +For more information about package management formats, see [Package references in project files](../../consume-packages/Package-References-in-Project-Files.md). diff --git a/docs/reference/errors-and-warnings/NU1017.md b/docs/reference/errors-and-warnings/NU1017.md new file mode 100644 index 000000000..2e68f8e0b --- /dev/null +++ b/docs/reference/errors-and-warnings/NU1017.md @@ -0,0 +1,51 @@ +--- +title: NuGet Error NU1017 +description: NU1017 error code +author: Nigusu-Allehu +ms.author: Nigusu-Allehu +ms.date: 09/23/2025 +ms.topic: reference +f1_keywords: + - "NU1017" +--- + +# NuGet Error NU1017 + +## Scenario + +> Invalid package id : `contoso../id`. + +### Issue + +The package ID is invalid because it does not match the required format. +NuGet validates package IDs using this regex: + +```regex +^\w+([.-]\w+)*$ +``` + +* The ID must **start with a letter or number**. +* It can only contain **letters, numbers, dots (`.`), and dashes (`-`)**. +* Dots or dashes must be followed by more letters or numbers. +* You can have multiple parts separated by `.` or `-`, like `Contoso.App.Service`. + +### Solution + +To fix this error: + +* Replace or remove any invalid characters from the package ID. Only letters, numbers, dots (`.`), and dashes (`-`) are allowed. +* Ensure the package ID starts with a letter or number. +* Dots (`.`) or dashes (`-`) must always be followed by another letter or number (no consecutive dots/dashes, and none at the end). +* For example, change `contoso../id` to `Contoso.Id`. + +Valid: + +```xml + +``` + +Invalid: + +```xml + +``` diff --git a/docs/reference/errors-and-warnings/NU1100.md b/docs/reference/errors-and-warnings/NU1100.md index 6e883c627..b24fb6bd4 100644 --- a/docs/reference/errors-and-warnings/NU1100.md +++ b/docs/reference/errors-and-warnings/NU1100.md @@ -14,7 +14,7 @@ f1_keywords: ## Scenario 1 -
    Unable to resolve 'Dependency (>= 1.0.0)' for 'TargetFramework'
    +> Unable to resolve 'Dependency (>= 1.0.0)' for 'TargetFramework' ### Issue @@ -36,7 +36,7 @@ Alternatively, you can create a configuration file using [`dotnet new nugetconfi ## Scenario 2 -
     Unable to resolve 'Dependency (>= 1.0.0)' for 'TargetFramework'.  PackageSourceMapping is enabled, the following source(s) were not considered: nuget.
    +> Unable to resolve 'Dependency (>= 1.0.0)' for 'TargetFramework'. PackageSourceMapping is enabled, the following source(s) were not considered: nuget. ### Issue diff --git a/docs/reference/errors-and-warnings/NU1101.md b/docs/reference/errors-and-warnings/NU1101.md index 30e68ea8b..d94f69103 100644 --- a/docs/reference/errors-and-warnings/NU1101.md +++ b/docs/reference/errors-and-warnings/NU1101.md @@ -14,7 +14,7 @@ f1_keywords: ## Scenario 1 -
    Unable to find package 'PackageId'. No packages exist with this id in source(s): sourceA, sourceB, sourceC
    +> Unable to find package 'PackageId'. No packages exist with this id in source(s): sourceA, sourceB, sourceC ### Issue The package cannot be found on any sources. @@ -24,8 +24,8 @@ Examine the project's dependencies in Visual Studio to be sure you're using the ## Scenario 2 -
    Unable to find package 'PackageId'. No packages exist with this id in source(s): sourceA PackageSourceMapping is enabled, the following source(s) were not considered: sourceB, sourceC.
-
    +> Unable to find package 'PackageId'. No packages exist with this id in source(s): sourceA PackageSourceMapping is enabled, the following source(s) were not considered: sourceB, sourceC. + ### Issue The package cannot be found on any of the PackageSourceMapping configured sources. diff --git a/docs/reference/errors-and-warnings/NU1102.md b/docs/reference/errors-and-warnings/NU1102.md index ef3561d9c..670b3bc97 100644 --- a/docs/reference/errors-and-warnings/NU1102.md +++ b/docs/reference/errors-and-warnings/NU1102.md @@ -14,7 +14,7 @@ f1_keywords: ## Scenario 1 -
    Unable to find package 'PackageId' with version (>= 9.0.1)
      - Found 30 version(s) in 'sourceA' [ Nearest version: '4.0.0' ]
      - Found 10 version(s) in 'sourceB' [ Nearest version: '4.0.0-rc-2129' ]
      - Found 9 version(s) in 'sourceC' [ Nearest version: '3.0.0-beta-00032' ]
      - Found 0 version(s) in 'sourceD'
      - Found 0 version(s) in 'sourceE'
    +> Unable to find package 'PackageId' with version (>= 9.0.1)
    - Found 30 version(s) in 'sourceA' [ Nearest version: '4.0.0' ]
    - Found 10 version(s) in 'sourceB' [ Nearest version: '4.0.0-rc-2129' ]
    - Found 9 version(s) in 'sourceC' [ Nearest version: '3.0.0-beta-00032' ]
    - Found 0 version(s) in 'sourceD'
    - Found 0 version(s) in 'sourceE' ### Issue The package identifier is found but a version within the specified dependency range cannot be found on any of the sources. The range might be specified by a package and not the user. @@ -24,8 +24,8 @@ Edit the project file to correct the package version. Also check that the [NuGet ## Scenario 2 -
    Unable to find package 'PackageId' with version (>= 9.0.1)
      - Found 30 version(s) in 'sourceA' [ Nearest version: '4.0.0' ]
      - Versions from sourceB were not considered
-
    +> Unable to find package 'PackageId' with version (>= 9.0.1)
    - Found 30 version(s) in 'sourceA' [ Nearest version: '4.0.0' ]
    - Versions from sourceB were not considered + ### Issue The package identifier is found but a version within the specified dependency range cannot be found on any of the sources. The range might be specified by a package and not the user. diff --git a/docs/reference/errors-and-warnings/NU1103.md b/docs/reference/errors-and-warnings/NU1103.md index 838d11f45..c34bc4864 100644 --- a/docs/reference/errors-and-warnings/NU1103.md +++ b/docs/reference/errors-and-warnings/NU1103.md @@ -14,7 +14,7 @@ f1_keywords: ## Scenario 1 -
    Unable to find a stable package 'PackageId' with version (>= 3.0.0)
      - Found 10 version(s) in 'sourceA' [ Nearest version: '4.0.0-rc-2129' ]
      - Found 9 version(s) in 'sourceB' [ Nearest version: '3.0.0-beta-00032' ]
      - Found 0 version(s) in 'sourceC'
      - Found 0 version(s) in 'sourceD'
    +> Unable to find a stable package 'PackageId' with version (>= 3.0.0)
    - Found 10 version(s) in 'sourceA' [ Nearest version: '4.0.0-rc-2129' ]
    - Found 9 version(s) in 'sourceB' [ Nearest version: '3.0.0-beta-00032' ]
    - Found 0 version(s) in 'sourceC'
    - Found 0 version(s) in 'sourceD' ### Issue The project specified a stable version for the dependency range, but no stable versions were found in that range. Pre-release versions were found but are not allowed. @@ -24,7 +24,7 @@ Edit the version range in the project file to include pre-release versions. See ## Scenario 2 -
    Unable to find a stable package 'PackageId' with version (>= 3.0.0)
      - Found 10 version(s) in 'sourceA' [ Nearest version: '4.0.0-rc-2129' ]
      - Versions from sourceB were not considered
    +> Unable to find a stable package 'PackageId' with version (>= 3.0.0)
    - Found 10 version(s) in 'sourceA' [ Nearest version: '4.0.0-rc-2129' ]
    - Versions from sourceB were not considered ### Issue The project specified a stable version for the dependency range, but no stable versions were found in that range. Pre-release versions were found but are not allowed. diff --git a/docs/reference/errors-and-warnings/NU1104.md b/docs/reference/errors-and-warnings/NU1104.md index 6d5da8854..1ad9f91bf 100644 --- a/docs/reference/errors-and-warnings/NU1104.md +++ b/docs/reference/errors-and-warnings/NU1104.md @@ -12,7 +12,7 @@ f1_keywords: # NuGet Error NU1104 -
    Project reference does not exist 'ProjectFile'. Check that the project reference is valid and that the project file exists.
    +> Project reference does not exist 'ProjectFile'. Check that the project reference is valid and that the project file exists. ### Issue A ProjectReference points to a file that doesn't exist. diff --git a/docs/reference/errors-and-warnings/NU1105.md b/docs/reference/errors-and-warnings/NU1105.md index 10828c853..3d6d26856 100644 --- a/docs/reference/errors-and-warnings/NU1105.md +++ b/docs/reference/errors-and-warnings/NU1105.md @@ -12,7 +12,9 @@ f1_keywords: # NuGet Error NU1105 -
    Unable to read project information for 'ProjectFile'. The project file may be invalid or missing targets required for restore.
    +## Scenario 1 + +> Unable to read project information for 'ProjectFile'. The project file may be invalid or missing targets required for restore. ### Issue The project file exists but no restore information was provided for it. Ensure you are [opening a project with the new project system or the legacy project system](https://github.com/dotnet/project-system/blob/main/docs/opening-with-new-project-system.md#opening-with-the-new-project-system). @@ -23,7 +25,7 @@ The project file exists but no restore information was provided for it. Ensure y From the command line this could mean that the file is corrupt or that the `NuGet.targets` are not imported. To import the `NuGet.targets`, usually it's recommended to import the `Microsoft.Common.targets`. -To restore projects in solution using [.NET Core CLI](../../consume-packages/install-use-packages-dotnet-cli.md) use: +To restore projects in solution using [.NET CLI](../../consume-packages/install-use-packages-dotnet-cli.md) use: ```dotnetcli dotnet restore MySolution.sln ``` @@ -36,3 +38,16 @@ The error could also mean that the project is unloaded. * If you are using Visual Studio 2019 or later, NuGet has the ability to re-use artifacts from the previous restore for unloaded projects. In order for this scenario to work, you need to ensure that all projects currently in the solution have been restored from the command line prior to loading them in Visual Studio. * Alternatively, reload the project. + +## Scenario 2 + +> Invalid target framework 'net.6.0' + +### Issue +The project file exists but specifies an invalid target framework: `'net.6.0'`. +This can occur due to a typo or use of an unsupported format. + +### Solution + +Update the project file to use a valid target framework. In this case, replace `'net.6.0'` with `'net6.0'` (without the extra dot). +For a full list of supported frameworks and their correct formats, refer to the [.NET Target Frameworks](/dotnet/standard/frameworks) documentation. diff --git a/docs/reference/errors-and-warnings/NU1106.md b/docs/reference/errors-and-warnings/NU1106.md index 081219020..892b43262 100644 --- a/docs/reference/errors-and-warnings/NU1106.md +++ b/docs/reference/errors-and-warnings/NU1106.md @@ -12,7 +12,7 @@ f1_keywords: # NuGet Error NU1106 -
    Unable to satisfy conflicting requests for 'PackageId': 'Conflict path' Framework: 'Target graph'
    +> Unable to satisfy conflicting requests for 'PackageId': 'Conflict path' Framework: 'Target graph' ### Issue Dependency constraints cannot be resolved. diff --git a/docs/reference/errors-and-warnings/NU1107.md b/docs/reference/errors-and-warnings/NU1107.md index ff7627769..b9f3dbaef 100644 --- a/docs/reference/errors-and-warnings/NU1107.md +++ b/docs/reference/errors-and-warnings/NU1107.md @@ -13,7 +13,7 @@ f1_keywords: # NuGet Error NU1107 -
    Version conflict detected for 'PackageA'. Install/reference 'PackageA' v4.0.0 directly to resolve this issue.
      'PackageB' 3.5.0 -> 'PackageA' (= 3.5.0)
      'PackageC' 4.0.0 -> 'PackageA' (= 4.0.0)
    +> Version conflict detected for 'PackageA'. Install/reference 'PackageA' v4.0.0 directly to resolve this issue.
    'PackageB' 3.5.0 -> 'PackageA' (= 3.5.0)
    'PackageC' 4.0.0 -> 'PackageA' (= 4.0.0) ### Issue Unable to resolve dependency constraints between packages. Two different packages are asking for two different versions of 'PackageA'. The project needs to choose which version of 'PackageA' to use. diff --git a/docs/reference/errors-and-warnings/NU1108.md b/docs/reference/errors-and-warnings/NU1108.md index b5eb9c862..965b6dd63 100644 --- a/docs/reference/errors-and-warnings/NU1108.md +++ b/docs/reference/errors-and-warnings/NU1108.md @@ -13,7 +13,7 @@ f1_keywords: # NuGet Error NU1108 -
    Cycle detected: A -> B -> A
    +> Cycle detected: A -> B -> A ### Issue A circular dependency was detected. diff --git a/docs/reference/errors-and-warnings/NU1109.md b/docs/reference/errors-and-warnings/NU1109.md index 1249e90d2..c9efb8464 100644 --- a/docs/reference/errors-and-warnings/NU1109.md +++ b/docs/reference/errors-and-warnings/NU1109.md @@ -11,15 +11,37 @@ f1_keywords: # NuGet Error NU1109 -
    NU1109: Detected package downgrade: B from 2.0.0 to centrally defined 1.0.0. Update the centrally managed package version to a higher version.
    -'Project' -> 'A' 1.0.0 -> 'B' (>= 2.0.0)
    -'Project' -> 'B' (>= 1.0.0) +> NU1109: Detected package downgrade: PackageB from 2.0.0 to centrally defined 1.0.0. Update the centrally managed package version to a higher version.
    +>   'Project' -> 'PackageA' 1.0.0 -> 'PackageB' (>= 2.0.0)
    +>   'Project' -> 'PackageB' (>= 1.0.0) -### Issue +## Issue -A dependency package specified a version constraint on a higher version of a package than restore ultimately resolved. That is because of the [direct-dependency-wins](../../concepts/dependency-resolution.md#direct-dependency-wins) rule - when resolving packages, the direct package version in the subgraph will override that of the distant packages with the same ID. +A project is configured to use NuGet [Central Package Management](../../consume-packages/Central-Package-Management.md) and a transitive package dependency is pinned to a version lower than is specified by the dependency package. +When resolving packages, NuGet respects the [direct-dependency-wins](../../concepts/dependency-resolution.md#direct-dependency-wins) rule and the pinned package version overrides the version specified by the dependency package which results in a lower version of the package being resolved which could result in issues at runtime. -### Solution +```xml + + true + + + + + +``` -Update the PackageVersion of B to to the higher version of the package. -In the example above, you would change the package reference to `B` 2.0.0. +## Solution +- Update the `PackageVersion` of `PackageB` to the higher version of the package. + +```xml + + + +``` + +- Disable Central Package Management transitive pinning to allow the package version specified by the dependency package to be used. +```xml + + false + +``` diff --git a/docs/reference/errors-and-warnings/NU1110.md b/docs/reference/errors-and-warnings/NU1110.md index 2c6fe2488..1a7c6aa58 100644 --- a/docs/reference/errors-and-warnings/NU1110.md +++ b/docs/reference/errors-and-warnings/NU1110.md @@ -11,8 +11,7 @@ f1_keywords: # NuGet Error NU1110 -
    NU1110: The package `B` is available in the Global packages folder, but the source it came from `https://api.nuget.org/v3/index.json` is not one of the configured sources.
-
    +> NU1110: The package `B` is available in the Global packages folder, but the source it came from `https://api.nuget.org/v3/index.json` is not one of the configured sources. ### Issue diff --git a/docs/reference/errors-and-warnings/NU1201.md b/docs/reference/errors-and-warnings/NU1201.md index 6fd890c0b..0a2ad3ddd 100644 --- a/docs/reference/errors-and-warnings/NU1201.md +++ b/docs/reference/errors-and-warnings/NU1201.md @@ -13,7 +13,7 @@ f1_keywords: # NuGet Error NU1201 ### Example 1 -
    Project 'ProjectA' is not compatible with 'TargetFramework'. Project 'ProjectA' supports:
      - 'TargetFrameworkA'
      - 'TargetFrameworkB'
    +> Project 'ProjectA' is not compatible with 'TargetFramework'. Project 'ProjectA' supports:
    - 'TargetFrameworkA'
    - 'TargetFrameworkB' ### Issue A dependency project doesn't contain a framework compatible with the current project. Typically, the project's target framework is a higher version than the consuming project. @@ -22,7 +22,7 @@ A dependency project doesn't contain a framework compatible with the current pro Change the project's target framework to an equal or lower version than the consuming project. ### Example 2 - NetStandard targetted projects cannot reference NetCoreApp targetted projects -
    Project 'ProjectB' is not compatible with netstandard2.0 (.NETStandard,Version=v2.0). Project 'ProjectB' supports: netcoreapp2.0 (.NETCoreApp,Version=v2.0)
    +> Project 'ProjectB' is not compatible with netstandard2.0 (.NETStandard,Version=v2.0). Project 'ProjectB' supports: netcoreapp2.0 (.NETCoreApp,Version=v2.0) ### Issue In this case: diff --git a/docs/reference/errors-and-warnings/NU1202.md b/docs/reference/errors-and-warnings/NU1202.md index 32c369fa7..86e50f8fb 100644 --- a/docs/reference/errors-and-warnings/NU1202.md +++ b/docs/reference/errors-and-warnings/NU1202.md @@ -12,7 +12,7 @@ f1_keywords: # NuGet Error NU1202 -
    Package 'PackageId' 4.0.11 is not compatible with 'TargetFramework'. Package 'PackageId' 4.0.11 supports:
      - 'TargetFrameworkA'
      - 'TargetFrameworkB'
      - 'TargetFrameworkC'
    +> Package 'PackageId' 4.0.11 is not compatible with 'TargetFramework'. Package 'PackageId' 4.0.11 supports:
    - 'TargetFrameworkA'
    - 'TargetFrameworkB'
    - 'TargetFrameworkC' ### Issue A dependency package doesn't contain any assets compatible with the project. diff --git a/docs/reference/errors-and-warnings/NU1203.md b/docs/reference/errors-and-warnings/NU1203.md index cf387a274..3d0e33e26 100644 --- a/docs/reference/errors-and-warnings/NU1203.md +++ b/docs/reference/errors-and-warnings/NU1203.md @@ -12,7 +12,7 @@ f1_keywords: # NuGet Error NU1203 -
    'PackageId' 1.0.0 provides a compile-time reference assembly for 'Foo.dll' on 'TargetFramework', but there is no compatible run-time assembly.
    +> 'PackageId' 1.0.0 provides a compile-time reference assembly for 'Foo.dll' on 'TargetFramework', but there is no compatible run-time assembly. ### Issue The package doesn't support the project's `RuntimeIdentifier`. diff --git a/docs/reference/errors-and-warnings/NU1204.md b/docs/reference/errors-and-warnings/NU1204.md index bcfc268dd..ef386ec01 100644 --- a/docs/reference/errors-and-warnings/NU1204.md +++ b/docs/reference/errors-and-warnings/NU1204.md @@ -10,7 +10,7 @@ f1_keywords: # NuGet Warning NU1204 -
    Invalid tools package Contoso.Tool 1.0.0. Tools packages cannot contain more than one PackageType.
    +> Invalid tools package Contoso.Tool 1.0.0. Tools packages cannot contain more than one PackageType. ### Issue diff --git a/docs/reference/errors-and-warnings/NU1211.md b/docs/reference/errors-and-warnings/NU1211.md index 186124a36..c0cf3e3ea 100644 --- a/docs/reference/errors-and-warnings/NU1211.md +++ b/docs/reference/errors-and-warnings/NU1211.md @@ -10,7 +10,7 @@ f1_keywords: # NuGet Warning NU1211 -
    Project `DotnelToolReferenceProject.csproj` must have a single package reference(s).
    +> Project `DotnelToolReferenceProject.csproj` must have a single package reference(s). ### Issue diff --git a/docs/reference/errors-and-warnings/NU1212.md b/docs/reference/errors-and-warnings/NU1212.md index d383effdf..5a2d7b395 100644 --- a/docs/reference/errors-and-warnings/NU1212.md +++ b/docs/reference/errors-and-warnings/NU1212.md @@ -12,7 +12,7 @@ f1_keywords: ## Scenario 1 -
    Invalid project-package combination for Contoso.Library 1.0.0. DotnetToolReference project style can only contain references of the DotnetTool type
    +> Invalid project-package combination for Contoso.Library 1.0.0. DotnetToolReference project style can only contain references of the DotnetTool type ### Issue @@ -26,7 +26,7 @@ Use a different package that's of the `DotnetTool` type. ## Scenario 2 -
    Invalid project-package combination for Contoso.Library 1.0.0. DotnetToolReference project style can only contain references of the DotnetTool type
    +> Invalid project-package combination for Contoso.Library 1.0.0. DotnetToolReference project style can only contain references of the DotnetTool type ### Issue diff --git a/docs/reference/errors-and-warnings/NU1213.md b/docs/reference/errors-and-warnings/NU1213.md index 51881485a..2b2eb288c 100644 --- a/docs/reference/errors-and-warnings/NU1213.md +++ b/docs/reference/errors-and-warnings/NU1213.md @@ -10,7 +10,7 @@ f1_keywords: # NuGet Warning NU1213 -
    The package Contoso.Platform 1.0.0 has a package type DotnetPlatform that is incompatible with this project.
    +> The package Contoso.Platform 1.0.0 has a package type DotnetPlatform that is incompatible with this project. ### Issue diff --git a/docs/reference/errors-and-warnings/NU1301.md b/docs/reference/errors-and-warnings/NU1301.md index 910c0c794..60aa3e8c5 100644 --- a/docs/reference/errors-and-warnings/NU1301.md +++ b/docs/reference/errors-and-warnings/NU1301.md @@ -10,7 +10,7 @@ f1_keywords: # NuGet Error NU1301 -
    The local source 'C:\Code\Contoso\contosoLocalSource' doesn't exist.
    +> The local source 'C:\Code\Contoso\contosoLocalSource' doesn't exist. ### Issue diff --git a/docs/reference/errors-and-warnings/NU1302.md b/docs/reference/errors-and-warnings/NU1302.md new file mode 100644 index 000000000..2dd3803d8 --- /dev/null +++ b/docs/reference/errors-and-warnings/NU1302.md @@ -0,0 +1,88 @@ +--- +title: NuGet Error NU1302 +description: NU2302 Error code +author: Nigusu-Allehu +ms.date: 07/25/2024 +ms.topic: reference +f1_keywords: + - "NU1302" +--- + +# NuGet Error NU1302 + +## Scenario 1 + +> You are running the 'restore' operation with an 'HTTP' source: myHttpSource. NuGet requires HTTPS sources. To use an HTTP source, you must explicitly set 'allowInsecureConnections' to true in your NuGet.Config file. Please refer to https://aka.ms/nuget-https-everywhere for more information. + +### Issue + +`myHttpSource` is an insecure HTTP source. We recommend using an HTTPS source instead. + +### Solution + +#### Option 1: Update the Source to Use HTTPS + +If possible, update the package source to use `https://` instead of `http://`: + +```xml + + + + + +``` + +#### Option 2: Allow Insecure Connections (If Necessary) + +If the source must remain HTTP, explicitly allow insecure connections by adding the `AllowInsecureConnections` flag in the `NuGet.Config`: + +```xml + + + + + +``` + +#### Option 3: Consult SDK Analysis Level + +The [`SdkAnalysisLevel`](/dotnet/core/project-sdk/msbuild-props#sdkanalysislevel) property in your project can serve as a temporary workaround for managing HTTP sources. +If additional time is needed to resolve the HTTP error, you can lower the `SdkAnalysisLevel` to suppress errors temporarily. +Here's how it functions: + +- For SDK Analysis Level value **below 9.0.100**, using HTTP sources triggers a warning ([NU1803](NU1803.md)). +- Starting with SDK Analysis Level **9.0.100 or higher**, HTTP sources result in an error (NU1302) unless `AllowInsecureConnections` is explicitly enabled. + +> [!WARNING] +> Changing SdkAnalysisLevel has other side-effects. Refer to the [`SdkAnalysisLevel`](/dotnet/core/project-sdk/msbuild-props#sdkanalysislevel) for a summary of the full scope of .NET SDK features affected. + +## Scenario 2 + +> You are using a NuGet source 'https://contoso/v3/index.json' that contains an 'HTTP' service index resource endpoint: 'http://contoso/v3-flatcontainer/contoso/index.json'. This is insecure and not recommended. To allow HTTP resources, you must explicitly set 'allowInsecureConnections' to true in your NuGet.Config file. For more information, visit https://aka.ms/nuget-https-everywhere. + +### Issue + +A configured package source uses **HTTPS**, but one of its resources (indicated in the error message) uses **HTTP**. + +NuGet requires that all sources and their resources use HTTPS. +If you want to continue using this source despite its HTTP resource, you must set the `allowInsecureConnections` flag to true in your NuGet.config file. + +To learn more about package sources and resource endpoints, take a look at the [NuGet Server API](../../api/overview). + +#### Option 1: Update the Source to Use HTTPS + +Whenever possible, switch to a package source that provides only HTTPS resources. This is the recommended and most secure option. + +#### Option 2: Allow Insecure Connections (If Necessary) + +If you must use the source, explicitly allow insecure connections by adding the `allowInsecureConnections` flag in the `NuGet.Config`: + +For information about managing the setting in Visual Studio, see [NuGet Options in Visual Studio](../../consume-packages/nuget-visual-studio-options.md#allow-insecure-connections) + +```xml + + + + + +``` diff --git a/docs/reference/errors-and-warnings/NU1401.md b/docs/reference/errors-and-warnings/NU1401.md index f365872ae..a902b408a 100644 --- a/docs/reference/errors-and-warnings/NU1401.md +++ b/docs/reference/errors-and-warnings/NU1401.md @@ -12,7 +12,7 @@ f1_keywords: # NuGet Error NU1401 -
    The 'PackageId' package requires NuGet client version '5.0.0' or above, but the current NuGet version is '4.3.0'.
    +> The 'PackageId' package requires NuGet client version '5.0.0' or above, but the current NuGet version is '4.3.0'. ### Issue The package requires features or frameworks not currently supported by the installed version of NuGet. diff --git a/docs/reference/errors-and-warnings/NU1402.md b/docs/reference/errors-and-warnings/NU1402.md index de7afdcaf..b503b03b6 100644 --- a/docs/reference/errors-and-warnings/NU1402.md +++ b/docs/reference/errors-and-warnings/NU1402.md @@ -11,7 +11,7 @@ f1_keywords: # NuGet Error NU1402 -
    NU1402: The package 'PackageId.1.0.0' contains an entry '../../foo.dll' which is unsafe for extraction.
    +> NU1402: The package 'PackageId.1.0.0' contains an entry '../../foo.dll' which is unsafe for extraction. ### Issue diff --git a/docs/reference/errors-and-warnings/NU1403.md b/docs/reference/errors-and-warnings/NU1403.md index f15bc56c9..44c5e8e50 100644 --- a/docs/reference/errors-and-warnings/NU1403.md +++ b/docs/reference/errors-and-warnings/NU1403.md @@ -11,7 +11,7 @@ f1_keywords: # NuGet Error NU1403 -
     Package content hash validation failed for PackageId.13.0.1. The package is different than the last restore.
    +> Package content hash validation failed for PackageId.13.0.1. The package is different than the last restore. ### Issue The content of the package in the global packages folder is different from the value in the lock file. diff --git a/docs/reference/errors-and-warnings/NU1501.md b/docs/reference/errors-and-warnings/NU1501.md index e315acc9d..8c87d199e 100644 --- a/docs/reference/errors-and-warnings/NU1501.md +++ b/docs/reference/errors-and-warnings/NU1501.md @@ -12,7 +12,7 @@ f1_keywords: # NuGet Warning NU1501 -
    The folder 'FolderPath' does not contain a project to restore.
    +> The folder 'FolderPath' does not contain a project to restore. ### Issue diff --git a/docs/reference/errors-and-warnings/NU1502.md b/docs/reference/errors-and-warnings/NU1502.md index ef225d101..a03595763 100644 --- a/docs/reference/errors-and-warnings/NU1502.md +++ b/docs/reference/errors-and-warnings/NU1502.md @@ -12,7 +12,7 @@ f1_keywords: # NuGet Warning NU1502 -
    Unknown Compatibility Profile: 'aaa'
    +> Unknown Compatibility Profile: 'aaa' ### Issue `RuntimeSupports` contains an invalid profile. Typically, the supports profile was not found in a `runtime.json` file from the current dependency packages. diff --git a/docs/reference/errors-and-warnings/NU1503.md b/docs/reference/errors-and-warnings/NU1503.md index 3e472cd1e..55a969055 100644 --- a/docs/reference/errors-and-warnings/NU1503.md +++ b/docs/reference/errors-and-warnings/NU1503.md @@ -12,7 +12,7 @@ f1_keywords: # NuGet Warning NU1503 -
    Skipping restore for project 'c:\a.csproj'. The project file may be invalid or missing targets required for restore.
    +> Skipping restore for project 'c:\a.csproj'. The project file may be invalid or missing targets required for restore. ### Issue A dependency project doesn't import NuGet's restore targets. This is similar to NU1105 but here the project is skipped and ignored instead of causing all of restore to fail. In complex solutions there are often other types of projects that may not support restore. diff --git a/docs/reference/errors-and-warnings/NU1504.md b/docs/reference/errors-and-warnings/NU1504.md index 368a1e6f6..0b1cb88ae 100644 --- a/docs/reference/errors-and-warnings/NU1504.md +++ b/docs/reference/errors-and-warnings/NU1504.md @@ -13,7 +13,7 @@ f1_keywords: ## Scenario 1 -
    Duplicate 'PackageReference' items found. Remove the duplicate items or use the Update functionality to ensure a consistent restore behavior. The duplicate 'PackageReference' items are: X 1.0.0, X 2.0.0.
    +> Duplicate 'PackageReference' items found. Remove the duplicate items or use the Update functionality to ensure a consistent restore behavior. The duplicate 'PackageReference' items are: X 1.0.0, X 2.0.0. ### Issue diff --git a/docs/reference/errors-and-warnings/NU1505.md b/docs/reference/errors-and-warnings/NU1505.md index 3fe1efb99..d767e2de0 100644 --- a/docs/reference/errors-and-warnings/NU1505.md +++ b/docs/reference/errors-and-warnings/NU1505.md @@ -13,7 +13,7 @@ f1_keywords: ## Scenario 1 -
    Duplicate 'PackageDownload' items found. Remove the duplicate items or use the Update functionality to ensure a consistent restore behavior. The duplicate 'PackageDownload' items are: X [1.0.0], X [2.0.0].
    +> Duplicate 'PackageDownload' items found. Remove the duplicate items or use the Update functionality to ensure a consistent restore behavior. The duplicate 'PackageDownload' items are: X [1.0.0], X [2.0.0]. ### Issue diff --git a/docs/reference/errors-and-warnings/NU1506.md b/docs/reference/errors-and-warnings/NU1506.md index 25588baab..e6fdc0f46 100644 --- a/docs/reference/errors-and-warnings/NU1506.md +++ b/docs/reference/errors-and-warnings/NU1506.md @@ -13,7 +13,7 @@ f1_keywords: ## Scenario 1 -
    Duplicate 'PackageVersion' items found. Remove the duplicate items or use the Update functionality to ensure a consistent restore behavior. The duplicate 'PackageVersion' items are: X [1.0.0], X [2.0.0].
    +> Duplicate 'PackageVersion' items found. Remove the duplicate items or use the Update functionality to ensure a consistent restore behavior. The duplicate 'PackageVersion' items are: X [1.0.0], X [2.0.0]. ### Issue diff --git a/docs/reference/errors-and-warnings/NU1507.md b/docs/reference/errors-and-warnings/NU1507.md index ca093e17b..ba2ff2de0 100644 --- a/docs/reference/errors-and-warnings/NU1507.md +++ b/docs/reference/errors-and-warnings/NU1507.md @@ -11,22 +11,21 @@ f1_keywords: # NuGet Warning NU1507 -## Scenario 1 +> There are 2 package sources defined in your configuration. When using central package management, please map your package sources with package source mapping or specify a single package source. The following sources are defined: https://api.nuget.org/v3/index.json, https://contoso.myget.org/F/development/. -
    There are 2 package sources defined in your configuration. When using central package management, please map your package sources with package source mapping (https://aka.ms/nuget-package-source-mapping) or specify a single package source. The following sources are defined: https://api.nuget.org/v3/index.json,  https://contoso.myget.org/F/development/.
    +## Issue -### Issue +A project is configured to use NuGet [Central Package Management](../../consume-packages/Central-Package-Management.md) and is not configured to use [Package Source Mapping](../../consume-packages/Package-Source-Mapping.md). +It is highly recommended to enable [Package Source Mapping](../../consume-packages/Package-Source-Mapping.md) because it safeguards your software supply chain when your project is consuming packages from multiple package sources by allowing you specify the source for each package. -When using NuGet's central package management (CPM), it is highly recommended that you also use Package Source Mapping. This can help safeguard your software supply chain is crucial if you use a mix of public and private package sources. Visit https://aka.ms/nuget-package-source-mapping to learn more about how package source mapping works. +## Solution -### Solution - -Onboard to Package Source Mapping if you have more than one NuGet feed configured when using central package management. You can visit https://aka.ms/nuget-package-source-mapping for more details. - -If you are unable to onboard to Package Source Mapping but want to use central package management, can suppress the warning: +- Onboard to [Package Source Mapping](../../consume-packages/Package-Source-Mapping.md) if you have more than one HTTP-based NuGet package source configured when using Central Package Management. +- If you are unable to onboard to [Package Source Mapping](../../consume-packages/Package-Source-Mapping.md) but want to use Central Package Management, you can suppress the warning: ```xml + $(NoWarn);NU1507 ``` diff --git a/docs/reference/errors-and-warnings/NU1508.md b/docs/reference/errors-and-warnings/NU1508.md new file mode 100644 index 000000000..eb9f758aa --- /dev/null +++ b/docs/reference/errors-and-warnings/NU1508.md @@ -0,0 +1,26 @@ +--- +title: NuGet Warning NU1508 +description: NU1508 warning code +author: zivkan +ms.author: zivkan +ms.date: 08/10/2024 +ms.topic: reference +f1_keywords: + - "NU1508" +--- + +# NuGet Warning NU1508 + +## Scenario 1 + +> Duplicate 'NuGetAuditSuppress' items found. Remove the duplicate items or use the Update functionality to ensure a consistent restore behavior. The duplicate 'NuGetAuditSuppress' items are: https://contoso.test/cve/1 , https://contoso.test/cve/1 . + +### Issue + +Sometimes when adding `NuGetAuditSuppress` items, you may end up adding an item for a particular package multiple times. + +MSBuild projects commonly import multiple `.props` and `.targets` files, so the duplicates might not be in the same file, but may be in imported files, such as `Directory.Build.props`, `Directory.Packages.props`, or `Directory.Build.targets`. + +### Solution + +Remove the duplicate item, so that it's included exactly once. diff --git a/docs/reference/errors-and-warnings/NU1509.md b/docs/reference/errors-and-warnings/NU1509.md new file mode 100644 index 000000000..cae01fdd4 --- /dev/null +++ b/docs/reference/errors-and-warnings/NU1509.md @@ -0,0 +1,28 @@ +--- +title: NuGet Warning NU1509 +description: NU1509 warning code +author: nkolev92 +ms.author: nikolev +ms.date: 02/04/2025 +ms.topic: reference +f1_keywords: + - "NU1509" +--- + +# NuGet Warning NU1509 + +## Scenario 1 + +> Duplicate 'PrunePackageReference' items found. Remove the duplicate items or use the Update functionality to ensure a consistent restore behavior. The duplicate 'PrunePackageReference' items are: X 1.0.0, X 2.0.0. + +### Issue + +Sometimes when adding `PrunePackageReference` items, you may end up adding an item for a particular package multiple times. + +MSBuild projects commonly import multiple `.props` and `.targets` files, so the duplicates might not be in the same file, but may be in imported files, such as `Directory.Build.props`, `Directory.Packages.props`, or `Directory.Build.targets`. + +The `.NET SDK` provides a of list `PrunePackageReference`, so the conflict may be happening because you have specified a `PrunePackageReference` or due to a bug with the `.NET SDK`. + +### Solution + +Remove the duplicate item, so that it's included exactly once. diff --git a/docs/reference/errors-and-warnings/NU1510.md b/docs/reference/errors-and-warnings/NU1510.md new file mode 100644 index 000000000..2b4dbf758 --- /dev/null +++ b/docs/reference/errors-and-warnings/NU1510.md @@ -0,0 +1,84 @@ +--- +title: NuGet Warning NU1510 +description: NU1510 warning code +author: nkolev92 +ms.author: nikolev +ms.date: 02/04/2025 +ms.topic: reference +f1_keywords: + - "NU1510" +--- + +# NuGet Warning NU1510 + +## Scenario + +> PackageReference System.Text.Json will not be pruned. Consider removing this package from your dependencies, as it is likely unnecessary. + +### Issue + +The package `System.Text.Json` has been specified for pruning through the [PrunePackageReference](../../consume-packages/Package-References-in-Project-Files.md#prunepackagereference) feature. +The `.NET SDK` generally specifies the list of packages to be pruned. The package is not needed as a direct PackageReference since the .NET runtime itself carries either the same or higher version of the assembly. + +This warning is *only* raised when the PackageReference in question *can be completely removed from the project*. + +#### Example 1 + +```xml + + net10.0 + + + + + +``` + +#### Example 2 + +```xml + + net9.0;net10.0 + + + + + + +``` + +Each conditional `PackageReference` for the `System.Text.Json` package can be removed because the package is already included in the respective .NET runtime versions for the frameworks it is declared for. + +#### Example 3 + +```xml + + net9.0;net10.0 + + + + + +``` + +The `System.Text.Json` package is within the pruning range of the only framework it's declared for. + +### Solution + +Remove the PackageReference as it's unnecessary. + +> [!NOTE] +> In order to allow for easier adoption of the PrunePackageReference feature, this warning is raised by default when a project targets the .NET 10 framework or newer. + +> [!NOTE] +> The warning will not be raised in scenarios in which at least one of the frameworks still needs the package, such as `net48` in the below example. +> +> ```xml +> +> net10.0;net48 +> +> +> +> +> +> ``` diff --git a/docs/reference/errors-and-warnings/NU1511.md b/docs/reference/errors-and-warnings/NU1511.md new file mode 100644 index 000000000..310a69a07 --- /dev/null +++ b/docs/reference/errors-and-warnings/NU1511.md @@ -0,0 +1,30 @@ +--- +title: NuGet Warning NU1511 +description: NU1511 warning code +author: nkolev92 +ms.author: nikolev +ms.date: 02/04/2025 +ms.topic: reference +f1_keywords: + - "NU1511" +--- + +# NuGet Warning NU1511 + +## Scenario 1 + +> A ProjectReference cannot be pruned, X. + +### Issue + +The project id `X` has been specified for pruning through the [PrunePackageReference](../../consume-packages/Package-References-in-Project-Files.md#prunepackagereference) feature. +Pruning of projects is not supported. + +### Solution + +- The `.NET SDK` generally specifies the list of packages to be pruned. It may mean that you have a project matching the id of a platform assembly. +In this scenario, change the name of the project. +- If the `PrunePackageReference` has been specified within your project, you may need to remove the `PrunePackageReference` + +> [!NOTE] +> In order to allow for easier adoption of the PrunePackageReference feature, this warning is raised by default when a project targets the .NET 10 framework or newer. diff --git a/docs/reference/errors-and-warnings/NU1601.md b/docs/reference/errors-and-warnings/NU1601.md index 174de7403..76d0d5704 100644 --- a/docs/reference/errors-and-warnings/NU1601.md +++ b/docs/reference/errors-and-warnings/NU1601.md @@ -12,7 +12,7 @@ f1_keywords: # NuGet Warning NU1601 -
    Dependency specified was 'PackageId' (>= 3.5.0) but ended up with 'PackageId' 4.0.0.
    +> Dependency specified was 'PackageId' (>= 3.5.0) but ended up with 'PackageId' 4.0.0. ### Issue A direct project dependency was bumped to a higher version than the project specified. diff --git a/docs/reference/errors-and-warnings/NU1602.md b/docs/reference/errors-and-warnings/NU1602.md index afcfaa095..e461722ef 100644 --- a/docs/reference/errors-and-warnings/NU1602.md +++ b/docs/reference/errors-and-warnings/NU1602.md @@ -12,7 +12,7 @@ f1_keywords: # NuGet Warning NU1602 -
    'PackageA' 4.0.0 does not provide an inclusive lower bound for dependency 'PackageB' (> 3.5.0). An approximate best match of 3.6.0 was resolved.
    +> 'PackageA' 4.0.0 does not provide an inclusive lower bound for dependency 'PackageB' (> 3.5.0). An approximate best match of 3.6.0 was resolved. ### Issue A package dependency is missing a lower bound. This doesn't allow restore to find the *best match*. Each restore will float downwards trying to find a lower version that can be used. This means that restore goes online to check all sources each time instead of using the packages that already exist in the user package folder. diff --git a/docs/reference/errors-and-warnings/NU1603.md b/docs/reference/errors-and-warnings/NU1603.md index 2b4e2ba4c..edb6d032f 100644 --- a/docs/reference/errors-and-warnings/NU1603.md +++ b/docs/reference/errors-and-warnings/NU1603.md @@ -12,7 +12,7 @@ f1_keywords: # NuGet Warning NU1603 -
    'PackageA' 4.0.0 depends on 'PackageB' (>= 4.0.0) but 4.0.0 was not found. An approximate best match of 5.0.0 was resolved.
    +> 'PackageA' 4.0.0 depends on 'PackageB' (>= 4.0.0) but 4.0.0 was not found. An approximate best match of 5.0.0 was resolved. ### Issue diff --git a/docs/reference/errors-and-warnings/NU1604.md b/docs/reference/errors-and-warnings/NU1604.md index 99eb4d2d1..2c132af48 100644 --- a/docs/reference/errors-and-warnings/NU1604.md +++ b/docs/reference/errors-and-warnings/NU1604.md @@ -12,10 +12,51 @@ f1_keywords: # NuGet Warning NU1604 -
    Project dependency 'PackageA' (<= 9.0.0) does not contain an inclusive lower bound. Include a lower bound in the dependency version to ensure consistent restore results.
    +## Missing Package Version + +> Project dependency 'PackageA' does not contain an inclusive lower bound. Include a lower bound in the dependency version to ensure consistent restore results. ### Issue -A project dependency doesn't define a lower bound.

    This means that restore did not find the *best match*. Each restore will float downwards trying to find a lower version that can be used. This means that restore goes online to check all sources each time instead of using the packages that already exist in the user package folder. + +A project dependency doesn't define a version. + +This means that restore used the lowest available version. +Each restore will float downwards trying to find a lower version that can be used. +This means that restore goes online to check all sources each time instead of using the packages that already exist in the user package folder. + +### Solution + +Find the `PackageReference` item that does not define the `Version` attribute and add it: + +For example change from: + +> `` + +to: + +> `` + +If the project is using [NuGet's Central Package Management (CPM)](../../consume-packages/Central-Package-Management.md), you need to update the `` item in `Directory.Packages.props` and change from: + +> `` + +to: +> `` + +If a version is specified in a `` item and you still receive this warning, verify you've correctly [onboarded to central package management](../../consume-packages/Central-Package-Management.md#enabling-central-package-management). + +> [!Note] +> When using CPM and the file `Directory.Packages.props` is invalid, NU1604 is raised. + +## Missing Inclusive Lower Bound + +> Project dependency 'PackageA' (<= 9.0.0) does not contain an inclusive lower bound. Include a lower bound in the dependency version to ensure consistent restore results. + +### Issue +A project dependency doesn't define a lower bound. + +This means that restore did not find the *best match*. Each restore will float downwards trying to find a lower version that can be used. +This means that restore goes online to check all sources each time instead of using the packages that already exist in the user package folder. ### Solution Update the project's `PackageReference` `Version` attribute to include a lower bound. @@ -32,3 +73,10 @@ or > `` which implies a lower bound. + +If the project is using [NuGet's Central Package Management (CPM)](../../consume-packages/Central-Package-Management.md), you need to update the `` item in `Directory.Packages.props` and change from: + +> `` + +to: +> `` diff --git a/docs/reference/errors-and-warnings/NU1605.md b/docs/reference/errors-and-warnings/NU1605.md index 60a45861b..d8197d284 100644 --- a/docs/reference/errors-and-warnings/NU1605.md +++ b/docs/reference/errors-and-warnings/NU1605.md @@ -14,9 +14,9 @@ f1_keywords: ## Example 1 -
    Detected package downgrade: 'PackageB' from 4.0.0 to 3.5.0. Reference the package directly from the project to select a different version.
      
-'Project' -> 'PackageA' 4.0.0 -> 'PackageB' (>= 4.0.0)
      
-'Project' -> 'PackageB' (>= 3.5.0)
    +> Detected package downgrade: 'PackageB' from 4.0.0 to 3.5.0. Reference the package directly from the project to select a different version.
    +>     'Project' -> 'PackageA' 4.0.0 -> 'PackageB' (>= 4.0.0)
    +>     'Project' -> 'PackageB' (>= 3.5.0) ### Issue @@ -28,16 +28,14 @@ To the project exhibiting the restore warning, add a package reference to the hi In the example above, you would change the package reference to `PackageB` 4.0.0: -
    -  'PackageA' 4.0.0 -> 'PackageB' 4.0.0
    
-  'PackageB' 4.0.0
-
    +> 'PackageA' 4.0.0 -> 'PackageB' 4.0.0
    +> 'PackageB' 4.0.0 ## Example 2 -
    Detected package downgrade: 'PackageC' from 2.0.0 to 1.1.0. Reference the package directly from the project to select a different version.
      
-'Project' -> 'PackageA' 1.0.0 -> 'PackageB' 2.0.0 ->'PackageC' (>= 2.0.0)
      
-'Project' -> 'PackageA' 1.0.0 -> 'PackageC' (>= 1.1.0)
    +> Detected package downgrade: 'PackageC' from 2.0.0 to 1.1.0. Reference the package directly from the project to select a different version.
    +>     'Project' -> 'PackageA' 1.0.0 -> 'PackageB' 2.0.0 ->'PackageC' (>= 2.0.0)
    +>     'Project' -> 'PackageA' 1.0.0 -> 'PackageC' (>= 1.1.0) ### Issue @@ -50,18 +48,14 @@ To the project exhibiting the restore warning, add a package reference to the hi In the example above, you would change the package reference to `PackageC` 2.0.0: -
    -  'PackageA' 4.0.0 -> 'PackageB' 4.0.0
    
-  'PackageB' 4.0.0
-
    +> 'PackageA' 4.0.0 -> 'PackageB' 4.0.0
    +> 'PackageB' 4.0.0 ## Example 3 -
    -Detected package downgrade: System.IO.FileSystem.Primitives from 4.3.0 to 4.0.1. Reference the package directly from the project to select a different version.
    
- Project -> System.IO.FileSystem 4.0.1 -> runtime.win.System.IO.FileSystem 4.3.0 -> System.IO.FileSystem.Primitives (>= 4.3.0)
    
- Project -> System.IO.FileSystem 4.0.1 -> System.IO.FileSystem.Primitives (>= 4.0.1)
    
-
    +> Detected package downgrade: System.IO.FileSystem.Primitives from 4.3.0 to 4.0.1. Reference the package directly from the project to select a different version.
    +>     Project -> System.IO.FileSystem 4.0.1 -> runtime.win.System.IO.FileSystem 4.3.0 -> System.IO.FileSystem.Primitives (>= 4.3.0)
    +>     Project -> System.IO.FileSystem 4.0.1 -> System.IO.FileSystem.Primitives (>= 4.0.1)
    ### Issue @@ -79,10 +73,9 @@ You may choose to use the `version` matching the the major version of your SDK. ## Example 4 -
    Detected package downgrade: Microsoft.NETCore.App from 2.1.8 to 2.1.0. Reference the package directly from the project to select a different version.
    
-  test -> mvc -> Microsoft.NETCore.App (>= 2.1.8)
    
-  test -> Microsoft.NETCore.App (>= 2.1.0)
    
-
    +> Detected package downgrade: Microsoft.NETCore.App from 2.1.8 to 2.1.0. Reference the package directly from the project to select a different version.
    +>     test -> mvc -> Microsoft.NETCore.App (>= 2.1.8)
    +>     test -> Microsoft.NETCore.App (>= 2.1.0) ### Issue diff --git a/docs/reference/errors-and-warnings/NU1608.md b/docs/reference/errors-and-warnings/NU1608.md index 888d06a00..4a5590843 100644 --- a/docs/reference/errors-and-warnings/NU1608.md +++ b/docs/reference/errors-and-warnings/NU1608.md @@ -12,7 +12,7 @@ f1_keywords: # NuGet Warning NU1608 -
    Detected package version outside of dependency constraint: 'PackageA' 1.0.0 requires 'PackageB' (= 1.0.0) but version 'PackageB' 2.0.0 was resolved.
    +> Detected package version outside of dependency constraint: 'PackageA' 1.0.0 requires 'PackageB' (= 1.0.0) but version 'PackageB' 2.0.0 was resolved. ### Issue A resolved package is higher than a dependency constraint allows. This means that a package referenced directly by a project overrides dependency constraints from other packages. diff --git a/docs/reference/errors-and-warnings/NU1701.md b/docs/reference/errors-and-warnings/NU1701.md index a96240d32..0fd319446 100644 --- a/docs/reference/errors-and-warnings/NU1701.md +++ b/docs/reference/errors-and-warnings/NU1701.md @@ -12,12 +12,12 @@ f1_keywords: # NuGet Warning NU1701 -
    Package 'packageId' was restored using 'TargetFrameworkA' instead the project target framework 'TargetFrameworkB'. This package may not be fully compatible with your project.
    +> Package 'packageId' was restored using 'TargetFrameworkA' instead the project target framework 'TargetFrameworkB'. This package may not be fully compatible with your project. ### Issue -`PackageTargetFallback` / `AssetTargetFallback` was used to select assets from a package. The warning let users know that the assets may not be 100% compatible. +`AssetTargetFallback` was used to select assets from a package. The warning let users know that the assets may not be 100% compatible. ### Solution Change the project's target framework to one that the package supports. -[!INCLUDE [nugetsolver-tool](../../includes/nugetsolver-tool.md)] \ No newline at end of file +[!INCLUDE [nugetsolver-tool](../../includes/nugetsolver-tool.md)] diff --git a/docs/reference/errors-and-warnings/NU1702.md b/docs/reference/errors-and-warnings/NU1702.md new file mode 100644 index 000000000..584570102 --- /dev/null +++ b/docs/reference/errors-and-warnings/NU1702.md @@ -0,0 +1,23 @@ +--- +title: NuGet Warning NU1702 +description: NU1702 warning code +author: nkolev92 +ms.date: 07/25/2024 +ms.topic: reference +f1_keywords: + - "NU1702" +--- + +# NuGet Warning NU1702 + +> ProjectReference 'C:\Code\Project2.csproj' was resolved using '.NETFramework,Version=v4.7.2' instead of the project target framework '.NETCoreApp,Version=v5.0'. +> This project may not be fully compatible with your project. + +### Issue + +`AssetTargetFallback` was used to select assets from a package. The warning lets users know that the assets may not be 100% compatible. + +### Solution + +Change the target framework of the projects to make them fully compatible. +Example: Change the target framework of Project2 to `.NET 5`, or change Project2 to target both `.NET 5` and `.NET Framework 4.7.2`. diff --git a/docs/reference/errors-and-warnings/NU1703.md b/docs/reference/errors-and-warnings/NU1703.md index 911170c4d..b1f40d7f0 100644 --- a/docs/reference/errors-and-warnings/NU1703.md +++ b/docs/reference/errors-and-warnings/NU1703.md @@ -12,7 +12,7 @@ f1_keywords: # NuGet Warning NU1703 -
    'packageId' was resolved as a dependency of 'project', but the dependency is using 'Xamarin.iOS' while 'project' is using 'net6.0-maccatalyst14.5' as its TargetFramework
    +> 'packageId' was resolved as a dependency of 'project', but the dependency is using 'Xamarin.iOS' while 'project' is using 'net6.0-maccatalyst14.5' as its TargetFramework ### Issue diff --git a/docs/reference/errors-and-warnings/NU1802.md b/docs/reference/errors-and-warnings/NU1802.md index da9738ae8..7e194460e 100644 --- a/docs/reference/errors-and-warnings/NU1802.md +++ b/docs/reference/errors-and-warnings/NU1802.md @@ -17,6 +17,7 @@ Updating last access time on file "C:\packages\contoso.library\1.0.0\.nupkg.meta ### Solution -You have enabled an experimental feature that updates the last access of the .nupkg.metadata file in the NuGet global packages folder. +You have enabled a feature that updates the last access of the .nupkg.metadata file in the NuGet global packages folder. Failures are likely to be issues with permissions. -The details of the failure reason will be contained in the error message. Consult that information for the exact action. \ No newline at end of file +The details of the failure reason will be contained in the error message. +Consult that information for the exact action. diff --git a/docs/reference/errors-and-warnings/NU1901-NU1904.md b/docs/reference/errors-and-warnings/NU1901-NU1904.md index 9c9146864..4fb538434 100644 --- a/docs/reference/errors-and-warnings/NU1901-NU1904.md +++ b/docs/reference/errors-and-warnings/NU1901-NU1904.md @@ -3,7 +3,7 @@ title: NuGet Warnings NU1901, NU1902, NU1903, NU1904 description: NU1901, NU1902, NU1903, NU1904 Warning codes author: zivkan ms.author: zivkan -ms.date: 6/27/2023 +ms.date: 7/19/2024 ms.topic: reference f1_keywords: - NU1901 @@ -14,9 +14,7 @@ f1_keywords: # NuGet Warnings NU1901, NU1902, NU1903, NU1904 -```text -warning NU1902: Package 'NuGet.Protocol' 5.11.2 has a known moderate severity vulnerability, https://github.com/advisories/GHSA-g3q9-xf95-8hp5 -``` +> warning NU1902: Package 'NuGet.Protocol' 5.11.2 has a known moderate severity vulnerability, https://github.com/advisories/GHSA-g3q9-xf95-8hp5 The warning code changes depending on the known vulnerability severity level: @@ -35,21 +33,25 @@ For more information, see [the documentation on auditing packages](../../concept ### Solution +We have [documentation on upgrading vulnerable packages](../../concepts/Auditing-Packages.md#actions-when-packages-with-known-vulnerabilities-are-reported) that goes in more detail about our recommended actions when your project uses a package with a known vulnerability, and tools that can help. + Upgrading to a newer version of the package is likely to resolve the warning. +If your project does not reference the package directly (it's a transitive package), [`dotnet nuget why`](/dotnet/core/tools/dotnet-nuget-why) can be used to understand which package caused it to be included in your project. You can check the URL provided by the vulnerability advisory to see what versions of the package have been fixed, or check your configured package source(s) to see what versions of the package are available. Visual Studio's package manager UI can show which package versions are affected and which do not have known vulnerabilities. +If these warnings are causing restore to fail because you are using `TreatWarningsAsErrors`, you can add `NU1901;NU1902;NU1903;NU1904` to allow these codes to remain as warnings. + If you do not wish to be notified of vulnerabilities that are less severe than a level you are comfortable with, you can edit the project file and add an MSBuild property `NuGetAuditLevel`, with value set to `low`, `moderate`, `high`, or `critical`. For example, `high`. -If these warnings are causing restore to fail because you are using `TreatWarningsAsErrors`, you can add `NU1901;NU1902;NU1903;NU1904` to allow these codes to remain as warnings. +If you would like to suppress a specific advisory, add an MSBuild [NuGetAuditSuppress](../../concepts/Auditing-Packages.md#excluding-advisories) item. +For example ``. +`NuGetAuditSuppress` is available from [VS 17.11 and .NET 8.0.400 SDK](../../release-notes/NuGet-6.11.md) for projects using `PackageReference`, and from [VS 17.12](../../release-notes/NuGet-6.12.md) for projects using `packages.config`. If you do not want NuGet to check for packages with known vulnerabilities during restore, add `false` inside a `` in your project file, or a [`Directory.Build.props` file](/visualstudio/msbuild/customize-by-directory). +If you would like to run NuGet Audit on developer machines, but disable it on CI pipelines, you can take advantage of MSBuild importing environment variables, and create a NuGetAudit environment variable set to `false` in your pipeline definition. -> [!NOTE] -> The initial release of NuGetAudit [does not provide a way to suppress specific advisories (URLs)](https://github.com/NuGet/Home/issues/11926). -> It is a feature we intend on adding based on prioritization of other improvements. -> -> As a mitigation, you can add an appropriate `NoWarn` to your `PackageReference` declarations. -> For example, ``. -> However, be aware that this will prevent new vulnerabilities of the same severity from being reported to you. +For projects targeting the .NET 10 framework, the default setting for `NuGetAuditMode` is `all`. +This means that NuGet will report on transitive packages with known vulnerabilities for all frameworks in the project. +The value can be explicitly set to `direct` to revert back to .NET 9's default. diff --git a/docs/reference/errors-and-warnings/NU1905.md b/docs/reference/errors-and-warnings/NU1905.md index b158d549e..9cc76f41d 100644 --- a/docs/reference/errors-and-warnings/NU1905.md +++ b/docs/reference/errors-and-warnings/NU1905.md @@ -3,7 +3,7 @@ title: NuGet Warning NU1905 description: NU1905 Warning codes author: zivkan ms.author: zivkan -ms.date: 6/27/2023 +ms.date: 07/19/2024 ms.topic: reference f1_keywords: - NU1905 @@ -12,24 +12,20 @@ f1_keywords: # NuGet Warning NU1905 ```text -warning NU1905: NuGetAudit is enabled, but no package sources contain known vulnerability data. +warning NU1905: Audit source 'Contoso' did not provide any vulnerability data. ``` ### Issue -`NuGetAudit` is explicitly enabled, but none of the configured package sources provide vulnerability information for NuGet to check against. +A source specified in a [NuGet.Config `` element](../nuget-config-file.md#auditsources) did not provide a vulnerability database. ### Solution -NuGet asks all configured package sources for vulnerability information. -Any package source implementing [NuGet's V3 server API can provide the data via the VulnerabilityInfo resource](../../api/vulnerability-info.md), including by mirroring nuget.org's vulnerability data. +Any NuGet source implementing [NuGet's V3 server API can provide vulnerability data via the `VulnerabilityInfo` resource](../../api/vulnerability-info.md), including by mirroring nuget.org's vulnerability data. +Any source defined in a NuGet.Config `` element is expected to provide this resource, and this warning is raised when it is not. You can check if your package source administrators have a setting to enable vulnerability data. If you would like to treat this warning as an error, to cause build failures when vulnerability checks could not be performed, you can add `$(WarningAsError);NU1905` to your project file. If you are using `TreatWarningsAsErrors` to cause all warnings to be treated as errors, you can add `$(NoWarn);NU1905` to your project file to suppress this warning message, or `NU1905` to prevent this warning from being treated as an error. -> [!NOTE] -> There is [a request to get vulnerability data without adding nuget.org as a package source](https://github.com/NuGet/Home/issues/12698). -> As a temporary mitigation, if your security policy allows it, you can use [Package Source Mapping](../../consume-packages/Package-Source-Mapping.md) to get all your packages from package sources other than nuget.org, so that adding nuget.org as a package source will only use it for vulnerability data. - For more information, see [the documentation on auditing packages](../../concepts/Auditing-Packages.md). diff --git a/docs/reference/errors-and-warnings/NU3000.md b/docs/reference/errors-and-warnings/NU3000.md index d71cd9e7e..d4419ce9d 100644 --- a/docs/reference/errors-and-warnings/NU3000.md +++ b/docs/reference/errors-and-warnings/NU3000.md @@ -17,7 +17,7 @@ f1_keywords: ## Scenario 1 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The primary signature does not have a timestamp.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The primary signature does not have a timestamp. ### Issue @@ -32,7 +32,7 @@ To enable long-term signature validity after the signature certificate has expir ## Scenario 2 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': Multiple timestamps are not accepted.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': Multiple timestamps are not accepted. ### Issue @@ -47,7 +47,7 @@ Please ensure that each package signature contains no more than 1 timestamp. ## Scenario 3 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The repository countersignature does not have a timestamp.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The repository countersignature does not have a timestamp. ### Issue diff --git a/docs/reference/errors-and-warnings/NU3001.md b/docs/reference/errors-and-warnings/NU3001.md index e90bf5b25..69f27b47c 100644 --- a/docs/reference/errors-and-warnings/NU3001.md +++ b/docs/reference/errors-and-warnings/NU3001.md @@ -14,37 +14,31 @@ f1_keywords: ## Scenario 1 -
    Invalid password was provided for the certificate file 'certificate.pfx'. Provide a valid password using the '-CertificatePassword' option.
    +> Invalid password was provided for the certificate file 'certificate.pfx'. Provide a valid password using the '-CertificatePassword' option. ### Issue A password protected certificate file was provided to the NuGet Sign operation. But an invalid or no password was provided. - ### Solution If you are using a password protected certificate file to sign a NuGet package, then please use the `-CertificatePassword` option to pass the correct password. - - ## Scenario 2 -
    Certificate file 'certificate.pfx' not found. For a list of accepted ways to provide a certificate, visit https://docs.nuget.org/docs/reference/command-line-reference.
    +> Certificate file 'certificate.pfx' not found. For a list of accepted ways to provide a certificate, visit https://docs.nuget.org/docs/reference/command-line-reference. ### Issue A certificate file was provided to the NuGet Sign operation. But the file does not exist on disk. - ### Solution Please ensure that any certificate file being used to sign a NuGet package exists on disk. - - ## Scenario 3 -
    Certificate file 'random_file.txt' is invalid. For a list of accepted ways to provide a certificate, visit https://docs.nuget.org/docs/reference/command-line-reference.
    +> Certificate file 'random_file.txt' is invalid. For a list of accepted ways to provide a certificate, visit https://docs.nuget.org/docs/reference/command-line-reference. ### Issue @@ -55,69 +49,56 @@ A certificate file was provided to the NuGet Sign operation, but the file is not Please ensure that any certificate file being used to sign a NuGet package is a valid certificate file. - - ## Scenario 4 -
    Multiple certificates were found that meet all the given criteria. Use the '-CertificateFingerprint' option with the hash of the desired certificate.
    +> Multiple certificates were found that meet all the given criteria. Use the '-CertificateFingerprint' option with the hash of the desired certificate. ### Issue A certificate was suggested to the NuGet Sign command using the `-CertificateSubjectName` option. But multiple certificates were found to match the certificate subject name in the Windows certificate store. - ### Solution Please pass the '-CertificateFingerprint' option with the hash of the desired certificate to the NuGet Sign command to uniquely identify a certificate. - - ## Scenario 5 -
    No certificates were found that meet all the given criteria. For a list of accepted ways to provide a certificate, visit https://docs.nuget.org/docs/reference/command-line-reference.
    +> No certificates were found that meet all the given criteria. For a list of accepted ways to provide a certificate, visit https://docs.nuget.org/docs/reference/command-line-reference. ### Issue A certificate was suggested to the NuGet Sign command using the `-CertificateSubjectName` option. But no certificate was found to match the certificate subject name in the Windows certificate store. - ### Solution Please ensure that you passing the right subject name filter, otherwise pass the '-CertificateFingerprint' option with the hash of the desired certificate to the NuGet Sign command to uniquely identify a certificate. - ## Scenario 6 -
    The following certificate cannot be used for package signing as the private key provider is unsupported:
-  Subject Name: CN=Certificate Subject Name
-  SHA1 hash: HASH
-  SHA256 hash: HASH
-  Issued by: Issuer Subject Name
-  Valid from: 4/9/2016 5:00:00 PM to 4/14/2020 5:00:00 AM
    +> The following certificate cannot be used for package signing as the private key provider is unsupported: + Subject Name: CN=Certificate Subject Name
    + SHA1 hash: HASH
    + SHA256 hash: HASH
    + Issued by: Issuer Subject Name
    + Valid from: 4/9/2016 5:00:00 PM to 4/14/2020 5:00:00 AM ### Issue A certificate was passed to the NuGet Sign command which has an unsupported pribvate key provider. - ### Solution Currently, due to framework limitations, NuGet sign command does not support CNG key private key provider. Please use a certificate with a CAPI private key provider. - - ## Scenario 7 -
    The package already contains a signature. Remove the existing signature before adding a new signature.
    +> The package already contains a signature. Remove the existing signature before adding a new signature. ### Issue NuGet Sign command was used to sign a package which already has a package signature. - ### Solution Please ensure that you are signing an unsigned package. If the package is already signed, then please use `-Overwrite` option to overwrite an existing signature. - - diff --git a/docs/reference/errors-and-warnings/NU3002.md b/docs/reference/errors-and-warnings/NU3002.md index abd57086b..3b379ecd0 100644 --- a/docs/reference/errors-and-warnings/NU3002.md +++ b/docs/reference/errors-and-warnings/NU3002.md @@ -12,7 +12,7 @@ f1_keywords: # NuGet Warning NU3002 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The '-Timestamper' option was not provided. The signed package will not be timestamped. To learn more about this option, please visit https://docs.nuget.org/docs/reference/command-line-reference.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The '-Timestamper' option was not provided. The signed package will not be timestamped. To learn more about this option, please visit https://docs.nuget.org/docs/reference/command-line-reference. ### Issue diff --git a/docs/reference/errors-and-warnings/NU3003.md b/docs/reference/errors-and-warnings/NU3003.md index 32d509f14..67505254f 100644 --- a/docs/reference/errors-and-warnings/NU3003.md +++ b/docs/reference/errors-and-warnings/NU3003.md @@ -14,7 +14,7 @@ f1_keywords: ## Scenario 1 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The package is not signed. Unable to verify signature from an unsigned package.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The package is not signed. Unable to verify signature from an unsigned package. ### Issue @@ -29,7 +29,7 @@ Please file an issue at [NuGet/Home](https://github.com/NuGet/Home/issues) along ## Scenario 2 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The package signature is invalid or cannot be verified on this platform.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The package signature is invalid or cannot be verified on this platform. ### Issue diff --git a/docs/reference/errors-and-warnings/NU3004.md b/docs/reference/errors-and-warnings/NU3004.md index 1e016fcf0..fdf2f1d1a 100644 --- a/docs/reference/errors-and-warnings/NU3004.md +++ b/docs/reference/errors-and-warnings/NU3004.md @@ -14,8 +14,8 @@ f1_keywords: ## Scenario 1 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The package is not signed.
    -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': signatureValidationMode is set to require, so packages are allowed only if signed by trusted signers; however, this package is unsigned.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The package is not signed.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': signatureValidationMode is set to require, so packages are allowed only if signed by trusted signers; however, this package is unsigned. ### Issue @@ -33,7 +33,7 @@ Please ensure that any package intended to be installed or passed to `nuget veri ## Scenario 2 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': This repository indicated that all its packages are repository signed; however, this package is unsigned.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': This repository indicated that all its packages are repository signed; however, this package is unsigned. ### Issue diff --git a/docs/reference/errors-and-warnings/NU3005.md b/docs/reference/errors-and-warnings/NU3005.md index 4fee4e186..a2c32aff2 100644 --- a/docs/reference/errors-and-warnings/NU3005.md +++ b/docs/reference/errors-and-warnings/NU3005.md @@ -14,7 +14,7 @@ f1_keywords: ## Scenario 1 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The package contains an invalid package signature file.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The package contains an invalid package signature file. ### Issue @@ -29,7 +29,7 @@ Please request the package author to re-sign the package using the `nuget sign` ## Scenario 2 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The package contains multiple package signature files.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The package contains multiple package signature files. ### Issue @@ -44,7 +44,7 @@ Please request the package author to re-sign the package using the `nuget sign` ## Scenario 3 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The package does not contain a valid package signature file.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The package does not contain a valid package signature file. ### Issue diff --git a/docs/reference/errors-and-warnings/NU3006.md b/docs/reference/errors-and-warnings/NU3006.md index 08533cb4b..bb8000c35 100644 --- a/docs/reference/errors-and-warnings/NU3006.md +++ b/docs/reference/errors-and-warnings/NU3006.md @@ -12,7 +12,7 @@ f1_keywords: # NuGet Warning NU3006 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': Signed Zip64 packages are not supported.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': Signed Zip64 packages are not supported. ### Issue diff --git a/docs/reference/errors-and-warnings/NU3007.md b/docs/reference/errors-and-warnings/NU3007.md index b6972611e..19077c226 100644 --- a/docs/reference/errors-and-warnings/NU3007.md +++ b/docs/reference/errors-and-warnings/NU3007.md @@ -12,7 +12,7 @@ f1_keywords: # NuGet Warning NU3007 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The package signature format version is not supported. Updating your client may solve this problem.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The package signature format version is not supported. Updating your client may solve this problem. ### Issue diff --git a/docs/reference/errors-and-warnings/NU3008.md b/docs/reference/errors-and-warnings/NU3008.md index 2f723239b..fa8461f8d 100644 --- a/docs/reference/errors-and-warnings/NU3008.md +++ b/docs/reference/errors-and-warnings/NU3008.md @@ -12,7 +12,7 @@ f1_keywords: # NuGet Error NU3008 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The package integrity check failed. The package has changed since it was signed. Try clearing the local http-cache and run nuget operation again.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The package integrity check failed. The package has changed since it was signed. Try clearing the local http-cache and run nuget operation again. ### Issue @@ -22,4 +22,4 @@ NuGet package being verified has changed since it was signed. Please ensure that the package has not been tampered with since signing. If this was a temporary problem, then you can fix this by clearing your local http-cache(s) by running `nuget locals http-cache -clear` or `dotnet nuget locals http-cache --clear` command. However, if the problem persists then please inform the package source and the package author. -If this issue happened on a package which came from `nuget.org` then please file an issue at [NuGet/Home](https://github.com/NuGet/Home/issues) along with the package that caused this problem. +If this issue happened on a package which came from `nuget.org` then please file an issue at [NuGet/NuGetGallery](https://github.com/NuGet/NuGetGallery/issues) along with the package that caused this problem. diff --git a/docs/reference/errors-and-warnings/NU3009.md b/docs/reference/errors-and-warnings/NU3009.md index e45e9ee5d..713c2ee4c 100644 --- a/docs/reference/errors-and-warnings/NU3009.md +++ b/docs/reference/errors-and-warnings/NU3009.md @@ -12,7 +12,7 @@ f1_keywords: # NuGet Warning NU3009 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The package signature file does not contain exactly one primary signature.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The package signature file does not contain exactly one primary signature. ### Issue diff --git a/docs/reference/errors-and-warnings/NU3010.md b/docs/reference/errors-and-warnings/NU3010.md index 9257129d9..e0616dd06 100644 --- a/docs/reference/errors-and-warnings/NU3010.md +++ b/docs/reference/errors-and-warnings/NU3010.md @@ -12,7 +12,7 @@ f1_keywords: # NuGet Warning NU3010 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The primary signature does not have a signing certificate.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The primary signature does not have a signing certificate. ### Issue diff --git a/docs/reference/errors-and-warnings/NU3011.md b/docs/reference/errors-and-warnings/NU3011.md index ce8f9802d..223a4794d 100644 --- a/docs/reference/errors-and-warnings/NU3011.md +++ b/docs/reference/errors-and-warnings/NU3011.md @@ -12,7 +12,7 @@ f1_keywords: # NuGet Warning NU3011 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The primary signature is invalid.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The primary signature is invalid. ### Issue diff --git a/docs/reference/errors-and-warnings/NU3012.md b/docs/reference/errors-and-warnings/NU3012.md index fe4853df2..9cecd28ac 100644 --- a/docs/reference/errors-and-warnings/NU3012.md +++ b/docs/reference/errors-and-warnings/NU3012.md @@ -14,7 +14,7 @@ f1_keywords: ## Scenario 1 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The primary signature validation failed.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The primary signature validation failed. ### Issue @@ -29,7 +29,7 @@ You can get more details about the problem by looking at the debug logs. If the ## Scenario 2 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The primary signature found a chain building issue:  A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The primary signature found a chain building issue: A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. ### Issue diff --git a/docs/reference/errors-and-warnings/NU3013.md b/docs/reference/errors-and-warnings/NU3013.md index e8180bd75..bd2d3a0a5 100644 --- a/docs/reference/errors-and-warnings/NU3013.md +++ b/docs/reference/errors-and-warnings/NU3013.md @@ -14,7 +14,7 @@ f1_keywords: ## Scenario 1 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The signing certificate has an unsupported signature algorithm.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The signing certificate has an unsupported signature algorithm. ### Issue @@ -32,7 +32,7 @@ Please ensure that the signing certificate has one of the following signature al ## Scenario 2 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The primary signature's certificate has an unsupported signature algorithm.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The primary signature's certificate has an unsupported signature algorithm. ### Issue diff --git a/docs/reference/errors-and-warnings/NU3014.md b/docs/reference/errors-and-warnings/NU3014.md index db7748cc5..e292ef72a 100644 --- a/docs/reference/errors-and-warnings/NU3014.md +++ b/docs/reference/errors-and-warnings/NU3014.md @@ -14,7 +14,7 @@ f1_keywords: ## Scenario 1 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The signing certificate does not meet a minimum public key length requirement.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The signing certificate does not meet a minimum public key length requirement. ### Issue @@ -29,7 +29,7 @@ Please ensure that the signing certificate has an RSA public key of length >= 20 ## Scenario 2 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The primary signature's certificate does not meet a minimum public key length requirement.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The primary signature's certificate does not meet a minimum public key length requirement. ### Issue diff --git a/docs/reference/errors-and-warnings/NU3015.md b/docs/reference/errors-and-warnings/NU3015.md index 8443439e8..5a04c73ef 100644 --- a/docs/reference/errors-and-warnings/NU3015.md +++ b/docs/reference/errors-and-warnings/NU3015.md @@ -14,7 +14,7 @@ f1_keywords: ## Scenario 1 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The lifetime signing EKU in the primary signature's certificate is not supported.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The lifetime signing EKU in the primary signature's certificate is not supported. ### Issue @@ -29,7 +29,7 @@ Please ensure that the signing certificate does not have lifetime signing Extend ## Scenario 2 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The lifetime signing EKU in the signing certificate is not supported.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The lifetime signing EKU in the signing certificate is not supported. ### Issue diff --git a/docs/reference/errors-and-warnings/NU3016.md b/docs/reference/errors-and-warnings/NU3016.md index eb43ec64e..ac4c9d36f 100644 --- a/docs/reference/errors-and-warnings/NU3016.md +++ b/docs/reference/errors-and-warnings/NU3016.md @@ -12,7 +12,7 @@ f1_keywords: # NuGet Warning NU3016 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The package hash uses an unsupported hash algorithm.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The package hash uses an unsupported hash algorithm. ### Issue diff --git a/docs/reference/errors-and-warnings/NU3017.md b/docs/reference/errors-and-warnings/NU3017.md index 8a7a038f4..c8d255031 100644 --- a/docs/reference/errors-and-warnings/NU3017.md +++ b/docs/reference/errors-and-warnings/NU3017.md @@ -14,7 +14,7 @@ f1_keywords: ## Scenario 1 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The signing certificate is not yet valid.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The signing certificate is not yet valid. ### Issue @@ -29,7 +29,7 @@ Please ensure that the signing certificate is currently valid. ## Scenario 2 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The primary signature's certificate is not yet valid.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The primary signature's certificate is not yet valid. ### Issue diff --git a/docs/reference/errors-and-warnings/NU3018.md b/docs/reference/errors-and-warnings/NU3018.md index 62f58ee6b..93baa310a 100644 --- a/docs/reference/errors-and-warnings/NU3018.md +++ b/docs/reference/errors-and-warnings/NU3018.md @@ -12,7 +12,7 @@ f1_keywords: # NuGet Warning NU3018 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The primary signature's signing certificate is not trusted by the trust provider.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The primary signature's signing certificate is not trusted by the trust provider. ### Issue diff --git a/docs/reference/errors-and-warnings/NU3019.md b/docs/reference/errors-and-warnings/NU3019.md index 65fbf57ed..689208f87 100644 --- a/docs/reference/errors-and-warnings/NU3019.md +++ b/docs/reference/errors-and-warnings/NU3019.md @@ -14,7 +14,7 @@ f1_keywords: ## Scenario 1 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The timestamp integrity check failed.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The timestamp integrity check failed. ### Issue @@ -29,7 +29,7 @@ Please try to re-sign and timestamp the package. If the problem persists, contac ## Scenario 2 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The primary signature's timestamp integrity check failed.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The primary signature's timestamp integrity check failed. ### Issue diff --git a/docs/reference/errors-and-warnings/NU3020.md b/docs/reference/errors-and-warnings/NU3020.md index a4755a354..cfca6be9a 100644 --- a/docs/reference/errors-and-warnings/NU3020.md +++ b/docs/reference/errors-and-warnings/NU3020.md @@ -14,7 +14,7 @@ f1_keywords: ## Scenario 1 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The timestamp does not have a signing certificate.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The timestamp does not have a signing certificate. ### Issue @@ -29,7 +29,7 @@ Please try to re-sign and timestamp the package. If the problem persists, contac ## Scenario 2 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The primary signature's timestamp does not have a signing certificate.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The primary signature's timestamp does not have a signing certificate. ### Issue diff --git a/docs/reference/errors-and-warnings/NU3021.md b/docs/reference/errors-and-warnings/NU3021.md index f528760a0..c0655ce3d 100644 --- a/docs/reference/errors-and-warnings/NU3021.md +++ b/docs/reference/errors-and-warnings/NU3021.md @@ -14,7 +14,7 @@ f1_keywords: ## Scenario 1 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The primary signature's timestamp signature validation failed.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The primary signature's timestamp signature validation failed. ### Issue @@ -29,7 +29,7 @@ Please request the package author to re-sign the package using the `nuget sign` ## Scenario 2 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The timestamp signature validation failed.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The timestamp signature validation failed. ### Issue diff --git a/docs/reference/errors-and-warnings/NU3022.md b/docs/reference/errors-and-warnings/NU3022.md index 73a97fa03..bbe3e11f1 100644 --- a/docs/reference/errors-and-warnings/NU3022.md +++ b/docs/reference/errors-and-warnings/NU3022.md @@ -14,7 +14,7 @@ f1_keywords: ## Scenario 1 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The primary signature's timestamp certificate has an unsupported signature algorithm.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The primary signature's timestamp certificate has an unsupported signature algorithm. ### Issue @@ -32,7 +32,7 @@ Please ensure that the timestamp authority's signing certificate has one of the ## Scenario 2 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The timestamp certificate has an unsupported signature algorithm (SHA1). The following algorithms are supported: SHA256RSA, SHA384RSA, SHA512RSA.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The timestamp certificate has an unsupported signature algorithm (SHA1). The following algorithms are supported: SHA256RSA, SHA384RSA, SHA512RSA. ### Issue diff --git a/docs/reference/errors-and-warnings/NU3023.md b/docs/reference/errors-and-warnings/NU3023.md index 8e815be5f..b984ba930 100644 --- a/docs/reference/errors-and-warnings/NU3023.md +++ b/docs/reference/errors-and-warnings/NU3023.md @@ -14,7 +14,7 @@ f1_keywords: ## Scenario 1 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The timestamp certificate does not meet a minimum public key length requirement.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The timestamp certificate does not meet a minimum public key length requirement. ### Issue @@ -29,7 +29,7 @@ Please ensure that the Timestamp Authority's signing certificate has an RSA pub ## Scenario 2 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The primary signature's timestamp certificate does not meet a minimum public key length requirement.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The primary signature's timestamp certificate does not meet a minimum public key length requirement. ### Issue diff --git a/docs/reference/errors-and-warnings/NU3024.md b/docs/reference/errors-and-warnings/NU3024.md index 199f65d91..373a01016 100644 --- a/docs/reference/errors-and-warnings/NU3024.md +++ b/docs/reference/errors-and-warnings/NU3024.md @@ -14,7 +14,7 @@ f1_keywords: ## Scenario 1 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The timestamp signature has an unsupported digest algorithm. The following algorithms are supported: : SHA-2-256, SHA-2-384, SHA-2-512.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The timestamp signature has an unsupported digest algorithm. The following algorithms are supported: : SHA-2-256, SHA-2-384, SHA-2-512. ### Issue @@ -32,7 +32,7 @@ Ensure that the timestamp authority's signature has one of the following digest ## Scenario 2 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The primary signature's timestamp signature has an unsupported digest algorithm.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The primary signature's timestamp signature has an unsupported digest algorithm. ### Issue diff --git a/docs/reference/errors-and-warnings/NU3025.md b/docs/reference/errors-and-warnings/NU3025.md index f80ff68b3..ea3569e9b 100644 --- a/docs/reference/errors-and-warnings/NU3025.md +++ b/docs/reference/errors-and-warnings/NU3025.md @@ -14,7 +14,7 @@ f1_keywords: ## Scenario 1 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The timestamp signing certificate is not yet valid.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The timestamp signing certificate is not yet valid. ### Issue @@ -29,7 +29,7 @@ Please ensure that the Timestamp Authority's signing certificate is currently va ## Scenario 2 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The primary signature's timestamp signing certificate is not yet valid.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The primary signature's timestamp signing certificate is not yet valid. ### Issue diff --git a/docs/reference/errors-and-warnings/NU3026.md b/docs/reference/errors-and-warnings/NU3026.md index 8d078a2d4..2fafbfb69 100644 --- a/docs/reference/errors-and-warnings/NU3026.md +++ b/docs/reference/errors-and-warnings/NU3026.md @@ -12,7 +12,7 @@ f1_keywords: # NuGet Warning NU3026 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The timestamp response is invalid. Nonces did not match.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The timestamp response is invalid. Nonces did not match. ### Issue diff --git a/docs/reference/errors-and-warnings/NU3027.md b/docs/reference/errors-and-warnings/NU3027.md index 4a0316d6e..382dcad8f 100644 --- a/docs/reference/errors-and-warnings/NU3027.md +++ b/docs/reference/errors-and-warnings/NU3027.md @@ -12,7 +12,7 @@ f1_keywords: # NuGet Warning NU3027 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The signature should be timestamped to enable long-term signature validity after the certificate has expired.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The signature should be timestamped to enable long-term signature validity after the certificate has expired. ### Issue diff --git a/docs/reference/errors-and-warnings/NU3028.md b/docs/reference/errors-and-warnings/NU3028.md index 4e1da0240..5ad0ba503 100644 --- a/docs/reference/errors-and-warnings/NU3028.md +++ b/docs/reference/errors-and-warnings/NU3028.md @@ -14,7 +14,7 @@ f1_keywords: *NuGet 4.6.0+* -
    The author primary signature's timestamp found a chain building issue: The revocation function was unable to check revocation because the revocation server could not be reached. For more information, visit https://aka.ms/certificateRevocationMode
    +> The author primary signature's timestamp found a chain building issue: The revocation function was unable to check revocation because the revocation server could not be reached. For more information, visit https://aka.ms/certificateRevocationMode ### Issue @@ -41,7 +41,7 @@ However, in some cases, this may have unintended concequences such as the packag When the revocation check mode is set to `offline`, the warning will be downgraded to an informational level. -
    The author primary signature's timestamp found a chain building issue: The revocation function was unable to check revocation because the certificate is not available in the cached certificate revocation list and NUGET_CERT_REVOCATION_MODE environment variable has been set to offline. For more information, visit https://aka.ms/certificateRevocationMode.
    +> The author primary signature's timestamp found a chain building issue: The revocation function was unable to check revocation because the certificate is not available in the cached certificate revocation list and NUGET_CERT_REVOCATION_MODE environment variable has been set to offline. For more information, visit https://aka.ms/certificateRevocationMode. > [!Note] > NU3028 is raised as an error in most cases. diff --git a/docs/reference/errors-and-warnings/NU3029.md b/docs/reference/errors-and-warnings/NU3029.md index 689e83f96..7eb3898f4 100644 --- a/docs/reference/errors-and-warnings/NU3029.md +++ b/docs/reference/errors-and-warnings/NU3029.md @@ -12,7 +12,7 @@ f1_keywords: # NuGet Warning NU3029 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The timestamp signature is invalid.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The timestamp signature is invalid. ### Issue diff --git a/docs/reference/errors-and-warnings/NU3030.md b/docs/reference/errors-and-warnings/NU3030.md index 45c892b2b..1c1966246 100644 --- a/docs/reference/errors-and-warnings/NU3030.md +++ b/docs/reference/errors-and-warnings/NU3030.md @@ -12,7 +12,7 @@ f1_keywords: # NuGet Warning NU3030 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The primary signature's timestamp's message imprint uses an unsupported hash algorithm.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The primary signature's timestamp's message imprint uses an unsupported hash algorithm. ### Issue diff --git a/docs/reference/errors-and-warnings/NU3031.md b/docs/reference/errors-and-warnings/NU3031.md index d590213c0..d065571b2 100644 --- a/docs/reference/errors-and-warnings/NU3031.md +++ b/docs/reference/errors-and-warnings/NU3031.md @@ -12,7 +12,7 @@ f1_keywords: # NuGet Warning NU3031 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The repository countersignature is invalid.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The repository countersignature is invalid. ### Issue diff --git a/docs/reference/errors-and-warnings/NU3032.md b/docs/reference/errors-and-warnings/NU3032.md index 447de425b..3265c81ad 100644 --- a/docs/reference/errors-and-warnings/NU3032.md +++ b/docs/reference/errors-and-warnings/NU3032.md @@ -14,7 +14,7 @@ f1_keywords: ## Scenario 1 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The package already contains a repository countersignature. Please remove the existing signature before adding a new repository countersignature.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The package already contains a repository countersignature. Please remove the existing signature before adding a new repository countersignature. ### Issue @@ -29,7 +29,7 @@ Remove the existing signature before adding a new repository countersignature. ## Scenario 2 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The package signature contains multiple repository countersignatures.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The package signature contains multiple repository countersignatures. ### Issue diff --git a/docs/reference/errors-and-warnings/NU3033.md b/docs/reference/errors-and-warnings/NU3033.md index ffabc561a..9349057ee 100644 --- a/docs/reference/errors-and-warnings/NU3033.md +++ b/docs/reference/errors-and-warnings/NU3033.md @@ -14,7 +14,7 @@ f1_keywords: ## Scenario 1 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': A repository primary signature must not have a repository countersignature.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': A repository primary signature must not have a repository countersignature. ### Issue @@ -28,7 +28,7 @@ Try to re-sign the package with either an author signature or a repository signa ## Scenario 2 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': A repository primary signature must not have a repository countersignature.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': A repository primary signature must not have a repository countersignature. ### Issue diff --git a/docs/reference/errors-and-warnings/NU3034.md b/docs/reference/errors-and-warnings/NU3034.md index 54034f27c..43886c386 100644 --- a/docs/reference/errors-and-warnings/NU3034.md +++ b/docs/reference/errors-and-warnings/NU3034.md @@ -12,10 +12,13 @@ f1_keywords: # NuGet Error NU3034 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': signatureValidationMode is set to require, so packages are allowed only if signed by trusted signers; however, no trusted signers were specified.
    -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The package signature certificate fingerprint does not match any certificate fingerprint in the allow list.
    -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': This repository indicated that all its packages are repository signed; however, it listed no signing certificates.
    -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': This package was not repository signed with a certificate listed by this repository.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': signatureValidationMode is set to require, so packages are allowed only if signed by trusted signers; however, no trusted signers were specified. + +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The package signature certificate fingerprint does not match any certificate fingerprint in the allow list. + +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': This repository indicated that all its packages are repository signed; however, it listed no signing certificates. + +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': This package was not repository signed with a certificate listed by this repository. ### Issue diff --git a/docs/reference/errors-and-warnings/NU3036.md b/docs/reference/errors-and-warnings/NU3036.md index 8710049cc..854f65bdf 100644 --- a/docs/reference/errors-and-warnings/NU3036.md +++ b/docs/reference/errors-and-warnings/NU3036.md @@ -14,7 +14,7 @@ f1_keywords: ## Scenario 1 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The timestamp's generalized time is outside the timestamping certificate's validity period.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The timestamp's generalized time is outside the timestamping certificate's validity period. ### Issue @@ -29,7 +29,7 @@ Try to re-sign and timestamp the package. If the problem persists, contact the t ## Scenario 2 -
    Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The primary signature's timestamp's generalized time is outside the timestamping certificate's validity period.
    +> Package 'SamplePackage v1.0.0' from source 'https://contoso.com/index.json': The primary signature's timestamp's generalized time is outside the timestamping certificate's validity period. ### Issue diff --git a/docs/reference/errors-and-warnings/NU3040.md b/docs/reference/errors-and-warnings/NU3040.md index 0d9e92d92..95b15be40 100644 --- a/docs/reference/errors-and-warnings/NU3040.md +++ b/docs/reference/errors-and-warnings/NU3040.md @@ -12,7 +12,7 @@ f1_keywords: # NuGet Warning NU3040 -
    There are two certificates with conflicting allowUntrustedRoot attributes in the computed settings. The allowUntrustedRoot attribute is going to be set to false. Certificate: SHA256-3F9001EA83C560D712C24CF213C3D312CB3BFF51EE89435D3430BD06B5D0EECE
    +> There are two certificates with conflicting allowUntrustedRoot attributes in the computed settings. The allowUntrustedRoot attribute is going to be set to false. Certificate: SHA256-3F9001EA83C560D712C24CF213C3D312CB3BFF51EE89435D3430BD06B5D0EECE ### Issue diff --git a/docs/reference/errors-and-warnings/NU3042.md b/docs/reference/errors-and-warnings/NU3042.md index 57c74bd3a..04497a9f6 100644 --- a/docs/reference/errors-and-warnings/NU3042.md +++ b/docs/reference/errors-and-warnings/NU3042.md @@ -14,13 +14,14 @@ f1_keywords: *NuGet 6.6.0+ on Linux and macOS only* -
    The following X.509 root certificate is untrusted because it is not present in the certificate bundle at <file-path>.  For more information, see documentation for NU3042.
-    Subject:  <certificate subject>
-    Fingerprint (SHA-256):  <certificate fingerprint>
-    Certificate (PEM):
-<PEM-encoded certificate>
    +> The following X.509 root certificate is untrusted because it is not present in the certificate bundle at <file-path>. For more information, see documentation for NU3042.
    +>     Subject: <certificate subject>
    +>     Fingerprint (SHA-256): <certificate fingerprint>
    +>     Certificate (PEM):
    +> <PEM-encoded certificate> ### Issue + Warning NU3042 is raised when signed package verification failed because a root certificate was not found in the appropriate trusted root certificate bundle, either code signing or timestamping. This warning will only be raised on Linux and macOS when signed package verification is enabled, never on Windows. NU3042 should accompany an [NU3018](NU3018.md) or [NU3028](NU3028.md). Each .NET 7+ SDK release contains two root certificate bundles sourced from the [Microsoft Trusted Root Program](https://aka.ms/RootCert). One certificate bundle contains all trusted roots valid for code signing, while the other contains all trusted roots valid for timestamping. NuGet uses these certificate bundles on Linux and macOS when signed package verification is enabled. @@ -35,10 +36,11 @@ The root cause for NU3042 is likely one of the following: For more information, see [NuGet signed-package verification](/dotnet/core/tools/nuget-signed-package-verification). ### Solution + On Linux, if you trust the certificate and are using a system-wide code signing certificate bundle, consider adding the root certificate to the bundle. This solution may not be suitable because it will grant system-wide trust. If the .NET SDK's certificate bundles are out-of-date, update to a more recent release of the .NET SDK. If all else fails, opt out of signed package verification by setting the environment variable `DOTNET_NUGET_SIGNATURE_VERIFICATION` to `false` and [open an issue with the NuGet team](https://github.com/NuGet/Home/issues) to suggest how signed package verification can be improved on your platform. -For more information, see [NuGet signed-package verification](/dotnet/core/tools/nuget-signed-package-verification). \ No newline at end of file +For more information, see [NuGet signed-package verification](/dotnet/core/tools/nuget-signed-package-verification). diff --git a/docs/reference/errors-and-warnings/NU3043.md b/docs/reference/errors-and-warnings/NU3043.md new file mode 100644 index 000000000..93cecd27d --- /dev/null +++ b/docs/reference/errors-and-warnings/NU3043.md @@ -0,0 +1,58 @@ +--- +title: NuGet Warning NU3043 +description: NU3043 warning code +author: kartheekp-ms +ms.date: 09/11/2024 +ms.topic: reference +f1_keywords: + - "NU3043" +--- + +# NuGet Warning NU3043 + +> Invalid value for `--certificate-fingerprint` option in the `dotnet nuget sign` command or the `CertificateFingerprint` option in the `NuGet.exe sign` command. +The value must be a SHA-256, SHA-384, or SHA-512 certificate fingerprint (in hexadecimal). + +This warning is promoted to an error in the .NET 10 SDK, and will be promoted to an error in NuGet.exe around .NET 10's release. + +## Issue + +Starting with .NET 9 and NuGet.exe 6.12, NU3043 warning is raised when a SHA-1 certificate fingerprint is passed to the sign commands. +SHA-1 is considered insecure and should no longer be used. + +## Solution + +To resolve this warning, ensure that you provide a valid SHA-256, SHA-384, or SHA-512 certificate fingerprint (in hexadecimal) for the `--certificate-fingerprint` option in the `dotnet nuget sign` command or the `CertificateFingerprint` option in the `NuGet.exe sign` command. + +You can use the following scripts to compute SHA-2 family hashes for certificates. + +### PowerShell +To use the script, you need to save the certificate to a local folder. + +```powershell +$certificate = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new($certPath) +$stream = [System.IO.MemoryStream]::new($certificate.RawData) + +Try +{ + (Get-FileHash -Algorithm SHA256 $stream).Hash +} +Finally +{ + $stream.Dispose() + $certificate.Dispose() +} +``` +### OpenSSL (Linux/macOS) + +If the certificate is in PEM or CRT format: +```sh +openssl x509 -in path/to/certificate -outform der | sha256sum +``` + +If the certificate is already in DER format: +```sh +sha256sum path/to/certificate +``` +> [!TIP] +> For SHA-384 or SHA-512, replace sha256sum with sha384sum or sha512sum as needed. diff --git a/docs/reference/errors-and-warnings/NU5001.md b/docs/reference/errors-and-warnings/NU5001.md index 101d6682f..c5ec558be 100644 --- a/docs/reference/errors-and-warnings/NU5001.md +++ b/docs/reference/errors-and-warnings/NU5001.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Error NU5001 -
    Unable to output resolved nuspec file because it would overwrite the original at 'F:\project\project.nuspec'.
    +> Unable to output resolved nuspec file because it would overwrite the original at 'F:\project\project.nuspec'. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5002.md b/docs/reference/errors-and-warnings/NU5002.md index 556e0aae8..24672a3ee 100644 --- a/docs/reference/errors-and-warnings/NU5002.md +++ b/docs/reference/errors-and-warnings/NU5002.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Error NU5002 -
    Please specify a nuspec, project.json, or project file to use.
    +> Please specify a nuspec, project.json, or project file to use. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5003.md b/docs/reference/errors-and-warnings/NU5003.md index 83e5e5c44..415f01851 100644 --- a/docs/reference/errors-and-warnings/NU5003.md +++ b/docs/reference/errors-and-warnings/NU5003.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Error NU5003 -
    Failed to build package because of an unsupported targetFramework value on 'System.Net'.
    +> Failed to build package because of an unsupported targetFramework value on 'System.Net'. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5004.md b/docs/reference/errors-and-warnings/NU5004.md index 70d0121ac..2e008e785 100644 --- a/docs/reference/errors-and-warnings/NU5004.md +++ b/docs/reference/errors-and-warnings/NU5004.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Error NU5004 -
    Failed to build package. Ensure 'F:\project\project.nuspec' includes assembly files. For help on building symbols package, visit http://docs.nuget.org/.
    +> Failed to build package. Ensure 'F:\project\project.nuspec' includes assembly files. For help on building symbols package, visit https://docs.nuget.org/. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5005.md b/docs/reference/errors-and-warnings/NU5005.md index 6506a3777..ef54649f9 100644 --- a/docs/reference/errors-and-warnings/NU5005.md +++ b/docs/reference/errors-and-warnings/NU5005.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Error NU5005 -
    Ensure 'F:\project\project.nuspec' includes source and symbol files. For help on building symbols package, visit http://docs.nuget.org/.
    +> Ensure 'F:\project\project.nuspec' includes source and symbol files. For help on building symbols package, visit https://docs.nuget.org/. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5007.md b/docs/reference/errors-and-warnings/NU5007.md index 203389722..3b499e554 100644 --- a/docs/reference/errors-and-warnings/NU5007.md +++ b/docs/reference/errors-and-warnings/NU5007.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Error NU5007 -
    No build found in F:\project\bin\Debug\net461\project.dll. Use the -Build option or build the project.
    +> No build found in F:\project\bin\Debug\net461\project.dll. Use the -Build option or build the project. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5008.md b/docs/reference/errors-and-warnings/NU5008.md index d013cdb86..c837ed1a4 100644 --- a/docs/reference/errors-and-warnings/NU5008.md +++ b/docs/reference/errors-and-warnings/NU5008.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Error NU5008 -
    Manifest file not found at 'F:\project\project.nuspec'
    +> Manifest file not found at 'F:\project\project.nuspec' ### Issue diff --git a/docs/reference/errors-and-warnings/NU5009.md b/docs/reference/errors-and-warnings/NU5009.md index 3da5c1008..792d50a34 100644 --- a/docs/reference/errors-and-warnings/NU5009.md +++ b/docs/reference/errors-and-warnings/NU5009.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Error NU5009 -
    Cannot find version of msbuild.
    +> Cannot find version of msbuild. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5010.md b/docs/reference/errors-and-warnings/NU5010.md index 4d94bf141..15c1a66f6 100644 --- a/docs/reference/errors-and-warnings/NU5010.md +++ b/docs/reference/errors-and-warnings/NU5010.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Error NU5010 -
    Version string specified for package reference '9.9.9.9.9' is invalid.
    +> Version string specified for package reference '9.9.9.9.9' is invalid. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5011.md b/docs/reference/errors-and-warnings/NU5011.md index 87469ed52..d437c1606 100644 --- a/docs/reference/errors-and-warnings/NU5011.md +++ b/docs/reference/errors-and-warnings/NU5011.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Error NU5011 -
    Unable to extract metadata from 'project.csproj'.
    +> Unable to extract metadata from 'project.csproj'. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5012.md b/docs/reference/errors-and-warnings/NU5012.md index 4e46b3aa1..ee612fa1c 100644 --- a/docs/reference/errors-and-warnings/NU5012.md +++ b/docs/reference/errors-and-warnings/NU5012.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Error NU5012 -
    Unable to find 'F:\project\bin\Debug\net461\project.dll'. Make sure the project has been built.
    +> Unable to find 'F:\project\bin\Debug\net461\project.dll'. Make sure the project has been built. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5013.md b/docs/reference/errors-and-warnings/NU5013.md index e1c551b00..187f889be 100644 --- a/docs/reference/errors-and-warnings/NU5013.md +++ b/docs/reference/errors-and-warnings/NU5013.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Error NU5013 -
    Failed to build 'project.csproj'
    +> Failed to build 'project.csproj' ### Issue diff --git a/docs/reference/errors-and-warnings/NU5014.md b/docs/reference/errors-and-warnings/NU5014.md index da935113f..cb07c53ac 100644 --- a/docs/reference/errors-and-warnings/NU5014.md +++ b/docs/reference/errors-and-warnings/NU5014.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Error NU5014 -
    Error occurred when processing file 'F:\project2\project2.csproj': The 'id' start tag on line 4 position 10 does not match the end tag of 'ids'. Line 4, position 20.
    +> Error occurred when processing file 'F:\project2\project2.csproj': The 'id' start tag on line 4 position 10 does not match the end tag of 'ids'. Line 4, position 20. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5015.md b/docs/reference/errors-and-warnings/NU5015.md index 34ddf8367..92c082f94 100644 --- a/docs/reference/errors-and-warnings/NU5015.md +++ b/docs/reference/errors-and-warnings/NU5015.md @@ -11,14 +11,16 @@ f1_keywords: --- # NuGet Error NU5015 -
    project.json cannot contain multiple Target Frameworks.
    + +> [!WARNING] +> project.json support has been removed starting with [NuGet 7.0](../../release-notes/NuGet-7.0.md) and this error will no longer be raised. + +> project.json cannot contain multiple Target Frameworks. ### Issue The project.json file passed to NuGet pack operation contains multiple target frameworks. - ### Solution Please fix the project.json file to contain only a single target framework. - diff --git a/docs/reference/errors-and-warnings/NU5016.md b/docs/reference/errors-and-warnings/NU5016.md index 74c14cc5c..d70ed874c 100644 --- a/docs/reference/errors-and-warnings/NU5016.md +++ b/docs/reference/errors-and-warnings/NU5016.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Error NU5016 -
    Package version constraints for 'NuGet.Versioning' return a version range that is empty.
    +> Package version constraints for 'NuGet.Versioning' return a version range that is empty. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5017.md b/docs/reference/errors-and-warnings/NU5017.md index ffda1be4e..67a3648c8 100644 --- a/docs/reference/errors-and-warnings/NU5017.md +++ b/docs/reference/errors-and-warnings/NU5017.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Error NU5017 -
    Cannot create a package that has no dependencies nor content.
    +> Cannot create a package that has no dependencies nor content. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5018.md b/docs/reference/errors-and-warnings/NU5018.md index 44b50fcc9..d505d56ac 100644 --- a/docs/reference/errors-and-warnings/NU5018.md +++ b/docs/reference/errors-and-warnings/NU5018.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Error NU5018 -
    Invalid assembly reference 'xunit.dll'. Ensure that a file named 'xunit.dll' exists in the lib directory.
    +> Invalid assembly reference 'xunit.dll'. Ensure that a file named 'xunit.dll' exists in the lib directory. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5019.md b/docs/reference/errors-and-warnings/NU5019.md index 165772bf3..a5195e127 100644 --- a/docs/reference/errors-and-warnings/NU5019.md +++ b/docs/reference/errors-and-warnings/NU5019.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Error NU5019 -
     File not found: 'bad_file.path'
    +> File not found: 'bad_file.path' ### Issue diff --git a/docs/reference/errors-and-warnings/NU5020.md b/docs/reference/errors-and-warnings/NU5020.md index b6c771748..56c685737 100644 --- a/docs/reference/errors-and-warnings/NU5020.md +++ b/docs/reference/errors-and-warnings/NU5020.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Error NU5020 -
    A source file was added with an empty path.
    +> A source file was added with an empty path. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5021.md b/docs/reference/errors-and-warnings/NU5021.md index d89e38f1c..d419bb941 100644 --- a/docs/reference/errors-and-warnings/NU5021.md +++ b/docs/reference/errors-and-warnings/NU5021.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Error NU5021 -
    The project directory for the source file 'src/Project/Code.cs' could not be found.
    +> The project directory for the source file 'src/Project/Code.cs' could not be found. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5022.md b/docs/reference/errors-and-warnings/NU5022.md index 370c50b8e..1656f4f02 100644 --- a/docs/reference/errors-and-warnings/NU5022.md +++ b/docs/reference/errors-and-warnings/NU5022.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Error NU5022 -
    MinClient Version string specified '9.9.9.9.9' is invalid.
    +> MinClient Version string specified '9.9.9.9.9' is invalid. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5023.md b/docs/reference/errors-and-warnings/NU5023.md index f88252691..9b319ac03 100644 --- a/docs/reference/errors-and-warnings/NU5023.md +++ b/docs/reference/errors-and-warnings/NU5023.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Error NU5023 -
    The assets file produced by restore does not exist. Try restoring the project again. The expected location of the assets file is F:\project\obj\project.assets.json.
    +> The assets file produced by restore does not exist. Try restoring the project again. The expected location of the assets file is F:\project\obj\project.assets.json. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5024.md b/docs/reference/errors-and-warnings/NU5024.md index c542ab37a..6350658f5 100644 --- a/docs/reference/errors-and-warnings/NU5024.md +++ b/docs/reference/errors-and-warnings/NU5024.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Error NU5024 -
    PackageVersion string specified '9.9.9.9.9' is invalid.
    +> PackageVersion string specified '9.9.9.9.9' is invalid. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5025.md b/docs/reference/errors-and-warnings/NU5025.md index e041791ea..3ed29ba0d 100644 --- a/docs/reference/errors-and-warnings/NU5025.md +++ b/docs/reference/errors-and-warnings/NU5025.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Error NU5025 -
    The assets file found does not contain a valid package spec. Try restoring the project again. The location of the assets file is F:\project\obj\project.assets.json.
    +> The assets file found does not contain a valid package spec. Try restoring the project again. The location of the assets file is F:\project\obj\project.assets.json. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5026.md b/docs/reference/errors-and-warnings/NU5026.md index 239d61f4e..b1d9917cc 100644 --- a/docs/reference/errors-and-warnings/NU5026.md +++ b/docs/reference/errors-and-warnings/NU5026.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Error NU5026 -
    The file ''F:\project\bin\Debug\net461\project.exe' to be packed was not found on disk.
    +> The file ''F:\project\bin\Debug\net461\project.exe' to be packed was not found on disk. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5027.md b/docs/reference/errors-and-warnings/NU5027.md index e5261eeb7..8effdd12b 100644 --- a/docs/reference/errors-and-warnings/NU5027.md +++ b/docs/reference/errors-and-warnings/NU5027.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Error NU5027 -
    Invalid target framework for the file 'F:\project\project.dll'.
    +> Invalid target framework for the file 'F:\project\project.dll'. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5028.md b/docs/reference/errors-and-warnings/NU5028.md index 12c7ad06f..2b8e8b89e 100644 --- a/docs/reference/errors-and-warnings/NU5028.md +++ b/docs/reference/errors-and-warnings/NU5028.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Error NU5028 -
    No project was provided to the PackTask.
    +> No project was provided to the PackTask. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5029.md b/docs/reference/errors-and-warnings/NU5029.md index f6e5ff460..18e600f49 100644 --- a/docs/reference/errors-and-warnings/NU5029.md +++ b/docs/reference/errors-and-warnings/NU5029.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Error NU5029 -
    NuspecProperties should be in the form of 'key1=value1;key2=value2'.
    +> NuspecProperties should be in the form of 'key1=value1;key2=value2'. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5030.md b/docs/reference/errors-and-warnings/NU5030.md index 654669992..e7e76da82 100644 --- a/docs/reference/errors-and-warnings/NU5030.md +++ b/docs/reference/errors-and-warnings/NU5030.md @@ -10,7 +10,7 @@ f1_keywords: --- # NuGet Error NU5030 -
    The license file 'LICENSE.txt' does not exist in the package.
    +> The license file 'LICENSE.txt' does not exist in the package. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5031.md b/docs/reference/errors-and-warnings/NU5031.md index 01ccd5ea7..e87a11e57 100644 --- a/docs/reference/errors-and-warnings/NU5031.md +++ b/docs/reference/errors-and-warnings/NU5031.md @@ -10,7 +10,7 @@ f1_keywords: --- # NuGet Error NU5031 -
    The license file 'LICENSE.txt' has an invalid extension. Valid options are .txt, .md or none.
    +> The license file 'LICENSE.txt' has an invalid extension. Valid options are .txt, .md or none. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5032.md b/docs/reference/errors-and-warnings/NU5032.md index afc9634db..886e4c77e 100644 --- a/docs/reference/errors-and-warnings/NU5032.md +++ b/docs/reference/errors-and-warnings/NU5032.md @@ -10,7 +10,7 @@ f1_keywords: --- # NuGet Error NU5032 -
    The license expression 'MIT OR OR Apache-2.0' cannot be parsed succesfully. The license expression is invalid.
    +> The license expression 'MIT OR OR Apache-2.0' cannot be parsed succesfully. The license expression is invalid. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5033.md b/docs/reference/errors-and-warnings/NU5033.md index 3569d58db..0840e32dd 100644 --- a/docs/reference/errors-and-warnings/NU5033.md +++ b/docs/reference/errors-and-warnings/NU5033.md @@ -10,7 +10,7 @@ f1_keywords: --- # NuGet Error NU5033 -
    Invalid metadata. Cannot specify both a License Expression and a License File.
    +> Invalid metadata. Cannot specify both a License Expression and a License File. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5034.md b/docs/reference/errors-and-warnings/NU5034.md index 1db56fd9e..e44ae8707 100644 --- a/docs/reference/errors-and-warnings/NU5034.md +++ b/docs/reference/errors-and-warnings/NU5034.md @@ -10,7 +10,7 @@ f1_keywords: --- # NuGet Error NU5034 -
    The PackageLicenseExpressionVersion string '2.0.0-InvalidSystemVersion' is not a valid version.
    +> The PackageLicenseExpressionVersion string '2.0.0-InvalidSystemVersion' is not a valid version. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5035.md b/docs/reference/errors-and-warnings/NU5035.md index 472e217be..d2b8aa165 100644 --- a/docs/reference/errors-and-warnings/NU5035.md +++ b/docs/reference/errors-and-warnings/NU5035.md @@ -10,7 +10,7 @@ f1_keywords: --- # NuGet Error NU5035 -
    The PackageLicenseUrl cannot be used in conjunction with the PackageLicenseFile and PackageLicenseExpression.
    +> The PackageLicenseUrl cannot be used in conjunction with the PackageLicenseFile and PackageLicenseExpression. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5036.md b/docs/reference/errors-and-warnings/NU5036.md index 0859655d4..bd3f14d75 100644 --- a/docs/reference/errors-and-warnings/NU5036.md +++ b/docs/reference/errors-and-warnings/NU5036.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Error NU5036 -
    This package has an improperly escaped Url in LicenseUrl
    +> This package has an improperly escaped Url in LicenseUrl ### Issue diff --git a/docs/reference/errors-and-warnings/NU5037.md b/docs/reference/errors-and-warnings/NU5037.md index af357a185..bf74dc5c8 100644 --- a/docs/reference/errors-and-warnings/NU5037.md +++ b/docs/reference/errors-and-warnings/NU5037.md @@ -11,7 +11,8 @@ f1_keywords: --- # NuGet Error NU5037 -
    The package is missing the required nuspec file.
    + +> The package is missing the required nuspec file. ### Issue @@ -29,9 +30,7 @@ Contact the package author. Restore fails for a project managed with the `PackageReference` format. For example: -``` -The package is missing the required nuspec file. Path: C:\.\.\.nuget\packages\x\1.0.0.'x' represents package name and '1.0.0' represents package version. -``` +> The package is missing the required nuspec file. Path: C:\.\.\.nuget\packages\x\1.0.0.'x' represents package name and '1.0.0' represents package version. ### Solution diff --git a/docs/reference/errors-and-warnings/NU5038.md b/docs/reference/errors-and-warnings/NU5038.md index 27b38557a..282d1f988 100644 --- a/docs/reference/errors-and-warnings/NU5038.md +++ b/docs/reference/errors-and-warnings/NU5038.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Error NU5038 -
    The readme file 'readme.txt' has an invalid extension. It must end in .md.
    +> The readme file 'readme.txt' has an invalid extension. It must end in .md. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5039.md b/docs/reference/errors-and-warnings/NU5039.md index 31b4b9e51..ddc6034f1 100644 --- a/docs/reference/errors-and-warnings/NU5039.md +++ b/docs/reference/errors-and-warnings/NU5039.md @@ -12,7 +12,7 @@ f1_keywords: # NuGet Error NU5039 -
    The readme file 'readme.md' does not exist in the package.
    +> The readme file 'readme.md' does not exist in the package. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5040.md b/docs/reference/errors-and-warnings/NU5040.md index 0d90383ef..de314e8bb 100644 --- a/docs/reference/errors-and-warnings/NU5040.md +++ b/docs/reference/errors-and-warnings/NU5040.md @@ -12,7 +12,7 @@ f1_keywords: # NuGet Error NU5040 -
    The readme file 'readme.md' is empty.
    +> The readme file 'readme.md' is empty. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5041.md b/docs/reference/errors-and-warnings/NU5041.md index 7574654df..a6278fb0c 100644 --- a/docs/reference/errors-and-warnings/NU5041.md +++ b/docs/reference/errors-and-warnings/NU5041.md @@ -12,7 +12,7 @@ f1_keywords: # NuGet Error NU5041 -
    Cannot open the readme file 'readme.md'
    +> Cannot open the readme file 'readme.md' ### Issue diff --git a/docs/reference/errors-and-warnings/NU5042.md b/docs/reference/errors-and-warnings/NU5042.md index 2ebf18b01..9fd147aa3 100644 --- a/docs/reference/errors-and-warnings/NU5042.md +++ b/docs/reference/errors-and-warnings/NU5042.md @@ -9,11 +9,14 @@ f1_keywords: - "NU5042" --- -# NuGet Error NU5042 +# NuGet Error NU5042 (Obsolete) -
    `project.json` pack is disabled in the current NuGet version, and will be permanently removed in a future version.
-Please consider migrating 'MyProject' to `PackageReference` and using the pack targets.
-You can set the 'NUGET_ENABLE_LEGACY_PROJECT_JSON_PACK' environment variable to 'true' to temporarily reenable this functionality.
    +> [!WARNING] +> project.json support has been removed starting with [NuGet 7.0](../../release-notes/NuGet-7.0.md) and this error will no longer be raised. + +> `project.json` pack is disabled in the current NuGet version, and will be permanently removed in a future version. +> Please consider migrating 'MyProject' to `PackageReference` and using the pack targets. +> You can set the 'NUGET_ENABLE_LEGACY_PROJECT_JSON_PACK' environment variable to 'true' to temporarily reenable this functionality. ### Issue @@ -21,4 +24,4 @@ NuGet.exe pack for project.json projects is not supported. ### Solution -Migrate your project to PackageReference and use the pack targets instead. \ No newline at end of file +[Migrate your project to PackageReference](../../archive/project-json.md#migrate-projectjson-to-packagereference) and use the pack targets instead. diff --git a/docs/reference/errors-and-warnings/NU5045.md b/docs/reference/errors-and-warnings/NU5045.md index a38ca3a7c..897e0f521 100644 --- a/docs/reference/errors-and-warnings/NU5045.md +++ b/docs/reference/errors-and-warnings/NU5045.md @@ -10,7 +10,7 @@ f1_keywords: # NuGet Warning NU5045 -
    The 'icon' element 'icon.svg' has an invalid file extension. Valid options are .png, .jpg or .jpeg.
    +> The 'icon' element 'icon.svg' has an invalid file extension. Valid options are .png, .jpg or .jpeg. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5046.md b/docs/reference/errors-and-warnings/NU5046.md index cc2191688..5825565ee 100644 --- a/docs/reference/errors-and-warnings/NU5046.md +++ b/docs/reference/errors-and-warnings/NU5046.md @@ -12,7 +12,7 @@ f1_keywords: # NuGet Error NU5046 -
    The icon file 'icon.png' does not exist in the package.
    +> The icon file 'icon.png' does not exist in the package. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5047.md b/docs/reference/errors-and-warnings/NU5047.md index 1582c09ca..44a3a86e2 100644 --- a/docs/reference/errors-and-warnings/NU5047.md +++ b/docs/reference/errors-and-warnings/NU5047.md @@ -12,7 +12,7 @@ f1_keywords: # NuGet Error NU5047 -
    The icon file size must not exceed 1 megabyte.
    +> The icon file size must not exceed 1 megabyte. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5048.md b/docs/reference/errors-and-warnings/NU5048.md index f91c9661a..e948b398b 100644 --- a/docs/reference/errors-and-warnings/NU5048.md +++ b/docs/reference/errors-and-warnings/NU5048.md @@ -12,7 +12,7 @@ f1_keywords: # NuGet Warning NU5048 -
    The 'PackageIconUrl'/'iconUrl' element is deprecated. Consider using the 'PackageIcon'/'icon' element instead. Learn more at https://aka.ms/deprecateIconUrl
    +> The 'PackageIconUrl'/'iconUrl' element is deprecated. Consider using the 'PackageIcon'/'icon' element instead. Learn more at https://aka.ms/deprecateIconUrl ### Issue diff --git a/docs/reference/errors-and-warnings/NU5049.md b/docs/reference/errors-and-warnings/NU5049.md index 65b97276e..4e186a366 100644 --- a/docs/reference/errors-and-warnings/NU5049.md +++ b/docs/reference/errors-and-warnings/NU5049.md @@ -11,7 +11,7 @@ f1_keywords: # NuGet Error NU5049 -
    The `pack` command for SDK-style projects is not supported, use `dotnet pack` or `msbuild -t:pack` to pack this project instead. You can override this behavior by setting the 'NUGET_ENABLE_LEGACY_CSPROJ_PACK' environment variable to 'true'.
    +> The `pack` command for SDK-style projects is not supported, use `dotnet pack` or `msbuild -t:pack` to pack this project instead. You can override this behavior by setting the 'NUGET_ENABLE_LEGACY_CSPROJ_PACK' environment variable to 'true'. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5100.md b/docs/reference/errors-and-warnings/NU5100.md index 8ae38a462..fe9fa082b 100644 --- a/docs/reference/errors-and-warnings/NU5100.md +++ b/docs/reference/errors-and-warnings/NU5100.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Warning NU5100 -
    The assembly 'bin\Debug\net461\project.dll' is not inside the 'lib' folder and hence it won't be added as a reference when the package is installed into a project. Move it into the 'lib' folder if it needs to be referenced.
    +> The assembly 'bin\Debug\net461\project.dll' is not inside the 'lib' folder and hence it won't be added as a reference when the package is installed into a project. Move it into the 'lib' folder if it needs to be referenced. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5101.md b/docs/reference/errors-and-warnings/NU5101.md index 9a20f02fb..4f884638b 100644 --- a/docs/reference/errors-and-warnings/NU5101.md +++ b/docs/reference/errors-and-warnings/NU5101.md @@ -13,7 +13,7 @@ f1_keywords: # NuGet Warning NU5101 ## Scenario 1 -
    The assembly 'lib\project.dll' is placed directly under 'lib' folder. It is recommended that assemblies be placed inside a framework-specific folder. Move it into a framework-specific folder.
    +> The assembly 'lib\project.dll' is placed directly under 'lib' folder. It is recommended that assemblies be placed inside a framework-specific folder. Move it into a framework-specific folder. ### Issue @@ -26,7 +26,7 @@ While packaging a folder please ensure that all assembly files are placed inside ## Scenario 2 -
    The assembly 'lib\project.dll' will be ignored when the package is installed after the migration.
    +> The assembly 'lib\project.dll' will be ignored when the package is installed after the migration. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5102.md b/docs/reference/errors-and-warnings/NU5102.md index 25cf64e5e..c95d23f99 100644 --- a/docs/reference/errors-and-warnings/NU5102.md +++ b/docs/reference/errors-and-warnings/NU5102.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Warning NU5102 -
    The value "http://project_url_here_or_delete_this_line/" for ProjectUrl is a sample value and should be removed. Replace it with an appropriate value or remove it and rebuild your package.
    +> The value "http://project_url_here_or_delete_this_line/" for ProjectUrl is a sample value and should be removed. Replace it with an appropriate value or remove it and rebuild your package. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5103.md b/docs/reference/errors-and-warnings/NU5103.md index 9f94a4c60..ab9bd4c60 100644 --- a/docs/reference/errors-and-warnings/NU5103.md +++ b/docs/reference/errors-and-warnings/NU5103.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Warning NU5103 -
    The folder 'lib\random_tfm\temp.dll' under 'lib' is not recognized as a valid framework name or a supported culture identifier. Rename it to a valid framework name or culture identifier.
    +> The folder 'lib\random_tfm\temp.dll' under 'lib' is not recognized as a valid framework name or a supported culture identifier. Rename it to a valid framework name or culture identifier. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5104.md b/docs/reference/errors-and-warnings/NU5104.md index 2fad138bb..a25e8b315 100644 --- a/docs/reference/errors-and-warnings/NU5104.md +++ b/docs/reference/errors-and-warnings/NU5104.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Warning NU5104 -
    A stable release of a package should not have a prerelease dependency. Either modify the version spec of dependency "NuGet.Versioning [4.7.0-preview4.5065, )" or update the version field in the nuspec.
    +> A stable release of a package should not have a prerelease dependency. Either modify the version spec of dependency "NuGet.Versioning [4.7.0-preview4.5065, )" or update the version field in the nuspec. ### Issue @@ -23,4 +23,4 @@ The project or nuspec being packaged contains a dependency on a prerelease packa If you intend to create a prerelease package then please refer to SemVer2 guidelines and add a prerelease tag to the version property i.e. `1.0.0-pre`. If you intend to create a stable package then please update the specified dependency version to a stable version. > [!NOTE] -> Mixing stable and prerelease packages may lead to unexpected behaviors are resolution time. Learn more about how [PackageReference](../../concepts/Dependency-Resolution.md#version-ranges-and-prerelease-versions-with-packagereference) and [packages.config](../../concepts/Dependency-Resolution.md#version-ranges-and-prerelease-versions-with-packagesconfig) projects handle this resolution. +> Mixing stable and prerelease packages may lead to unexpected behaviors at resolution time. Learn more about how [PackageReference](../../concepts/Dependency-Resolution.md#version-ranges-and-prerelease-versions-with-packagereference) and [packages.config](../../concepts/Dependency-Resolution.md#version-ranges-and-prerelease-versions-with-packagesconfig) projects handle this resolution. diff --git a/docs/reference/errors-and-warnings/NU5105.md b/docs/reference/errors-and-warnings/NU5105.md index 4c278c447..da447a0c9 100644 --- a/docs/reference/errors-and-warnings/NU5105.md +++ b/docs/reference/errors-and-warnings/NU5105.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Warning NU5105 -
    The package version '1.2.3+semver2.metadata' uses SemVer 2.0.0 or components of SemVer 1.0.0 that are not supported on legacy clients. Change the package version to a SemVer 1.0.0 string. If the version contains a release label it must start with a letter. This message can be ignored if the package is not intended for older clients.
    +> The package version '1.2.3+semver2.metadata' uses SemVer 2.0.0 or components of SemVer 1.0.0 that are not supported on legacy clients. Change the package version to a SemVer 1.0.0 string. If the version contains a release label it must start with a letter. This message can be ignored if the package is not intended for older clients. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5106.md b/docs/reference/errors-and-warnings/NU5106.md index 52524a311..637373f03 100644 --- a/docs/reference/errors-and-warnings/NU5106.md +++ b/docs/reference/errors-and-warnings/NU5106.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Warning NU5106 -
    The file at 'lib\WinRT\temp.dll' uses the obsolete 'WinRT' as the framework folder. Replace 'WinRT' or 'WinRT45' with 'NetCore45'.
    +> The file at 'lib\WinRT\temp.dll' uses the obsolete 'WinRT' as the framework folder. Replace 'WinRT' or 'WinRT45' with 'NetCore45'. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5107.md b/docs/reference/errors-and-warnings/NU5107.md index 595d1ace8..3ae39e017 100644 --- a/docs/reference/errors-and-warnings/NU5107.md +++ b/docs/reference/errors-and-warnings/NU5107.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Warning NU5107 -
    The file 'tools/subfolder/init.ps1' will be ignored by NuGet because it is not directly under 'tools' folder. Place the file directly under 'tools' folder.
    +> The file 'tools/subfolder/init.ps1' will be ignored by NuGet because it is not directly under 'tools' folder. Place the file directly under 'tools' folder. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5108.md b/docs/reference/errors-and-warnings/NU5108.md index dd7774181..ce801cc36 100644 --- a/docs/reference/errors-and-warnings/NU5108.md +++ b/docs/reference/errors-and-warnings/NU5108.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Warning NU5108 -
    The transform file 'other\code.pp' is outside the 'content' folder and hence will not be transformed during installation of this package. Move it into the 'content' folder.
    +> The transform file 'other\code.pp' is outside the 'content' folder and hence will not be transformed during installation of this package. Move it into the 'content' folder. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5109.md b/docs/reference/errors-and-warnings/NU5109.md index 26ff11cc8..9641ff624 100644 --- a/docs/reference/errors-and-warnings/NU5109.md +++ b/docs/reference/errors-and-warnings/NU5109.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Warning NU5109 -
    The file at 'tools/_._' uses the symbol for empty directory '_._', but it is present in a directory that contains other files. Please remove this file from directories that contain other files.
    +> The file at 'tools/_._' uses the symbol for empty directory '_._', but it is present in a directory that contains other files. Please remove this file from directories that contain other files. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5110.md b/docs/reference/errors-and-warnings/NU5110.md index fe9b4a099..191f63eab 100644 --- a/docs/reference/errors-and-warnings/NU5110.md +++ b/docs/reference/errors-and-warnings/NU5110.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Warning NU5110 -
    The script file 'other\init.ps1' is outside the 'tools' folder and hence will not be executed during installation of this package. Move it into the 'tools' folder.
    +> The script file 'other\init.ps1' is outside the 'tools' folder and hence will not be executed during installation of this package. Move it into the 'tools' folder. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5111.md b/docs/reference/errors-and-warnings/NU5111.md index 962d82d3d..fee3943e9 100644 --- a/docs/reference/errors-and-warnings/NU5111.md +++ b/docs/reference/errors-and-warnings/NU5111.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Warning NU5111 -
    The script file 'tools\random.ps1' is not recognized by NuGet and hence will not be executed during installation of this package. Rename it to install.ps1, uninstall.ps1 or init.ps1 and place it directly under 'tools'.
    +> The script file 'tools\random.ps1' is not recognized by NuGet and hence will not be executed during installation of this package. Rename it to install.ps1, uninstall.ps1 or init.ps1 and place it directly under 'tools'. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5112.md b/docs/reference/errors-and-warnings/NU5112.md index 192844f22..8b77a6fed 100644 --- a/docs/reference/errors-and-warnings/NU5112.md +++ b/docs/reference/errors-and-warnings/NU5112.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Warning NU5112 -
    The version of dependency 'NuGet.Versioning' is not specified. Specify the version of dependency and rebuild your package.
    +> The version of dependency 'NuGet.Versioning' is not specified. Specify the version of dependency and rebuild your package. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5114.md b/docs/reference/errors-and-warnings/NU5114.md index a2dfc2236..4a5d32b9b 100644 --- a/docs/reference/errors-and-warnings/NU5114.md +++ b/docs/reference/errors-and-warnings/NU5114.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Warning NU5114 -
    'SolutionDir' key already exists in Properties collection. Overriding value.
    +> 'SolutionDir' key already exists in Properties collection. Overriding value. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5115.md b/docs/reference/errors-and-warnings/NU5115.md index 941c84d85..d9c6a8a3d 100644 --- a/docs/reference/errors-and-warnings/NU5115.md +++ b/docs/reference/errors-and-warnings/NU5115.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Warning NU5115 -
    Description was not specified. Using 'Description'.
    +> Description was not specified. Using 'Description'. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5116.md b/docs/reference/errors-and-warnings/NU5116.md index 7127aaebe..469fbfc1a 100644 --- a/docs/reference/errors-and-warnings/NU5116.md +++ b/docs/reference/errors-and-warnings/NU5116.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Warning NU5116 -
     'Content\sample.txt' was included in the project but doesn't exist. Skipping...
    +> 'Content\sample.txt' was included in the project but doesn't exist. Skipping... ### Issue diff --git a/docs/reference/errors-and-warnings/NU5117.md b/docs/reference/errors-and-warnings/NU5117.md index 3d198a771..187fb6c8b 100644 --- a/docs/reference/errors-and-warnings/NU5117.md +++ b/docs/reference/errors-and-warnings/NU5117.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Warning NU5117 -
     '$(MSBuildProjectDirectory)/tools/sample.txt' was included in the project but the path could not be resolved. Skipping...
    +> '$(MSBuildProjectDirectory)/tools/sample.txt' was included in the project but the path could not be resolved. Skipping... ### Issue diff --git a/docs/reference/errors-and-warnings/NU5118.md b/docs/reference/errors-and-warnings/NU5118.md index a8bf62a31..99b5e5242 100644 --- a/docs/reference/errors-and-warnings/NU5118.md +++ b/docs/reference/errors-and-warnings/NU5118.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Warning NU5118 -
    File 'F :\validation\test\proj\tools\readme.1.txt' is not added because the package already contains file 'tools\readme.txt'
    +> File 'F :\validation\test\proj\tools\readme.1.txt' is not added because the package already contains file 'tools\readme.txt' ### Issue diff --git a/docs/reference/errors-and-warnings/NU5119.md b/docs/reference/errors-and-warnings/NU5119.md index 619691945..8b92ad1fa 100644 --- a/docs/reference/errors-and-warnings/NU5119.md +++ b/docs/reference/errors-and-warnings/NU5119.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Warning NU5119 -
    File 'F:\project\binary\Libuv.1.10.0.nupkg' was not added to the package. Files and folders starting with '.' or ending with '.nupkg' are excluded by default. To include this file, use -NoDefaultExcludes from the commandline
    +> File 'F:\project\binary\Libuv.1.10.0.nupkg' was not added to the package. Files and folders starting with '.' or ending with '.nupkg' are excluded by default. To include this file, use -NoDefaultExcludes from the commandline ### Issue diff --git a/docs/reference/errors-and-warnings/NU5120.md b/docs/reference/errors-and-warnings/NU5120.md index bd45bd1d7..18e7a1db9 100644 --- a/docs/reference/errors-and-warnings/NU5120.md +++ b/docs/reference/errors-and-warnings/NU5120.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Warning NU5120 -
    install.ps1 script will be ignored when the package is installed after the migration.
    +> install.ps1 script will be ignored when the package is installed after the migration. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5121.md b/docs/reference/errors-and-warnings/NU5121.md index 31ee44496..f2a3aeb8f 100644 --- a/docs/reference/errors-and-warnings/NU5121.md +++ b/docs/reference/errors-and-warnings/NU5121.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Warning NU5121 -
     'content' assets will not be available when the package is installed after the migration.
    +> 'content' assets will not be available when the package is installed after the migration. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5122.md b/docs/reference/errors-and-warnings/NU5122.md index fa928b1fc..01a31181a 100644 --- a/docs/reference/errors-and-warnings/NU5122.md +++ b/docs/reference/errors-and-warnings/NU5122.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Warning NU5122 -
    XDT transform file 'tools/transform.xdt' will not be applied when the package is installed after the migration.
    +> XDT transform file 'tools/transform.xdt' will not be applied when the package is installed after the migration. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5123.md b/docs/reference/errors-and-warnings/NU5123.md index 7931c2c37..3ac6486ea 100644 --- a/docs/reference/errors-and-warnings/NU5123.md +++ b/docs/reference/errors-and-warnings/NU5123.md @@ -11,7 +11,7 @@ f1_keywords: --- # NuGet Warning NU5123 -
    The file 'content/<LongPath>/readme.txt' path, name, or both are too long. Your package might not work without long file path support. Please shorten the file path or file name.
    +> The file 'content/<LongPath>/readme.txt' path, name, or both are too long. Your package might not work without long file path support. Please shorten the file path or file name. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5124.md b/docs/reference/errors-and-warnings/NU5124.md index 39fcaec77..522840ba3 100644 --- a/docs/reference/errors-and-warnings/NU5124.md +++ b/docs/reference/errors-and-warnings/NU5124.md @@ -10,7 +10,7 @@ f1_keywords: --- # NuGet Warning NU5124 -
    The license identifier 'Microsoft-SpecialLicense' is not recognized by the current toolset.
    +> The license identifier 'Microsoft-SpecialLicense' is not recognized by the current toolset. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5125.md b/docs/reference/errors-and-warnings/NU5125.md index d6a21b797..313f74c7a 100644 --- a/docs/reference/errors-and-warnings/NU5125.md +++ b/docs/reference/errors-and-warnings/NU5125.md @@ -10,7 +10,7 @@ f1_keywords: --- # NuGet Warning NU5125 -
    The 'licenseUrl' element will be deprecated. Consider using the 'license' element instead.
    +> The 'licenseUrl' element will be deprecated. Consider using the 'license' element instead. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5126.md b/docs/reference/errors-and-warnings/NU5126.md index a91a1d10b..43224ecb2 100644 --- a/docs/reference/errors-and-warnings/NU5126.md +++ b/docs/reference/errors-and-warnings/NU5126.md @@ -10,7 +10,7 @@ f1_keywords: # NuGet Warning NU5126 -
    `project.json` pack is deprecated. Please consider migrating '{0}' to `PackageReference` and using the pack targets
    +> `project.json` pack is deprecated. Please consider migrating '{0}' to `PackageReference` and using the pack targets ### Issue diff --git a/docs/reference/errors-and-warnings/NU5127.md b/docs/reference/errors-and-warnings/NU5127.md index 8e1ba098f..5e50a7523 100644 --- a/docs/reference/errors-and-warnings/NU5127.md +++ b/docs/reference/errors-and-warnings/NU5127.md @@ -2,23 +2,31 @@ title: NuGet Warning NU5127 description: NU5127 Warning code author: zivkan -ms.date: 09/20/2019 +ms.date: 05/05/2025 ms.topic: reference -ms.reviewer: karann f1_keywords: - NU5127 --- # NuGet Warning NU5127 -
    This package does not contain a lib/ or ref/ folder, and will therefore be treated as compatible for all frameworks. Since framework specific files were found under the build/ directory for net45, netstandard2.0, consider creating the following empty files to correctly narrow the compatibility of the package:
--lib/net45/_._
--lib/netstandard2.0/_._
    +> This package does not contain a lib/ or ref/ folder, and will therefore be treated as compatible for all frameworks. Since framework specific files were found under the build/ directory for net45, netstandard2.0, consider creating the following empty files to correctly narrow the compatibility of the package:
    +> -lib/net45/_._
    +> -lib/netstandard2.0/_._ ### Issue -Projects using packages with `PackageReference` only use `lib/` and `ref/` assemblies to determine package compatibility. Therefore, a package without any `lib/` or `ref/` files will be considered compatible with all projects. However, if that package contains build files specific to one or more [Target Framework Monikers (TFMs)](../target-frameworks.md), a package consumer may expect the package to fail if none of the build files are used. +Projects using packages with `PackageReference` only use `lib/` and `ref/` assemblies to determine package compatibility. +Therefore, a package without any `lib/` or `ref/` files will be considered compatible with all projects. +However, packages containing MSBuild props or targets that are specific to one or more target frameworks show intent in only being compatible with those target frameworks. + +For example, consider a package `PackageA` contains a single file, `build/net8.0/PackageA.targets`. +If this package is referenced by a project targeting `net48` (.NET Framework, Version 4.8), NuGet will not emit any warnings or errors, but also will not select any assets from the package. +Therefore, the package consumer will not be notified that the package does not work correctly with their project. ### Solution -As the warning message suggests, create an empty file named `_._` in the lib folder for the TFMs listed. This will allow NuGet to fail the restore for `PackageReference` projects when the project is incompatible with the package. +As the warning message suggests, create an empty file named `_._` in the lib folder for the TFMs listed. +This will allow NuGet to fail the restore for `PackageReference` projects when the project is incompatible with the package. + +If your package is intended to be compatible with all target frameworks, but only take effect for certain target frameworks, create a file `build/{PackageId}.props` whose contents are ``. diff --git a/docs/reference/errors-and-warnings/NU5128.md b/docs/reference/errors-and-warnings/NU5128.md index 7ded238b1..c2b14d33a 100644 --- a/docs/reference/errors-and-warnings/NU5128.md +++ b/docs/reference/errors-and-warnings/NU5128.md @@ -13,8 +13,8 @@ f1_keywords: ## Scenario 1 -
    Some target frameworks declared in the dependencies group of the nuspec and the lib/ref folder do not have exact matches in the other location. Consult the list of actions below:
-- Add a dependency group for .NETStandard2.0 to the nuspec
    +> Some target frameworks declared in the dependencies group of the nuspec and the lib/ref folder do not have exact matches in the other location. Consult the list of actions below: +> - Add a dependency group for .NETStandard2.0 to the nuspec ### Issue @@ -50,8 +50,8 @@ If you do not wish your package to be compatible with the reported TFM, modify y ## Scenario 2 -
    Some target frameworks declared in the dependencies group of the nuspec and the lib/ref folder do not have exact matches in the other location. Consult the list of actions below:
-- Add lib or ref assemblies for the netstandard2.0 target framework
    +> Some target frameworks declared in the dependencies group of the nuspec and the lib/ref folder do not have exact matches in the other location. Consult the list of actions below: +> - Add lib or ref assemblies for the netstandard2.0 target framework ### Issue diff --git a/docs/reference/errors-and-warnings/NU5129.md b/docs/reference/errors-and-warnings/NU5129.md index ccd56200c..3e75b385f 100644 --- a/docs/reference/errors-and-warnings/NU5129.md +++ b/docs/reference/errors-and-warnings/NU5129.md @@ -11,9 +11,7 @@ f1_keywords: # NuGet Warning NU5129 -``` -At least one . file was found in '//', but '//.' was not. -``` +> At least one .<extension> file was found in '<build_folder>/<tfm>/', but '<build_folder>/<tfm>/<package_id>.<extension>' was not. `` is one of: `targets`, `props`. `` is one of: `build`, `buildTransitive`, `buildCrossTargeting`, `buildMultiTargeting`. @@ -22,13 +20,16 @@ At least one . file was found in '//', but ' At least one .targets file was found in 'build/netstandard2.0/', but 'build/netstandard2.0/MyPackage.targets' was not. + +> At least one .props file was found in 'build/netstandard2.0/', but 'build/netstandard2.0/MyPackage.props' was not. + +> At least one .props file was found in 'buildTransitive/net472/', but 'buildTransitive/net472/My.Package.Id.props' was not. + +> At least one .targets file was found in 'buildMultitargeting/netcoreapp3.0/', but 'buildMultitargeting/netcoreapp3.0/Contoso.Utilities. +targets' was not. + +> At least one .props file was found in 'build/', but 'build/AdventureWorks.Tools.props' was not. ### Issue diff --git a/docs/reference/errors-and-warnings/NU5130.md b/docs/reference/errors-and-warnings/NU5130.md index e04d10328..af139a88a 100644 --- a/docs/reference/errors-and-warnings/NU5130.md +++ b/docs/reference/errors-and-warnings/NU5130.md @@ -11,8 +11,8 @@ f1_keywords: # NuGet Warning NU5130 -
    Some target frameworks declared in the dependencies group of the nuspec and the lib/ref folder have compatible matches, but not exact matches in the other location. Unless intentional, consult the list of actions below:
-- Add a dependency group for .NETFramework4.7.2 to the nuspec
    +> Some target frameworks declared in the dependencies group of the nuspec and the lib/ref folder have compatible matches, but not exact matches in the other location. Unless intentional, consult the list of actions below: +> - Add a dependency group for .NETFramework4.7.2 to the nuspec ### Issue diff --git a/docs/reference/errors-and-warnings/NU5131.md b/docs/reference/errors-and-warnings/NU5131.md index 947cef557..26953b57d 100644 --- a/docs/reference/errors-and-warnings/NU5131.md +++ b/docs/reference/errors-and-warnings/NU5131.md @@ -11,8 +11,8 @@ f1_keywords: # NuGet Warning NU5131 -
    References were found in the nuspec, but some reference assemblies were not found in both the nuspec and ref folder. Add the following reference assemblies:
-- Add AssemblyName.dll to the ref/net472/ directory
    +> References were found in the nuspec, but some reference assemblies were not found in both the nuspec and ref folder. Add the following reference assemblies: +> - Add AssemblyName.dll to the ref/net472/ directory ### Issue diff --git a/docs/reference/errors-and-warnings/NU5133.md b/docs/reference/errors-and-warnings/NU5133.md index 2cf0963d3..ea8282dda 100644 --- a/docs/reference/errors-and-warnings/NU5133.md +++ b/docs/reference/errors-and-warnings/NU5133.md @@ -14,7 +14,7 @@ f1_keywords: ## Example -
    Warning NU5133: NuGet.exe file on path \Downloads\nuget.exe needs to be unblocked after downloading.
    +> Warning NU5133: NuGet.exe file on path \Downloads\nuget.exe needs to be unblocked after downloading. ### Issue When downloading a file on Windows, in this case nuget.exe, through a web browser, the `Mark Of The Web` may be added. diff --git a/docs/reference/errors-and-warnings/NU5501.md b/docs/reference/errors-and-warnings/NU5501.md index f6591f8d3..0df5db23b 100644 --- a/docs/reference/errors-and-warnings/NU5501.md +++ b/docs/reference/errors-and-warnings/NU5501.md @@ -14,7 +14,7 @@ f1_keywords: ## Scenario 1 -
    The following dependency group(s) require(s) dots in the framework version: net50-windows7.0
    +> The following dependency group(s) require(s) dots in the framework version: net50-windows7.0 ### Issue @@ -48,7 +48,7 @@ Change `net50` to `net5.0`. ## Scenario 2 -
    The following packaged file folder(s) require(s) dots in the framework version: contentFiles/any/net50/a.img.
    +> The following packaged file folder(s) require(s) dots in the framework version: contentFiles/any/net50/a.img. ### Issue diff --git a/docs/reference/extensibility/NuGet-Credential-Providers-for-Visual-Studio.md b/docs/reference/extensibility/NuGet-Credential-Providers-for-Visual-Studio.md index 6b10f8121..e567da4aa 100644 --- a/docs/reference/extensibility/NuGet-Credential-Providers-for-Visual-Studio.md +++ b/docs/reference/extensibility/NuGet-Credential-Providers-for-Visual-Studio.md @@ -4,7 +4,7 @@ description: NuGet credential providers authenticate with feeds by implementing author: JonDouglas ms.author: jodou ms.date: 01/09/2017 -ms.topic: conceptual +ms.topic: how-to --- # Authenticating feeds in Visual Studio with NuGet credential providers @@ -31,8 +31,7 @@ The NuGet Visual Studio Extension 3.6+ implements an internal CredentialService During credential acquisition, the credential service will try credential providers in the following order, stopping as soon as credentials are acquired: 1. Credentials will be fetched from NuGet configuration files (using the built-in `SettingsCredentialProvider`). -1. If the package source is on Visual Studio Team Services, the `VisualStudioAccountProvider` will be used. -1. All other plug-in Visual Studio credential providers will be tried sequentially. +1. Visual Studio credential providers will be tried sequentially. 1. Try to use all NuGet cross platform credential providers sequentially. 1. If no credentials have been acquired yet, the user will be prompted for credentials using a standard basic authentication dialog. diff --git a/docs/reference/extensibility/NuGet-Cross-Platform-Authentication-Plugin.md b/docs/reference/extensibility/NuGet-Cross-Platform-Authentication-Plugin.md index a0e8d027b..624db0a23 100644 --- a/docs/reference/extensibility/NuGet-Cross-Platform-Authentication-Plugin.md +++ b/docs/reference/extensibility/NuGet-Cross-Platform-Authentication-Plugin.md @@ -4,7 +4,7 @@ description: NuGet cross platform authentication plugins for NuGet.exe, dotnet.e author: nkolev92 ms.author: nikolev ms.date: 07/01/2018 -ms.topic: conceptual +ms.topic: article --- # NuGet cross platform authentication plugin @@ -58,10 +58,14 @@ The following table summarizes how the plugin should behave for all combinations | IsNonInteractive | CanShowDialog | Plugin behavior | | ---------------- | ------------- | --------------- | -| true | true | The IsNonInteractive switch takes precedence over the dialog switch. The plugin is not allowed to pop a dialog. This combination is only valid for .NET Framework plugins | -| true | false | The IsNonInteractive switch takes precedence over the dialog switch. The plugin is not allowed to block. This combination is only valid for .NET Core plugins | -| false | true | The plugin should show a dialog. This combination is only valid for .NET Framework plugins | -| false | false | The plugin should/can not show a dialog. The plugin should use device flow to authenticate by logging an instruction message via the logger. This combination is only valid for .NET Core plugins | +| true | true | The IsNonInteractive switch takes precedence over the dialog switch. The plugin is not allowed to block. | +| true | false | The IsNonInteractive switch takes precedence over the dialog switch. The plugin is not allowed to block. | +| false | true | The plugin can show a dialog if required. For example, interactive login, or account selection. | +| false | false | The plugin should/can not show a dialog. The plugin should use device flow to authenticate by logging an instruction message via the logger. | + +Prior to [NuGet 7.0](../../release-notes/NuGet-7.0.md), NuGet would always set `CanShowDialog` to false on the dotnet CLI, and true for MSBuild restore. +From 7.0, NuGet will always set `CanShowDialog` to true, but plugins should still detect when graphical interfaces are not available. +For example when running on Linux over an SSH connection without X forwarding, or a PowerShell remote session. Please refer to the following specs before writing a plugin. diff --git a/docs/reference/extensibility/NuGet-Cross-Platform-Plugins.md b/docs/reference/extensibility/NuGet-Cross-Platform-Plugins.md index 02428709d..3fd832a9e 100644 --- a/docs/reference/extensibility/NuGet-Cross-Platform-Plugins.md +++ b/docs/reference/extensibility/NuGet-Cross-Platform-Plugins.md @@ -4,7 +4,7 @@ description: NuGet cross platform plugins for NuGet.exe, dotnet.exe, msbuild.exe author: nkolev92 ms.author: nikolev ms.date: 07/01/2018 -ms.topic: conceptual +ms.topic: article --- # NuGet cross platform plugins @@ -12,20 +12,11 @@ ms.topic: conceptual In NuGet 4.8+ support for cross platform plugins has been added. This was achieved with by building a new plugin extensibility model, that has to conform to a strict set of rules of operation. The plugins are self-contained executables (runnables in the .NET Core world), that the NuGet Clients launch in a separate process. -This is a true write once, run everywhere plugin. It will work with all NuGet client tools. -The plugins can be either .NET Framework (NuGet.exe, MSBuild.exe and Visual Studio), or .NET Core (dotnet.exe). -A versioned communication protocol between the NuGet Client and the plugin is defined. During the startup handshake, the 2 processes negotiate the protocol version. - -In order to cover all NuGet client tools scenarios, one would need both a .NET Framework and a .NET Core plugin. -The below describes the client/framework combinations of the plugins. - -| Client tool | Framework | -| ------------ | --------- | -| Visual Studio | .NET Framework | -| dotnet.exe | .NET Core | -| NuGet.exe | .NET Framework | -| MSBuild.exe | .NET Framework | -| NuGet.exe on Mono | .NET Framework | +This is a true write once, run everywhere plugin. +It will work with all NuGet client tools. +The plugins can be written in any programming language, but the easiest plugin development and installation experience will be with .NET. +A versioned communication protocol between the NuGet Client and the plugin is defined. +During the startup handshake, the 2 processes negotiate the protocol version. ## How does it work @@ -41,17 +32,22 @@ The high level workflow can be described as follows: The current protocol version is *2.0.0*. Under this version, the requirements are as follows: -- Have a valid, trusted Authenticode signature assemblies that will run on Windows and Mono. There is no special trust requirement for assemblies run on Linux and Mac yet. [Relevant issue](https://github.com/NuGet/Home/issues/6702) - Support stateless launching under the current security context of NuGet client tools. For example, NuGet client tools will not perform elevation or additional initialization outside of the plugin protocol described later. - Be non interactive, unless explicitly specified. - Adhere to the negotiated plugin protocol version. - Respond to all requests within a reasonable time period. - Honor cancellation requests for any in-progress operation. +Plugins discovered from the PATH environment variable (for example, installed via `dotnet tool`) additionally must match the filename pattern `nuget-plugin-*`. +The `nuget-plugin-` part must be written entirely in lowercase letters. + +NuGet 6.12 (MSBuild 17.12, and .NET SDK 9.0.100) and earlier also required plugins to be Authenticode signed on Windows. + The technical specification is described in more detail in the following specs: - [NuGet Package Download Plugin](https://github.com/NuGet/Home/wiki/NuGet-Package-Download-Plugin) - [NuGet cross plat authentication plugin](https://github.com/NuGet/Home/wiki/NuGet-cross-plat-authentication-plugin) +- [Dotnet Tools Plugins](https://github.com/NuGet/Home/blob/dev/accepted/2024/support-nuget-authentication-plugins-dotnet-tools.md) ## Client - Plugin interaction @@ -65,23 +61,27 @@ After 1 minute of inactivity a plugin is considered idle and is shut down. ## Plugin installation and discovery -The plugins will be discovered via a convention based directory structure. -CI/CD scenarios and power users can use environment variables to override the behavior. When using environment variables, only absolute paths are allowed. Note that `NUGET_NETFX_PLUGIN_PATHS` and `NUGET_NETCORE_PLUGIN_PATHS` are only available with 5.3+ version of the NuGet tooling and later. +NuGet searches for plugins from a convention based directory structure, and scanning the PATH environment variable. + +### Convention based discovery + +CI/CD scenarios and power users can use environment variables to override the behavior. +When using environment variables, only absolute paths are allowed. Note that `NUGET_NETFX_PLUGIN_PATHS` and `NUGET_NETCORE_PLUGIN_PATHS` are only available with 5.3+ version of the NuGet tooling and later. - `NUGET_NETFX_PLUGIN_PATHS` - defines the plugins that will be used by the .NET Framework based tooling (NuGet.exe/MSBuild.exe/Visual Studio). Takes precedence over `NUGET_PLUGIN_PATHS`. (NuGet version 5.3+ only) - `NUGET_NETCORE_PLUGIN_PATHS` - defines the plugins that will be used by the .NET Core based tooling (dotnet.exe). Takes precedence over `NUGET_PLUGIN_PATHS`. (NuGet version 5.3+ only) - `NUGET_PLUGIN_PATHS` - defines the plugins that will be used for that NuGet process, priority preserved. If this environment variable is set, it overrides the convention based discovery. Ignored if either of the framework specific variables is specified. -- User-location, the NuGet Home location in `%UserProfile%/.nuget/plugins`. This location cannot be overriden. A different root directory will be used for .NET Core and .NET Framework plugins. +- User-location, the NuGet Home location in `%UserProfile%/.nuget/plugins`. This location cannot be overridden. A different root directory will be used for .NET Core and .NET Framework plugins. -| Framework | Root discovery location | -| ------- | ------------------------ | -| .NET Core | `%UserProfile%/.nuget/plugins/netcore` | -| .NET Framework | `%UserProfile%/.nuget/plugins/netfx` | +| Framework | Root discovery location | Used by | +| ------- | ------------------------ | ---- | +| .NET Core | `%UserProfile%/.nuget/plugins/netcore` | dotnet CLI | +| .NET Framework | `%UserProfile%/.nuget/plugins/netfx` | MSBuild, NuGet.exe, Visual Studio | Each plugin should be installed in its own folder. The plugin entry point will be the name of the installed folder, with the .dll extensions for .NET Core, and .exe extension for .NET Framework. -``` +```text .nuget plugins netfx @@ -96,8 +96,17 @@ The plugin entry point will be the name of the installed folder, with the .dll e ... ``` -> [!Note] -> There is currently no user story for the installation of the plugins. It's as simple as moving the required files into the predetermined location. +### PATH discovery + +Starting from [NuGet 6.13](../../release-notes/NuGet-6.13.md), NuGet will search each directory provided in the PATH environment variable for files matching the pattern `nuget-plugin-*`. +The pattern matching is case-sensitive, and `nuget-plugin-` must be written entirely in lowercase letters. +On Windows the file must have an `.exe` or `.bat` extension. +On Linux and Mac the file must have the executable bit set. + +This allows NuGet plugins to be installed via `dotnet tool` commands, WinGet, a Linux distribution's package manager, or any other method that can put executables on the user's PATH. +This also allows NuGet plugins to be written in any programming language (previously plugins for Linux and Mac must be written in .NET). + +We recommend plugins are developed in .NET, so that you can use the [NuGet.Protocol package](https://www.nuget.org/packages/NuGet.Protocol) to avoid needing to write the json RPC code, and to allow customers to discover your plugin via `dotnet package search nuget-plugin`. ## Supported operations diff --git a/docs/reference/extensibility/nuget-exe-Credential-Providers.md b/docs/reference/extensibility/nuget-exe-Credential-Providers.md index 624c8c787..b0242a3b1 100644 --- a/docs/reference/extensibility/nuget-exe-Credential-Providers.md +++ b/docs/reference/extensibility/nuget-exe-Credential-Providers.md @@ -4,7 +4,7 @@ description: nuget.exe credential providers authenticate with a feed, and are im author: JonDouglas ms.author: jodou ms.date: 12/12/2017 -ms.topic: conceptual +ms.topic: concept-article --- # Authenticating feeds with nuget.exe credential providers diff --git a/docs/reference/media/registered-certs.png b/docs/reference/media/registered-certs.png index 39a20e9eb..2b9cc1b64 100644 Binary files a/docs/reference/media/registered-certs.png and b/docs/reference/media/registered-certs.png differ diff --git a/docs/reference/msbuild-targets.md b/docs/reference/msbuild-targets.md index 9d6d9b1db..b4601c9c3 100644 --- a/docs/reference/msbuild-targets.md +++ b/docs/reference/msbuild-targets.md @@ -4,7 +4,7 @@ description: NuGet pack and restore can work directly as MSBuild targets with Nu author: nkolev92 ms.author: nikolev ms.date: 2/4/2022 -ms.topic: conceptual +ms.topic: article no-loc: [NuGet, MSBuild, .nuspec, nuspec] --- @@ -38,6 +38,9 @@ Similarly, you can write an MSBuild task, write your own target and consume NuGe For .NET projects that use the `PackageReference` format, using `msbuild -t:pack` draws inputs from the project file to use in creating a NuGet package. +Non-SDK-style projects will need to install the NuGet.Build.Tasks.Pack package when using Visual Studio 2022 or earlier. +We recommend uninstalling this package when upgrading to Visual Studio 2026 to ensure your project can use the latest pack features and bug fixes. + The following table describes the MSBuild properties that can be added to a project file within the first `` node. You can make these edits easily in Visual Studio 2017 and later by right-clicking the project and selecting **Edit {project_name}** on the context menu. For convenience, the table is organized by the equivalent property in a [`.nuspec` file](../reference/nuspec.md). > [!NOTE] @@ -307,7 +310,8 @@ When using `MSBuild -t:pack -p:IsTool=true`, all output files, as specified in t ### Packing using a `.nuspec` file -Although it is recommended that you [include all the properties](../reference/msbuild-targets.md#pack-target) that are usually in the `.nuspec` file in the project file instead, you can choose to use a `.nuspec` file to pack your project. For a non-SDK-style project that uses `PackageReference`, you must import `NuGet.Build.Tasks.Pack.targets` so that the pack task can be executed. You still need to restore the project before you can pack a nuspec file. (An SDK-style project includes the pack targets by default.) +Although it is recommended that you [include all the properties](../reference/msbuild-targets.md#pack-target) that are usually in the `.nuspec` file in the project file instead, you can choose to use a `.nuspec` file to pack your project. +You still need to restore the project before you can pack a nuspec file. (An SDK-style project includes the pack targets by default.) The target framework of the project file is irrelevant and not used when packing a nuspec. The following three MSBuild properties are relevant to packing using a `.nuspec`: @@ -444,6 +448,7 @@ Additional restore settings may come from MSBuild properties in the project file | `RestorePackagesConfig` | An opt-in switch, that restores projects with packages.config. Support with `MSBuild -t:restore` only. | | `RestoreRepositoryPath` | packages.config only. Specifies the packages directory to which the packages should be restored. `SolutionDirectory` will be used if not specified. | | `RestoreUseStaticGraphEvaluation` | An opt-in switch to use static graph MSBuild evaluation instead of the standard evaluation. Static graph evaluation is an experimental feature that's significantly faster for large repos and solutions. | +| `RestoreUseLegacyDependencyResolver` | An opt-out to use the legacy dependency resolver. NuGet's dependency resolver implementation was rewritten in the [6.12 release](../../docs/release-notes/NuGet-6.12.md). This switch forces the previous algorithm to be used. | The `ExcludeRestorePackageImports` property is an internal property used by NuGet. It should not be modified or set in any MSBuild files. diff --git a/docs/reference/nuget-config-file.md b/docs/reference/nuget-config-file.md index a77f0a0e4..83aa92383 100644 --- a/docs/reference/nuget-config-file.md +++ b/docs/reference/nuget-config-file.md @@ -30,13 +30,14 @@ Contains miscellaneous configuration settings, which can be set using the [`nuge | Key | Value | | --- | --- | -| dependencyVersion (`packages.config` only) | The default `DependencyVersion` value for package install, restore, and update, when the `-DependencyVersion` switch is not specified directly. This value is also used by the NuGet Package Manager UI. Values are `Lowest`, `HighestPatch`, `HighestMinor`, `Highest`. | -| globalPackagesFolder (projects using PackageReference only) | The location of the default global packages folder. The default is `%userprofile%\.nuget\packages` (Windows) or `~/.nuget/packages` (Mac/Linux). A relative path can be used in project-specific `nuget.config` files. This setting is overridden by the `NUGET_PACKAGES` environment variable, which takes precedence. | -| repositoryPath (`packages.config` only) | The location in which to install NuGet packages instead of the default `$(Solutiondir)/packages` folder. A relative path can be used in project-specific `nuget.config` files. | | defaultPushSource | Identifies the URL or path of the package source that should be used as the default if no other package sources are found for an operation. | +| dependencyVersion (`packages.config` only) | The default `DependencyVersion` value for package install, restore, and update, when the `-DependencyVersion` switch is not specified directly. This value is also used by the NuGet Package Manager UI. Values are `Lowest`, `HighestPatch`, `HighestMinor`, `Highest`. | +| globalPackagesFolder | The location of the default global packages folder. The default is `%userprofile%\.nuget\packages` (Windows) or `~/.nuget/packages` (Mac/Linux). A relative path can be used in project-specific `nuget.config` files. This setting is overridden by the `NUGET_PACKAGES` environment variable, which takes precedence. | | http_proxy http_proxy.user http_proxy.password no_proxy | Proxy settings to use when connecting to package sources; `http_proxy` should be in the format `http://:@`. Passwords are encrypted and cannot be added manually. For `no_proxy`, the value is a comma-separated list of domains the bypass the proxy server. You can alternately use the http_proxy and no_proxy environment variables for those values. For additional details, see [NuGet proxy settings](http://skolima.blogspot.com/2012/07/nuget-proxy-settings.html) (skolima.blogspot.com). | | maxHttpRequestsPerSource | Controls the maximum number of parallel requests sent from NuGet to every package source for package dependency resolution and downloads. The default value on `dotnet.exe` is `Int32.MaxValue` which is derived from `HttpClientHandler.MaxConnectionsPerServer` property. This setting has no impact on `dotnet.exe` for `Mac OS` because the throttling limit is set to `16` to avoid too many open files error. The default value for `NuGet client tools` that runs on `.NET Framework` such as `Visual Studio` and `nuget.exe` is `64` on `Windows` and `1` on `Mono`. The default value for `Packages.config` style projects is set to `Environment.ProcessorCount`. Configuring `maxHttpRequestsPerSource` property to a value less than the default could impact NuGet performance. | -| signatureValidationMode | Specifies the validation mode used to verify package signatures for package install, and restore. Values are `accept`, `require`. Defaults to `accept`. +| repositoryPath (`packages.config` only) | The location in which to install NuGet packages instead of the default `$(Solutiondir)/packages` folder. A relative path can be used in project-specific `nuget.config` files. | +| signatureValidationMode | Specifies the validation mode used to verify package signatures for package install, and restore. Values are `accept`, `require`. Defaults to `accept`. | +| updatePackageLastAccessTime | When set to `true`, restore will update the last access time of the `.nupkg.metadata` file in the global packages folder during restore. See [the documentation on the global packages folder for more information](../consume-packages/managing-the-global-packages-and-cache-folders.md#global-packages) | **Example**: @@ -48,6 +49,7 @@ Contains miscellaneous configuration settings, which can be set using the [`nuge + ``` @@ -117,27 +119,48 @@ Lists all known package sources. The order is ignored during restore operations | :-- | :-- | | **Key** | (name to assign to the package source) | | **Value** | The path or URL of the package source. | -| **protocolVersion** | The NuGet server protocol version to be used. The current version is "3". Defaults to version "2" when not pointing to a package source URL ending in `.json` (e.g. https://api.nuget.org/v3/index.json). Supported in [NuGet 3.0+](/nuget/release-notes/nuget-3.0.0). See [NuGet Server API](/nuget/api/overview) for more information about the version 3 protocol. | +| **protocolVersion** | The NuGet server protocol version to be used. The current version is "3". Defaults to version "2" when not pointing to a package source URL ending in `.json` (e.g. ). Supported in [NuGet 3.0+](/nuget/release-notes/nuget-3.0.0). See [NuGet Server API](/nuget/api/overview) for more information about the version 3 protocol. | | **allowInsecureConnections** | When false, or not specified, NuGet will emit a warning when the source uses http, rather than https. If you are confident that communication with this source will never be at risk of interception attacks, you can set the value to true to suppress the warning. Supported in NuGet 6.8+. | +| **disableTLSCertificateValidation** | This configuration property allows you to disable SSL/TLS certificate validation for your HTTPS server. When set to true, the server will ignore any errors related to SSL/TLS certificates, such as expired or self-signed certificates, and establish the connection without validation. Supported in NuGet 6.11+. | **Example**: ```xml - + + ``` +> [!NOTE] +> Use package sources that you trust. + > [!NOTE] > When using the CLI, you can express a [`RestoreSources`](../reference/msbuild-targets.md#restore-properties) MSBuild property or [`--source`(.NET CLI)](/dotnet/core/tools/dotnet-restore#options) | [`-Source`(NuGet CLI)](/nuget/reference/cli-reference/cli-ref-restore#options) to override the `` defined in the NuGet.config. > [!Tip] > When `` is present for a given node, NuGet ignores previously defined configuration values for that node. [Read more about how settings are applied](../consume-packages/configuring-nuget-behavior.md#how-settings-are-applied). +### auditSources + +Lists all known audit sources, which [NuGet Audit](../concepts/Auditing-Packages.md#running-a-security-audit-with-restore) will use during restore. +If no audit sources are provided, restore will use package sources and suppress [NU1905](../reference/errors-and-warnings/NU1905.md). +`auditSources` was added to [NuGet 6.12](../release-notes/NuGet-6.12.md). + +Audit sources support the same attributes as `packageSources` (`protocolVersion`, `allowInsecureConnections`), and sources that require authentication are configured with `packageSourceCredentials`, the same way as `packageSources`. + +**Example**: +```xml + + + + +``` + ### packageSourceCredentials Stores usernames and passwords for sources, typically specified with the `-username` and `-password` switches with `nuget sources`. Passwords are encrypted by default unless the `-storepasswordincleartext` option is also used. @@ -286,7 +309,7 @@ Identifies to the currently active source or indicates the aggregate of all sour ## trustedSigners section -Stores trusted signers used to allow package while installing or restoring. This list cannot be empty when the user sets `signatureValidationMode` to `require`. +Stores trusted signers used to allow package while installing or restoring. This list cannot be empty when the user sets `signatureValidationMode` to `require`. This section can be updated with the [`nuget trusted-signers` command](../reference/cli-reference/cli-ref-trusted-signers.md). @@ -422,7 +445,6 @@ The table below show environnment variable syntax and path separator support for | `$MY_VAR` | `/` | No | No | No | No | | `$MY_VAR` | `\` | No | No | No | No | - ## Example config file Below is an example `nuget.config` file that illustrates a number of settings including optional ones: diff --git a/docs/reference/nuspec.md b/docs/reference/nuspec.md index 81f2d82fc..da7370ef6 100644 --- a/docs/reference/nuspec.md +++ b/docs/reference/nuspec.md @@ -35,7 +35,9 @@ In this topic: ## General form and schema -The current `nuspec.xsd` schema file can be found in the [NuGet GitHub repository](https://github.com/NuGet/NuGet.Client/blob/dev/src/NuGet.Core/NuGet.Packaging/compiler/resources/nuspec.xsd). +A `nuspec.xsd` schema file can be found in the [NuGet GitHub repository](https://github.com/NuGet/NuGet.Client/blob/dev/src/NuGet.Core/NuGet.Packaging/compiler/resources/nuspec.xsd). +Note, that this file only represents the most recent schema for a `.nuspec` file. +No officially published versions exists and no version of that file corresponds to any specific NuGet version. Within this schema, a `.nuspec` file has the following general form: @@ -64,6 +66,11 @@ All XML element names in the .nuspec file are case-sensitive, as is the case for metadata element `` is correct and `` is not correct. The proper casing for each element name is documented below. +> [!Important] +> While the `.nuspec` file contains a reference to a schema +> (`xmlns="http://schemas.microsoft.com/packaging/2010/07/nuspec.xsd"`), +> The NuGet-Team has never published a schema file that could be used for automatic schema validation. + ### Required metadata elements Although the following elements are the minimum requirements for a package, you should consider adding the [optional metadata elements](#optional-metadata-elements) to improve the overall experience developers have with your package. @@ -86,9 +93,9 @@ A description of the package for UI display. When uploading a package to nuget.org, the `description` field is limited to 4000 characters. #### authors -A comma-separated list of packages authors, matching the profile names on nuget.org. These are displayed in the NuGet Gallery on nuget.org and are used to cross-reference packages by the same authors. - -When uploading a package to nuget.org, the `authors` field is limited to 4000 characters. +A comma-separated list of package authors. +The `authors` and the `owners` from the nuspec are ignored when uploading the package to nuget.org. +For setting package ownership on nuget.org, see [Managing package owners on nuget.org](../nuget-org/publish-a-package.md#managing-package-owners-on-nugetorg). ### Optional metadata elements @@ -96,7 +103,9 @@ When uploading a package to nuget.org, the `authors` field is limited to 4000 ch > [!Important] > owners is deprecated. Use authors instead. -A comma-separated list of the package creators using profile names on nuget.org. This is often the same list as in `authors`, and is ignored when uploading the package to nuget.org. See [Managing package owners on nuget.org](../nuget-org/publish-a-package.md#managing-package-owners-on-nugetorg). +A comma-separated list of package owners. +The `owners` from the nuspec is ignored when uploading the package to nuget.org. +For setting package ownership on nuget.org, see [Managing package owners on nuget.org](../nuget-org/publish-a-package.md#managing-package-owners-on-nugetorg). #### projectUrl A URL for the package's home page, often shown in UI displays as well as nuget.org. @@ -816,11 +825,11 @@ C#-specific content for net45 and up /contentFiles/cs/net45/sample.cs ``` -Empty folders can use `.` to opt out of providing content for certain combinations of language and TxM, for example: +Empty folders can use `_._` to opt out of providing content for certain combinations of language and TxM, for example: ``` /contentFiles/vb/any/code.vb -/contentFiles/cs/any/. +/contentFiles/cs/any/_._ ``` #### Example contentFiles section diff --git a/docs/reference/target-frameworks.md b/docs/reference/target-frameworks.md index 86b59a309..a2c1e0df5 100644 --- a/docs/reference/target-frameworks.md +++ b/docs/reference/target-frameworks.md @@ -288,7 +288,7 @@ Additional frameworks defined by third parties provide compatibility with other | | WindowsPhone 8.1 (UWP) | | | WindowsPhone 8.0 (SL) | -Additionally, NuGet packages targeting Xamarin can use additional Xamarin-defined frameworks. See [Creating NuGet packages for Xamarin](https://developer.xamarin.com/guides/cross-platform/advanced/nuget/). +Additionally, NuGet packages targeting Xamarin can use additional Xamarin-defined frameworks: | Name | Description | .NET Standard | | --- | --- | --- diff --git a/docs/release-notes/Index.md b/docs/release-notes/Index.md index e535502b9..638732d93 100644 --- a/docs/release-notes/Index.md +++ b/docs/release-notes/Index.md @@ -4,13 +4,19 @@ description: Index of NuGet release notes and known issues for all versions. author: anangaur ms.author: anangaur ms.date: 05/25/2022 -ms.topic: conceptual +ms.topic: release-notes --- # Release Notes [Known Issues](../release-notes/known-issues.md) +[Nuget 6.13](../release-notes/NuGet-6.13.md) + +[NuGet 6.12](../release-notes/NuGet-6.12.md) + +[NuGet 6.11](../release-notes/NuGet-6.11.md) + [NuGet 6.10](../release-notes/NuGet-6.10.md) [NuGet 6.9](../release-notes/NuGet-6.9.md) diff --git a/docs/release-notes/Known-Issues.md b/docs/release-notes/Known-Issues.md index 08a02261a..051862356 100644 --- a/docs/release-notes/Known-Issues.md +++ b/docs/release-notes/Known-Issues.md @@ -3,8 +3,8 @@ title: Known Issues description: Known issues with NuGet including authentication, package installation, and tools. author: JonDouglas ms.author: jodou -ms.date: 11/11/2016 -ms.topic: conceptual +ms.date: 06/06/2024 +ms.topic: troubleshooting-known-issue --- # Known Issues with NuGet @@ -14,6 +14,25 @@ These are the most common known issues with NuGet that are repeatedly reported. > [!Note] > Starting with NuGet 4.0, known issues are a part of the respective release notes. +## NuGet Audit settings may not be applied correctly for projects using packages.config in Visual Studio 17.10 + +NuGet Audit support was added for packages.config projects starting from NuGet 6.10 and Visual Studio 17.10. +Information on how to configure NuGet Audit can be found in our docs on [our docs on auditing packages](../concepts/Auditing-Packages.md). + +**Problem:** + +If two or more projects using packages.config in the solution use the same project name, then NuGet Audit will choose one and use the same NuGet Audit settings for both projects. + +The tracking issue to remove this limitation is [available on GitHub](https://github.com/NuGet/Home/issues/13466). + +**Workaround:** + +If all projects with the same name use the same configuration values, then there will be no functional difference when NuGet restores one project using a different project's configuration. + +NuGet.exe does not have this limitation, so you can [download NuGet.exe](../install-nuget-client-tools.md#nugetexe-cli) and run `NuGet.exe restore` on your solution to see if the NuGet Audit warnings are different on the command line to what Visual Studio is reporting. + +If it is feasible to rename the projects so they have different project names, then this problem scenario will not be encountered. + ## Authentication issues with NuGet feeds in VSTS with nuget.exe v3.4.3 **Problem:** diff --git a/docs/release-notes/NuGet-1.1.md b/docs/release-notes/NuGet-1.1.md index 6ccec09fa..63b2c1586 100644 --- a/docs/release-notes/NuGet-1.1.md +++ b/docs/release-notes/NuGet-1.1.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 1.1 including known issues, bug fixes, adde author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 1.0 and 1.1 Release Notes @@ -268,4 +268,4 @@ The following is a list of features and bugs that were fixed for NuGet CTP 1. * ```[Add Disclaimer Text to the Add Package Dialog](http://nuget.codeplex.com/workitem/140)``` * ```[Add Disclaimer When the Package Console is run the first time](http://nuget.codeplex.com/workitem/143)``` * ```[Display Disclaimer After Installing Package In The Console](http://nuget.codeplex.com/workitem/144)``` -* ```[Rename the .nupack extension to .nupkg](http://nuget.codeplex.com/workitem/146)``` \ No newline at end of file +* ```[Rename the .nupack extension to .nupkg](http://nuget.codeplex.com/workitem/146)``` diff --git a/docs/release-notes/NuGet-1.2.md b/docs/release-notes/NuGet-1.2.md index fe8f2022f..f43a1121a 100644 --- a/docs/release-notes/NuGet-1.2.md +++ b/docs/release-notes/NuGet-1.2.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 1.2 including known issues, bug fixes, adde author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 1.2 Release Notes @@ -87,4 +87,4 @@ need to update that project with the latest version of NuGet.Server. you need to uninstall NuGet first and then install it. This is listed in our [Known Issues page](../release-notes/known-issues.md) which provides more details. The issue only affects those running Visual Studio 2010 SP1 and have a version of NuGet 1.0 installed that was incorrectly signed. This version was only made available from the CodePlex website for a brief -period so this issue shouldn't affect too many people. \ No newline at end of file +period so this issue shouldn't affect too many people. diff --git a/docs/release-notes/NuGet-1.3.md b/docs/release-notes/NuGet-1.3.md index 8db5d57bb..74115f60a 100644 --- a/docs/release-notes/NuGet-1.3.md +++ b/docs/release-notes/NuGet-1.3.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 1.3 including known issues, bug fixes, adde author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 1.3 Release Notes diff --git a/docs/release-notes/NuGet-1.4.md b/docs/release-notes/NuGet-1.4.md index a1b4e3870..71514285b 100644 --- a/docs/release-notes/NuGet-1.4.md +++ b/docs/release-notes/NuGet-1.4.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 1.4 including known issues, bug fixes, adde author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 1.4 Release Notes diff --git a/docs/release-notes/NuGet-1.5.md b/docs/release-notes/NuGet-1.5.md index 2ae23b70a..3bb052e73 100644 --- a/docs/release-notes/NuGet-1.5.md +++ b/docs/release-notes/NuGet-1.5.md @@ -4,7 +4,8 @@ description: Release notes for NuGet 1.5 including known issues, bug fixes, adde author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes +ms.custom: sfi-image-nochange --- # NuGet 1.5 Release Notes diff --git a/docs/release-notes/NuGet-1.6.md b/docs/release-notes/NuGet-1.6.md index 0f8bc5d2f..4dd8dd1ca 100644 --- a/docs/release-notes/NuGet-1.6.md +++ b/docs/release-notes/NuGet-1.6.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 1.6 including known issues, bug fixes, adde author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 1.6 Release Notes diff --git a/docs/release-notes/NuGet-1.7.md b/docs/release-notes/NuGet-1.7.md index 9395f1783..5a2f1b933 100644 --- a/docs/release-notes/NuGet-1.7.md +++ b/docs/release-notes/NuGet-1.7.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 1.7 including known issues, bug fixes, adde author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 1.7 Release Notes diff --git a/docs/release-notes/NuGet-1.8.md b/docs/release-notes/NuGet-1.8.md index c8fe0e9c9..6179df1c7 100644 --- a/docs/release-notes/NuGet-1.8.md +++ b/docs/release-notes/NuGet-1.8.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 1.8 including known issues, bug fixes, adde author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 1.8 Release Notes @@ -72,4 +72,4 @@ By modifying the install command to download and install packages in parallel, N ## Bug Fixes NuGet 1.8 includes quite a few bug fixes with an emphasis on the package manager console and package restore workflow, particularly as it relates to package restore consent and Windows 8 Express integration. -For a full list of work items fixed in NuGet 1.8, please view the ```[NuGet Issue Tracker for this release](http://nuget.codeplex.com/workitem/list/advanced?keyword=&status=Closed&type=All&priority=All&release=NuGet%201.8&assignedTo=All&component=All&sortField=Votes&sortDirection=Descending&page=0)```. \ No newline at end of file +For a full list of work items fixed in NuGet 1.8, please view the ```[NuGet Issue Tracker for this release](http://nuget.codeplex.com/workitem/list/advanced?keyword=&status=Closed&type=All&priority=All&release=NuGet%201.8&assignedTo=All&component=All&sortField=Votes&sortDirection=Descending&page=0)```. diff --git a/docs/release-notes/NuGet-2.0.md b/docs/release-notes/NuGet-2.0.md index de1064776..d37a46008 100644 --- a/docs/release-notes/NuGet-2.0.md +++ b/docs/release-notes/NuGet-2.0.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 2.0 including known issues, bug fixes, adde author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 2.0 Release Notes diff --git a/docs/release-notes/NuGet-2.1.md b/docs/release-notes/NuGet-2.1.md index ab2447af4..e2ed72aba 100644 --- a/docs/release-notes/NuGet-2.1.md +++ b/docs/release-notes/NuGet-2.1.md @@ -4,7 +4,8 @@ description: Release notes for NuGet 2.1 including known issues, bug fixes, adde author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes +ms.custom: sfi-image-nochange --- # NuGet 2.1 Release Notes diff --git a/docs/release-notes/NuGet-2.12-RC.md b/docs/release-notes/NuGet-2.12-RC.md index ffd6d73ac..57b3f680e 100644 --- a/docs/release-notes/NuGet-2.12-RC.md +++ b/docs/release-notes/NuGet-2.12-RC.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 2.12 RC including known issues, bug fixes, author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 2.12-RC Release Notes diff --git a/docs/release-notes/NuGet-2.12.md b/docs/release-notes/NuGet-2.12.md index eef3d737a..db1e010bb 100644 --- a/docs/release-notes/NuGet-2.12.md +++ b/docs/release-notes/NuGet-2.12.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 2.12 including known issues, bug fixes, add author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 2.12 Release Notes diff --git a/docs/release-notes/NuGet-2.2.1.md b/docs/release-notes/NuGet-2.2.1.md index 2ad2f92c7..84de48489 100644 --- a/docs/release-notes/NuGet-2.2.1.md +++ b/docs/release-notes/NuGet-2.2.1.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 2.2.1 including known issues, bug fixes, ad author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 2.2.1 Release Notes diff --git a/docs/release-notes/NuGet-2.2.md b/docs/release-notes/NuGet-2.2.md index ec4030efc..ea2296b2c 100644 --- a/docs/release-notes/NuGet-2.2.md +++ b/docs/release-notes/NuGet-2.2.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 2.2 including known issues, bug fixes, adde author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 2.2 Release Notes diff --git a/docs/release-notes/NuGet-2.5.md b/docs/release-notes/NuGet-2.5.md index 09079a7a6..afaa2e90b 100644 --- a/docs/release-notes/NuGet-2.5.md +++ b/docs/release-notes/NuGet-2.5.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 2.5 including known issues, bug fixes, adde author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 2.5 Release Notes diff --git a/docs/release-notes/NuGet-2.6.1-for-WebMatrix.md b/docs/release-notes/NuGet-2.6.1-for-WebMatrix.md index 1f46b40a9..e5abd798f 100644 --- a/docs/release-notes/NuGet-2.6.1-for-WebMatrix.md +++ b/docs/release-notes/NuGet-2.6.1-for-WebMatrix.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 2.6.1 for WebMatrix including known issues, author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 2.6.1 for WebMatrix Release Notes diff --git a/docs/release-notes/NuGet-2.6.md b/docs/release-notes/NuGet-2.6.md index 222b8fd9a..b9a4db16c 100644 --- a/docs/release-notes/NuGet-2.6.md +++ b/docs/release-notes/NuGet-2.6.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 2.6 including known issues, bug fixes, adde author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 2.6 Release Notes @@ -158,4 +158,4 @@ package authors to fully understand how developers are installing their packages ## Bug Fixes NuGet 2.6 also includes several bug fixes. For a full list of work items fixed in NuGet 2.6, please view -the ```[NuGet Issue Tracker for this release](https://nuget.codeplex.com/workitem/list/advanced?keyword=&status=Closed&type=All&priority=All&release=NuGet%202.6&assignedTo=All&component=All&sortField=LastUpdatedDate&sortDirection=Descending&page=0&reasonClosed=All)```. \ No newline at end of file +the ```[NuGet Issue Tracker for this release](https://nuget.codeplex.com/workitem/list/advanced?keyword=&status=Closed&type=All&priority=All&release=NuGet%202.6&assignedTo=All&component=All&sortField=LastUpdatedDate&sortDirection=Descending&page=0&reasonClosed=All)```. diff --git a/docs/release-notes/NuGet-2.7.1.md b/docs/release-notes/NuGet-2.7.1.md index 867978a56..b9b3ed7de 100644 --- a/docs/release-notes/NuGet-2.7.1.md +++ b/docs/release-notes/NuGet-2.7.1.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 2.7.1 including known issues, bug fixes, ad author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 2.7.1 Release Notes diff --git a/docs/release-notes/NuGet-2.7.2.md b/docs/release-notes/NuGet-2.7.2.md index 8b5778746..bc7b2a718 100644 --- a/docs/release-notes/NuGet-2.7.2.md +++ b/docs/release-notes/NuGet-2.7.2.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 2.7.2 including known issues, bug fixes, ad author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 2.7.2 Release Notes diff --git a/docs/release-notes/NuGet-2.7.md b/docs/release-notes/NuGet-2.7.md index a8224e923..6154bfff3 100644 --- a/docs/release-notes/NuGet-2.7.md +++ b/docs/release-notes/NuGet-2.7.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 2.7 including known issues, bug fixes, adde author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 2.7 Release Notes diff --git a/docs/release-notes/NuGet-2.8.1.md b/docs/release-notes/NuGet-2.8.1.md index 5efbb0905..1b9cea406 100644 --- a/docs/release-notes/NuGet-2.8.1.md +++ b/docs/release-notes/NuGet-2.8.1.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 2.8.1 including known issues, bug fixes, ad author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 2.8.1 Release Notes diff --git a/docs/release-notes/NuGet-2.8.2.md b/docs/release-notes/NuGet-2.8.2.md index d6d38ce0f..30fc16840 100644 --- a/docs/release-notes/NuGet-2.8.2.md +++ b/docs/release-notes/NuGet-2.8.2.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 2.8.2 including known issues, bug fixes, ad author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 2.8.2 Release Notes diff --git a/docs/release-notes/NuGet-2.8.3.md b/docs/release-notes/NuGet-2.8.3.md index 3e0b2a079..85476d164 100644 --- a/docs/release-notes/NuGet-2.8.3.md +++ b/docs/release-notes/NuGet-2.8.3.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 2.8.3 including known issues, bug fixes, ad author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 2.8.3 Release Notes diff --git a/docs/release-notes/NuGet-2.8.5.md b/docs/release-notes/NuGet-2.8.5.md index a9ffa31c7..8952af0db 100644 --- a/docs/release-notes/NuGet-2.8.5.md +++ b/docs/release-notes/NuGet-2.8.5.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 2.8.5 including known issues, bug fixes, ad author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 2.8.5 Release Notes @@ -22,4 +22,4 @@ In this release, the support for NuGet Package Manager dialog was added for [DNX One bug was fixed that prevented packages from installing into FSharp projects properly: -```https://nuget.codeplex.com/workitem/4400``` \ No newline at end of file +```https://nuget.codeplex.com/workitem/4400``` diff --git a/docs/release-notes/NuGet-2.8.6.md b/docs/release-notes/NuGet-2.8.6.md index dbe2f5ee2..2d009fd6d 100644 --- a/docs/release-notes/NuGet-2.8.6.md +++ b/docs/release-notes/NuGet-2.8.6.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 2.8.6 including known issues, bug fixes, ad author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 2.8.6 Release Notes @@ -20,4 +20,4 @@ In this release, the NuGet Package Manager dialog had support added for: * Introduced the UAP Target Framework Moniker to support Windows 10 Application Development. * NuGet protocol version 3 endpoints * Support for [Nuget.Config](../consume-packages/configuring-nuget-behavior.md) protocolVersion attribute on repository sources. Default value is "2" -* Falling back to remote repository if a required package version is not available in the local cache \ No newline at end of file +* Falling back to remote repository if a required package version is not available in the local cache diff --git a/docs/release-notes/NuGet-2.8.7.md b/docs/release-notes/NuGet-2.8.7.md index cb3dde359..7eba6482a 100644 --- a/docs/release-notes/NuGet-2.8.7.md +++ b/docs/release-notes/NuGet-2.8.7.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 2.8.7 including known issues, bug fixes, ad author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 2.8.7 Release Notes @@ -12,4 +12,4 @@ ms.topic: conceptual [NuGet 2.8.6 Release Notes](../release-notes/nuget-2.8.6.md) | [NuGet 2.9-RC Release Notes](../release-notes/nuget-2.9-RC.md) NuGet 2.8.7 was released July 27, 2015 as a patch update to the 2.8.6 VSIX with fix specific to a bug that effected Powershell policy implementation. -[https://github.com/NuGet/Home/issues/974](https://github.com/NuGet/Home/issues/974) \ No newline at end of file +[https://github.com/NuGet/Home/issues/974](https://github.com/NuGet/Home/issues/974) diff --git a/docs/release-notes/NuGet-2.8.md b/docs/release-notes/NuGet-2.8.md index 76ea22e1b..950ad8ac6 100644 --- a/docs/release-notes/NuGet-2.8.md +++ b/docs/release-notes/NuGet-2.8.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 2.8 including known issues, bug fixes, adde author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 2.8 Release Notes diff --git a/docs/release-notes/NuGet-2.9-RC.md b/docs/release-notes/NuGet-2.9-RC.md index 8ba73ad39..a4c2a3ebb 100644 --- a/docs/release-notes/NuGet-2.9-RC.md +++ b/docs/release-notes/NuGet-2.9-RC.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 2.9 RC including known issues, bug fixes, a author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 2.9-RC Release Notes diff --git a/docs/release-notes/NuGet-3.0-Beta.md b/docs/release-notes/NuGet-3.0-Beta.md index 4cd4e693c..0cd6ff14a 100644 --- a/docs/release-notes/NuGet-3.0-Beta.md +++ b/docs/release-notes/NuGet-3.0-Beta.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 3.0 Beta including known issues, bug fixes, author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 3.0 Beta Release Notes diff --git a/docs/release-notes/NuGet-3.0-Preview.md b/docs/release-notes/NuGet-3.0-Preview.md index 9f1365d4f..00f990e0f 100644 --- a/docs/release-notes/NuGet-3.0-Preview.md +++ b/docs/release-notes/NuGet-3.0-Preview.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 3.0 Preview including known issues, bug fix author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 3.0 Preview Release Notes @@ -120,4 +120,4 @@ Between now and 3.0 RTM, we are also working on some fundamental new NuGet featu ## Stay Tuned -Please keep an eye on [our blog](https://blog.nuget.org) for more progress and announcements for NuGet 3.0! \ No newline at end of file +Please keep an eye on [our blog](https://blog.nuget.org) for more progress and announcements for NuGet 3.0! diff --git a/docs/release-notes/NuGet-3.0-RC.md b/docs/release-notes/NuGet-3.0-RC.md index eb1dc61eb..867f4269b 100644 --- a/docs/release-notes/NuGet-3.0-RC.md +++ b/docs/release-notes/NuGet-3.0-RC.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 3.0 RC including known issues, bug fixes, a author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 3.0 RC Release Notes @@ -37,4 +37,4 @@ We've made some changes to our [source code repositories on GitHub](https://gith ## Stay Tuned -Please keep an eye on [our blog](https://blog.nuget.org) for more progress and announcements for NuGet 3.0! \ No newline at end of file +Please keep an eye on [our blog](https://blog.nuget.org) for more progress and announcements for NuGet 3.0! diff --git a/docs/release-notes/NuGet-3.0-RC2.md b/docs/release-notes/NuGet-3.0-RC2.md index dad222238..193ae5190 100644 --- a/docs/release-notes/NuGet-3.0-RC2.md +++ b/docs/release-notes/NuGet-3.0-RC2.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 3.0 RC2 including known issues, bug fixes, author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 3.0 RC2 Release Notes @@ -31,4 +31,4 @@ In total, we closed 158 issues in this release, and you can review the [complete * [Improved error logging](https://github.com/NuGet/Home/issues/407) * [Improved powershell error messages when calling Update-Package](https://github.com/NuGet/Home/issues/5) -Download this ```[update to the NuGet extension](https://nuget.codeplex.com/releases/view/615507)``` from Codeplex and please keep an eye on [our blog](https://blog.nuget.org) for more progress and announcements for NuGet 3.0! \ No newline at end of file +Download this ```[update to the NuGet extension](https://nuget.codeplex.com/releases/view/615507)``` from Codeplex and please keep an eye on [our blog](https://blog.nuget.org) for more progress and announcements for NuGet 3.0! diff --git a/docs/release-notes/NuGet-3.0.0.md b/docs/release-notes/NuGet-3.0.0.md index 71c46bb49..a404510af 100644 --- a/docs/release-notes/NuGet-3.0.0.md +++ b/docs/release-notes/NuGet-3.0.0.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 3.0.0 including known issues, bug fixes, ad author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 3.0 Release Notes @@ -49,4 +49,4 @@ There were a number of known issues delivered with this release, and all of thes * [Multiple Packages can be gathered in parallel](https://github.com/NuGet/Home/issues/713) * [Removed install-package -force command](https://github.com/NuGet/Home/issues/697) -Please keep an eye on [our blog](https://blog.nuget.org) for more progress and announcements as we get ready to deliver support for Windows 10 development. \ No newline at end of file +Please keep an eye on [our blog](https://blog.nuget.org) for more progress and announcements as we get ready to deliver support for Windows 10 development. diff --git a/docs/release-notes/NuGet-3.1.1.md b/docs/release-notes/NuGet-3.1.1.md index 3331410e0..d755e1cd1 100644 --- a/docs/release-notes/NuGet-3.1.1.md +++ b/docs/release-notes/NuGet-3.1.1.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 3.1.1 including known issues, bug fixes, ad author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 3.1.1 Release Notes @@ -12,4 +12,4 @@ ms.topic: conceptual [NuGet 3.1 Release Notes](../release-notes/nuget-3.1.md) | [NuGet 3.2-RC Release Notes](../release-notes/nuget-3.2-RC.md) NuGet 3.1.1 was released July 27, 2015 as a patch update to the 3.1 VSIX with fix specific to a bug that effected Powershell policy implementation. -[https://github.com/NuGet/Home/issues/974](https://github.com/NuGet/Home/issues/974) \ No newline at end of file +[https://github.com/NuGet/Home/issues/974](https://github.com/NuGet/Home/issues/974) diff --git a/docs/release-notes/NuGet-3.1.md b/docs/release-notes/NuGet-3.1.md index aa7c025b9..db0f53466 100644 --- a/docs/release-notes/NuGet-3.1.md +++ b/docs/release-notes/NuGet-3.1.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 3.1 including known issues, bug fixes, adde author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 3.1 Release Notes diff --git a/docs/release-notes/NuGet-3.2-RC.md b/docs/release-notes/NuGet-3.2-RC.md index 0a398294f..28f9dd082 100644 --- a/docs/release-notes/NuGet-3.2-RC.md +++ b/docs/release-notes/NuGet-3.2-RC.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 3.2 RC including known issues, bug fixes, a author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 3.2 RC Release Notes @@ -111,4 +111,4 @@ A complete list of issues addressed for the Visual Studio extension can be found ## Known Issues -We continue to track issues on our GitHub issues list which can be found at: [https://github.com/nuget/home/issues](https://github.com/nuget/home/issues) \ No newline at end of file +We continue to track issues on our GitHub issues list which can be found at: [https://github.com/nuget/home/issues](https://github.com/nuget/home/issues) diff --git a/docs/release-notes/NuGet-3.2.1.md b/docs/release-notes/NuGet-3.2.1.md index 6e571888f..543ed8742 100644 --- a/docs/release-notes/NuGet-3.2.1.md +++ b/docs/release-notes/NuGet-3.2.1.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 3.2.1 including known issues, bug fixes, ad author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 3.2.1 Release Notes @@ -30,4 +30,4 @@ A complete list of issues addressed for the command-line and Visual Studio exten ## Known Issues -We continue to track issues on our GitHub issues list which can be found at: [https://github.com/nuget/home/issues](https://github.com/nuget/home/issues) \ No newline at end of file +We continue to track issues on our GitHub issues list which can be found at: [https://github.com/nuget/home/issues](https://github.com/nuget/home/issues) diff --git a/docs/release-notes/NuGet-3.2.md b/docs/release-notes/NuGet-3.2.md index 22ce6ecf1..48afecf3f 100644 --- a/docs/release-notes/NuGet-3.2.md +++ b/docs/release-notes/NuGet-3.2.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 3.2 including known issues, bug fixes, adde author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 3.2 Release Notes @@ -109,4 +109,4 @@ A complete list of issues addressed for the Visual Studio extension can be found ## Known Issues -We continue to track issues on our GitHub issues list which can be found at: [https://github.com/nuget/home/issues](https://github.com/nuget/home/issues) \ No newline at end of file +We continue to track issues on our GitHub issues list which can be found at: [https://github.com/nuget/home/issues](https://github.com/nuget/home/issues) diff --git a/docs/release-notes/NuGet-3.3.md b/docs/release-notes/NuGet-3.3.md index 4fd3580cc..f9e990a61 100644 --- a/docs/release-notes/NuGet-3.3.md +++ b/docs/release-notes/NuGet-3.3.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 3.3 including known issues, bug fixes, adde author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 3.3 Release Notes @@ -54,4 +54,4 @@ The list of issues fixed in the 3.3 command-line release are recorded in the [3. ## Known Issues -We continue to track issues on our GitHub issues list which can be found at: [https://github.com/nuget/home/issues](https://github.com/nuget/home/issues) \ No newline at end of file +We continue to track issues on our GitHub issues list which can be found at: [https://github.com/nuget/home/issues](https://github.com/nuget/home/issues) diff --git a/docs/release-notes/NuGet-3.4-RC.md b/docs/release-notes/NuGet-3.4-RC.md index 355733ecc..8e7e10089 100644 --- a/docs/release-notes/NuGet-3.4-RC.md +++ b/docs/release-notes/NuGet-3.4-RC.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 3.4 RC including known issues, bug fixes, a author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 3.4-RC Release Notes @@ -43,4 +43,4 @@ The following features are available in this RC, with more planned for the 3.4 f ## Known Issues -We continue to track issues on our GitHub issues list which can be found at: [https://github.com/nuget/home/issues](https://github.com/nuget/home/issues) \ No newline at end of file +We continue to track issues on our GitHub issues list which can be found at: [https://github.com/nuget/home/issues](https://github.com/nuget/home/issues) diff --git a/docs/release-notes/NuGet-3.4.1.md b/docs/release-notes/NuGet-3.4.1.md index 95b157b65..2d9ddc85f 100644 --- a/docs/release-notes/NuGet-3.4.1.md +++ b/docs/release-notes/NuGet-3.4.1.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 3.4.1 including known issues, bug fixes, ad author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 3.4.1 Release Notes @@ -19,4 +19,4 @@ NuGet 3.4.1 was released March 30, 2016 at the same time as the Visual Studio 20 * Corrected an issue with Visual Studio locating `lucene.net.dll` * All sources should not be the default repository source after a NuGet extension install or update. You can opt-in to this feature from the configuration settings. -We continue to track issues on our GitHub issues list which can be found at: [https://github.com/nuget/home/issues](https://github.com/nuget/home/issues) \ No newline at end of file +We continue to track issues on our GitHub issues list which can be found at: [https://github.com/nuget/home/issues](https://github.com/nuget/home/issues) diff --git a/docs/release-notes/NuGet-3.4.2.md b/docs/release-notes/NuGet-3.4.2.md index f1914888f..ace3e38a3 100644 --- a/docs/release-notes/NuGet-3.4.2.md +++ b/docs/release-notes/NuGet-3.4.2.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 3.4.2 including known issues, bug fixes, ad author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 3.4.2 Release Notes @@ -40,4 +40,4 @@ These issues will be fixed early next week before we hit RTM. * Running nuget delete command on a package using the V2 feed will fail. Use V3 feed instead. -For the complete list of fixes and improvements in this release, check out the list of issues [here](https://github.com/NuGet/Home/issues?utf8=%E2%9C%93&q=is%3Aissue+milestone%3A3.4.2++is%3Aclosed+). \ No newline at end of file +For the complete list of fixes and improvements in this release, check out the list of issues [here](https://github.com/NuGet/Home/issues?utf8=%E2%9C%93&q=is%3Aissue+milestone%3A3.4.2++is%3Aclosed+). diff --git a/docs/release-notes/NuGet-3.4.3.md b/docs/release-notes/NuGet-3.4.3.md index b190f78b9..0e1471ab6 100644 --- a/docs/release-notes/NuGet-3.4.3.md +++ b/docs/release-notes/NuGet-3.4.3.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 3.4.3 including known issues, bug fixes, ad author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 3.4.3 Release Notes @@ -27,4 +27,4 @@ You can download both the VSIX and nuget.exe [here](https://dist.nuget.org/index * Fixed an issue that caused restore failures in C++/CLI projects with `project.json`. * Some packages (E.g ModernHttpClient) where not being unzipped correctly when you use nuget in mono. This has now been fixed in this release. -For the complete list of fixes and improvements in this release, check out the list of issues [here](https://github.com/NuGet/Home/issues?q=is%3Aissue+milestone%3A3.4.3+is%3Aclosed). \ No newline at end of file +For the complete list of fixes and improvements in this release, check out the list of issues [here](https://github.com/NuGet/Home/issues?q=is%3Aissue+milestone%3A3.4.3+is%3Aclosed). diff --git a/docs/release-notes/NuGet-3.4.4.md b/docs/release-notes/NuGet-3.4.4.md index cd1396dd8..ac831086e 100644 --- a/docs/release-notes/NuGet-3.4.4.md +++ b/docs/release-notes/NuGet-3.4.4.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 3.4.4 including known issues, bug fixes, ad author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 3.4.4 Release Notes @@ -32,4 +32,4 @@ You can download both the VSIX and nuget.exe [here](https://dist.nuget.org/index - Updating `NuGet.Core.dll` version to 2.12.0 to fix XML issue [\#594](https://github.com/NuGet/NuGet.Client/pull/594) - Support ./NuGet.CommandLine.XPlat -v \ \ [\#593](https://github.com/NuGet/NuGet.Client/pull/593) - Display error restoring without `project.json` or `packages.config` [\#590](https://github.com/NuGet/NuGet.Client/pull/590) -- Fixing dependency versions when required versions differ [\#559](https://github.com/NuGet/NuGet.Client/pull/559) \ No newline at end of file +- Fixing dependency versions when required versions differ [\#559](https://github.com/NuGet/NuGet.Client/pull/559) diff --git a/docs/release-notes/NuGet-3.4.md b/docs/release-notes/NuGet-3.4.md index 3d94ced51..a9e55c5df 100644 --- a/docs/release-notes/NuGet-3.4.md +++ b/docs/release-notes/NuGet-3.4.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 3.4 including known issues, bug fixes, adde author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 3.4 Release Notes @@ -61,4 +61,4 @@ Custom NuGet repositories that redirect requests to an alternative host do not h * **Workaround:** To work around this issue, configure the package repository URI in settings to point to the redirected server location. For more information, see [GitHub pull request #387](https://github.com/NuGet/NuGet.Client/pull/387). -We continue to track issues on our GitHub issues list which can be found at: [https://github.com/nuget/home/issues](https://github.com/nuget/home/issues) \ No newline at end of file +We continue to track issues on our GitHub issues list which can be found at: [https://github.com/nuget/home/issues](https://github.com/nuget/home/issues) diff --git a/docs/release-notes/NuGet-3.5-Beta.md b/docs/release-notes/NuGet-3.5-Beta.md index 01d3d6877..5d69352d7 100644 --- a/docs/release-notes/NuGet-3.5-Beta.md +++ b/docs/release-notes/NuGet-3.5-Beta.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 3.5 Beta including known issues, bug fixes, author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 3.5 Beta Release Notes @@ -23,4 +23,4 @@ NuGet 3.5 Beta is a superset of the changes introduced in the 3.4.3 release. For ## Fixes -* The list of fixes and improvements in this release, is given [here](https://github.com/NuGet/Home/issues?q=is%3Aissue+milestone%3A%223.5+Beta%22+is%3Aclosed). \ No newline at end of file +* The list of fixes and improvements in this release, is given [here](https://github.com/NuGet/Home/issues?q=is%3Aissue+milestone%3A%223.5+Beta%22+is%3Aclosed). diff --git a/docs/release-notes/NuGet-3.5-Beta2.md b/docs/release-notes/NuGet-3.5-Beta2.md index 23b01454d..7cf76b2cb 100644 --- a/docs/release-notes/NuGet-3.5-Beta2.md +++ b/docs/release-notes/NuGet-3.5-Beta2.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 3.5 Beta 2 including known issues, bug fixe author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 3.5 Beta2 Release Notes @@ -85,4 +85,4 @@ NuGet 3.5 Beta 2 RTM was released June 27, 2016 for Visual Studio 2013 and nuget * Print out nuget.exe version header in detailed output - [#1887](https://github.com/NuGet/Home/issues/1887) -* NuGet should add support for /runtimes/{rid}/nativeassets/{txm}/ - [#2782](https://github.com/NuGet/Home/issues/2782) \ No newline at end of file +* NuGet should add support for /runtimes/{rid}/nativeassets/{txm}/ - [#2782](https://github.com/NuGet/Home/issues/2782) diff --git a/docs/release-notes/NuGet-3.5-RC.md b/docs/release-notes/NuGet-3.5-RC.md index e7b46f94e..b3bd58ed8 100644 --- a/docs/release-notes/NuGet-3.5-RC.md +++ b/docs/release-notes/NuGet-3.5-RC.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 3.5 RC including known issues, bug fixes, a author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 3.5 RC Release Notes diff --git a/docs/release-notes/NuGet-3.5-RTM.md b/docs/release-notes/NuGet-3.5-RTM.md index e9a8ca006..3301d1b2a 100644 --- a/docs/release-notes/NuGet-3.5-RTM.md +++ b/docs/release-notes/NuGet-3.5-RTM.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 3.5 including known issues, bug fixes, adde author: JonDouglas ms.author: jodou ms.date: 11/11/2016 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 3.5 Release Notes diff --git a/docs/release-notes/NuGet-4.0-RC.md b/docs/release-notes/NuGet-4.0-RC.md index 759cbd418..cfeb207ad 100644 --- a/docs/release-notes/NuGet-4.0-RC.md +++ b/docs/release-notes/NuGet-4.0-RC.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 4.0 RC including known issues, bug fixes, a author: JonDouglas ms.author: jodou ms.date: 02/03/2017 -ms.topic: conceptual +ms.topic: release-notes ms.reviewer: ananguar --- diff --git a/docs/release-notes/NuGet-4.0-RTM.md b/docs/release-notes/NuGet-4.0-RTM.md index cea4530b9..7fd345079 100644 --- a/docs/release-notes/NuGet-4.0-RTM.md +++ b/docs/release-notes/NuGet-4.0-RTM.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 4.0 RTM including known issues, bug fixes, author: anangaur ms.author: anangaur ms.date: 03/03/2017 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 4.0 RTM Release Notes diff --git a/docs/release-notes/NuGet-4.3-RTM.md b/docs/release-notes/NuGet-4.3-RTM.md index aa9e7702b..9700bea1a 100644 --- a/docs/release-notes/NuGet-4.3-RTM.md +++ b/docs/release-notes/NuGet-4.3-RTM.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 4.3 RTM including known issues, bug fixes, author: JonDouglas ms.author: jodou ms.date: 08/14/2017 -ms.topic: conceptual +ms.topic: release-notes ms.reviewer: anangaur --- diff --git a/docs/release-notes/NuGet-4.4-RTM.md b/docs/release-notes/NuGet-4.4-RTM.md index da36710c4..a06c05f27 100644 --- a/docs/release-notes/NuGet-4.4-RTM.md +++ b/docs/release-notes/NuGet-4.4-RTM.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 4.4 RTM including known issues, bug fixes, author: JonDouglas ms.author: jodou ms.date: 08/14/2017 -ms.topic: conceptual +ms.topic: release-notes ms.reviewer: anangaur --- diff --git a/docs/release-notes/NuGet-4.5-RTM.md b/docs/release-notes/NuGet-4.5-RTM.md index 507e183f7..7acc5f0b1 100644 --- a/docs/release-notes/NuGet-4.5-RTM.md +++ b/docs/release-notes/NuGet-4.5-RTM.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 4.5 RTM including known issues, bug fixes, author: anangaur ms.author: anangaur ms.date: 12/4/2017 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 4.5 Release Notes diff --git a/docs/release-notes/NuGet-4.6-rtm.md b/docs/release-notes/NuGet-4.6-rtm.md index b1e089539..ce8438c4c 100644 --- a/docs/release-notes/NuGet-4.6-rtm.md +++ b/docs/release-notes/NuGet-4.6-rtm.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 4.6.0 including known issues, bug fixes, ad author: anangaur ms.author: anangaur ms.date: 3/7/2018 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 4.6 Release Notes diff --git a/docs/release-notes/NuGet-4.7-RTM.md b/docs/release-notes/NuGet-4.7-RTM.md index 4a189d084..a43b5ab53 100644 --- a/docs/release-notes/NuGet-4.7-RTM.md +++ b/docs/release-notes/NuGet-4.7-RTM.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 4.7.0 including known issues, bug fixes, ad author: JonDouglas ms.author: jodou ms.date: 5/14/2018 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 4.7 Release Notes diff --git a/docs/release-notes/NuGet-4.8-RTM.md b/docs/release-notes/NuGet-4.8-RTM.md index 56896037f..1fef31ac9 100644 --- a/docs/release-notes/NuGet-4.8-RTM.md +++ b/docs/release-notes/NuGet-4.8-RTM.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 4.8.1 including known issues, bug fixes, ad author: JonDouglas ms.author: jodou ms.date: 5/14/2018 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 4.8 Release Notes diff --git a/docs/release-notes/NuGet-4.9-RTM.md b/docs/release-notes/NuGet-4.9-RTM.md index 04951f3ef..fd729e748 100644 --- a/docs/release-notes/NuGet-4.9-RTM.md +++ b/docs/release-notes/NuGet-4.9-RTM.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 4.9 including known issues, bug fixes, new author: JonDouglas ms.author: jodou ms.date: 11/20/2018 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 4.9 Release Notes diff --git a/docs/release-notes/NuGet-5.0-RTM.md b/docs/release-notes/NuGet-5.0-RTM.md index 6c49464ad..bd75b0597 100644 --- a/docs/release-notes/NuGet-5.0-RTM.md +++ b/docs/release-notes/NuGet-5.0-RTM.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 5.0 including known issues, bug fixes, new author: JonDouglas ms.author: jodou ms.date: 04/02/2019 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 5.0 Release Notes @@ -167,4 +167,4 @@ Disable the usage of the fallback folder by setting the `RestoreAdditionalProjec `` -Use this with caution as packages that would be restored from the fallback folder will now be downloaded from NuGet.org. \ No newline at end of file +Use this with caution as packages that would be restored from the fallback folder will now be downloaded from NuGet.org. diff --git a/docs/release-notes/NuGet-5.1-RTM.md b/docs/release-notes/NuGet-5.1-RTM.md index b661d0365..1f04bff82 100644 --- a/docs/release-notes/NuGet-5.1-RTM.md +++ b/docs/release-notes/NuGet-5.1-RTM.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 5.1 including new features, bug fixes, and author: JonDouglas ms.author: jodou ms.date: 05/21/2019 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 5.1 Release Notes diff --git a/docs/release-notes/NuGet-5.10.md b/docs/release-notes/NuGet-5.10.md index d8018de5b..e83d28fa6 100644 --- a/docs/release-notes/NuGet-5.10.md +++ b/docs/release-notes/NuGet-5.10.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 5.10 including new features, bug fixes, and author: zkat ms.author: kmarchan ms.date: 6/11/2021 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 5.10 Release Notes diff --git a/docs/release-notes/NuGet-5.11.md b/docs/release-notes/NuGet-5.11.md index 615c7c535..dd8f31249 100644 --- a/docs/release-notes/NuGet-5.11.md +++ b/docs/release-notes/NuGet-5.11.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 5.11 including new features, bug fixes, and author: erdembayar ms.author: eryondon ms.date: 8/10/2021 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 5.11 Release Notes diff --git a/docs/release-notes/NuGet-5.2-RTM.md b/docs/release-notes/NuGet-5.2-RTM.md index f02714365..a57435a9c 100644 --- a/docs/release-notes/NuGet-5.2-RTM.md +++ b/docs/release-notes/NuGet-5.2-RTM.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 5.2 including new features, bug fixes, and author: JonDouglas ms.author: jodou ms.date: 07/23/2019 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 5.2 Release Notes diff --git a/docs/release-notes/NuGet-5.3.md b/docs/release-notes/NuGet-5.3.md index 6bbf19858..6559e3454 100644 --- a/docs/release-notes/NuGet-5.3.md +++ b/docs/release-notes/NuGet-5.3.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 5.3 including new features, bug fixes, and author: JonDouglas ms.author: jodou ms.date: 09/06/2019 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 5.3 Release Notes diff --git a/docs/release-notes/NuGet-5.4.md b/docs/release-notes/NuGet-5.4.md index 7e49fe0e6..9c8251328 100644 --- a/docs/release-notes/NuGet-5.4.md +++ b/docs/release-notes/NuGet-5.4.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 5.4 including new features, bug fixes, and author: JonDouglas ms.author: jodou ms.date: 09/06/2019 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 5.4 Release Notes diff --git a/docs/release-notes/NuGet-5.5.md b/docs/release-notes/NuGet-5.5.md index 67fdbc22f..8c51128bc 100644 --- a/docs/release-notes/NuGet-5.5.md +++ b/docs/release-notes/NuGet-5.5.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 5.5 including new features, bug fixes, and author: JonDouglas ms.author: jodou ms.date: 03/19/2020 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 5.5 Release Notes diff --git a/docs/release-notes/NuGet-5.6.md b/docs/release-notes/NuGet-5.6.md index be2dc0ce2..696fb3493 100644 --- a/docs/release-notes/NuGet-5.6.md +++ b/docs/release-notes/NuGet-5.6.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 5.6 including new features, bug fixes, and author: nkolev92 ms.author: nikolev ms.date: 05/19/2020 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 5.6 Release Notes diff --git a/docs/release-notes/NuGet-5.7.md b/docs/release-notes/NuGet-5.7.md index af334fa98..ee702a83b 100644 --- a/docs/release-notes/NuGet-5.7.md +++ b/docs/release-notes/NuGet-5.7.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 5.7 including new features, bug fixes, and author: nkolev92 ms.author: nikolev ms.date: 8/14/2020 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 5.7 Release Notes diff --git a/docs/release-notes/NuGet-5.8.md b/docs/release-notes/NuGet-5.8.md index 5ed41c6d0..837149983 100644 --- a/docs/release-notes/NuGet-5.8.md +++ b/docs/release-notes/NuGet-5.8.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 5.8 including new features, bug fixes, and author: JonDouglas ms.author: jodou ms.date: 11/9/2020 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 5.8 Release Notes diff --git a/docs/release-notes/NuGet-5.9.md b/docs/release-notes/NuGet-5.9.md index 57582f302..f10019cf8 100644 --- a/docs/release-notes/NuGet-5.9.md +++ b/docs/release-notes/NuGet-5.9.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 5.9 including new features, bug fixes, and author: erdembayar ms.author: eryondon ms.date: 3/11/2021 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 5.9 Release Notes diff --git a/docs/release-notes/NuGet-6.0.md b/docs/release-notes/NuGet-6.0.md index d45a359f9..5de5d1544 100644 --- a/docs/release-notes/NuGet-6.0.md +++ b/docs/release-notes/NuGet-6.0.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 6.0 including new features, bug fixes, and author: zkat ms.author: kmarchan ms.date: 10/7/2021 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 6.0 Release Notes diff --git a/docs/release-notes/NuGet-6.1.md b/docs/release-notes/NuGet-6.1.md index 242741db9..9ae87e416 100644 --- a/docs/release-notes/NuGet-6.1.md +++ b/docs/release-notes/NuGet-6.1.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 6.1 including new features, bug fixes, and author: zivkan ms.author: zivkan ms.date: 2/15/2022 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 6.1 Release Notes diff --git a/docs/release-notes/NuGet-6.10.md b/docs/release-notes/NuGet-6.10.md index 5486c9908..cdc222c9d 100644 --- a/docs/release-notes/NuGet-6.10.md +++ b/docs/release-notes/NuGet-6.10.md @@ -3,7 +3,7 @@ title: NuGet 6.10 Release Notes description: Release notes for NuGet 6.10 including new features, bug fixes, and DCRs. author: kartheekp-ms ms.date: 5/13/2024 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 6.10 Release Notes @@ -12,10 +12,30 @@ NuGet distribution vehicles: | NuGet version | Available in Visual Studio version | Available in .NET SDK(s) | |:---|:---|:---| -| [**6.10**](https://nuget.org/downloads) | [Visual Studio 2022 version 17.10](https://visualstudio.microsoft.com/downloads/) | [8.0.3xx](https://dotnet.microsoft.com/download/dotnet/8.0)1 | +| [**6.10.2**](https://nuget.org/downloads) | [Visual Studio 2022 version 17.10](https://visualstudio.microsoft.com/downloads/) | [8.0.3xx](https://dotnet.microsoft.com/download/dotnet/8.0)1 | 1 Installed with Visual Studio 2022 with any .NET workload +## Summary: What's New in 6.10.2 + +### Issues fixed in this release + +* Revert Enable central package management implicitly when Directory.Packages.props exists - [#11834](https://github.com/NuGet/Home/issues/11834) + +[List of commits in this release](https://github.com/NuGet/NuGet.Client/compare/6.10.1.5...6.10.2.8) + +1 Installed with Visual Studio 2022 with any .NET workload + +## Summary: What's New in 6.10.1 + +### Issues fixed in this release + +* Visual Studio and PMC restore/update fails when multiple packages.config projects in the solution share the same name (An item with the same key has already been added) - [#13465](https://github.com/NuGet/Home/issues/13465) + +* ##[error]The nuget command failed with exit code(1) and error(An item with the same key has already been added. - [#13456](https://github.com/NuGet/Home/issues/13456) + +[List of commits in this release](https://github.com/NuGet/NuGet.Client/compare/6.10.0.97...6.10.1.5) + ## Summary: What's New in 6.10 * [Feature]: add dotnet nuget config command - [#12469](https://github.com/NuGet/Home/issues/12469) @@ -28,6 +48,21 @@ NuGet distribution vehicles: * dotnet list package --vulnerable requires constant login to 3rd party nuget feed - [#12456](https://github.com/NuGet/Home/issues/12456) +### 6.10.0 Known issues + +NuGet.exe 6.10.0 and Visual Studio 17.10.0 may have failures during NuGet operations for projects using packages.config under the following scenarios: + +* Two or more projects in the solution have the same name +* Two or more projects in the solution use the same packages.config file (the project files exist in the same directory) + +These issues have been fixed in NuGet.exe 6.10.1 and Visual Studio 17.10.2. + +Public tracking issues and discussions can be found in the following locations: + +* [Cannot nuget restore after updating visual studio community to 17.10.0. An item with the same key has already been added.](https://developercommunity.visualstudio.com/t/Cannot-nuget-restore-after-updating-visu/10665602) +* [Visual Studio and PMC restore/update fails when multiple packages.config projects in the solution share the same name (An item with the same key has already been added)](https://github.com/NuGet/Home/issues/13465) +* [##[error]The nuget command failed with exit code(1) and error(An item with the same key has already been added.](https://github.com/NuGet/Home/issues/13456) + ### Breaking changes * Add nullable annotations to NuGet.Configuration - [#13250](https://github.com/NuGet/Home/issues/13250) @@ -38,6 +73,8 @@ NuGet distribution vehicles: * [DCR]: Central Package Management - Respect .props file as a way to opt-in to the feature. - [#11834](https://github.com/NuGet/Home/issues/11834) +* Remove NuGet.Packaging.Core - [#12495](https://github.com/NuGet/Home/issues/12495) + ### Issues fixed in this release * Warn when vulnerabilities are detected during packages.config restore in CLI scenarios. - [#13253](https://github.com/NuGet/Home/issues/13253) @@ -174,4 +211,4 @@ Thank you to all the contributors who helped make this NuGet release awesome! * [5673](https://github.com/NuGet/NuGet.Client/pull/5673) Enable publishing in VMR * [5625](https://github.com/NuGet/NuGet.Client/pull/5625) Eliminate System.CommandLine prebuilt package * [brianrob](https://github.com/NuGet/NuGet.Client/pull/5650) - * [5650](https://github.com/NuGet/NuGet.Client/pull/5650) Add Restore Instrumentation \ No newline at end of file + * [5650](https://github.com/NuGet/NuGet.Client/pull/5650) Add Restore Instrumentation diff --git a/docs/release-notes/NuGet-6.11.md b/docs/release-notes/NuGet-6.11.md new file mode 100644 index 000000000..0e74cce77 --- /dev/null +++ b/docs/release-notes/NuGet-6.11.md @@ -0,0 +1,107 @@ +--- +title: NuGet 6.11 Release Notes +description: Release notes for NuGet 6.11 including new features, bug fixes, and DCRs. +author: martinrrm +ms.date: 8/13/2024 +ms.topic: release-notes +--- +# NuGet 6.11 Release Notes + +NuGet distribution vehicles: + +| NuGet version | Available in Visual Studio version | Available in .NET SDK(s) | +|:---|:---|:---| +| [**6.11**](https://nuget.org/downloads) | [Visual Studio 2022 version 17.11](https://visualstudio.microsoft.com/downloads/) | [8.0.4xx](https://dotnet.microsoft.com/download/dotnet/8.0)1 | + +1 Installed with Visual Studio 2022 with any .NET workload + +## Summary: What's New in 6.11.1 + +### Issues fixed in this release + +* Fix "multiple attempts to download the nupkg have failed" - [#13545](https://github.com/NuGet/Home/issues/13545) + +[List of commits in this release](https://github.com/NuGet/NuGet.Client/compare/6.11.0.122...6.11.1.2) + +## Summary: What's New in 6.11 + +* Suppress NuGetAudit warnings for specific advisories for PackageReference projects - [#13679](https://github.com/NuGet/Home/issues/13679) + +* Add `--allow-insecure-connections` option to dotnet SDK - [#13396](https://github.com/NuGet/Home/issues/13396) + +* Swap authors for owners in Visual Studio Package Manager UI - [#12501](https://github.com/NuGet/Home/issues/12501) + +* [Feature]: add dotnet nuget why to dotnet CLI - [#11943](https://github.com/NuGet/Home/issues/11943) + +* NuGet cannot restore from HTTPS sources that have SSL certificate problems - [#4387](https://github.com/NuGet/Home/issues/4387) + +### Breaking changes + +* `MSBuildRestoreUtility.GetRestoreAuditProperties` needs a breaking change to read `NuGetAuditSuppress` items - [#13313](https://github.com/NuGet/Home/issues/13313) + +### Issues fixed in this release + +* IVsNuGetProjectUpdateEvents.ProjectUpdateStarted or ProjectUpdateFinished should only provide a list of files that will get changed. - [#13413](https://github.com/NuGet/Home/issues/13413) + +* `dotnet nuget` commands should not output usage information on all errors - [#13251](https://github.com/NuGet/Home/issues/13251) + +* [DCR]: NuGet causes many ArgumentExceptions to be thrown & caught in VS - [#11535](https://github.com/NuGet/Home/issues/11535) + +* Remove .NET Framework TFM from NuGet.CommandLine.XPlat - [#8452](https://github.com/NuGet/Home/issues/8452) + +* PERF: GetPackageInfo allocates by unnecessarily calling GetNupkgMetadataPath - [#13556](https://github.com/NuGet/Home/issues/13556) + +* 'dotnet nuget why' crashes when using --framework option - [#13547](https://github.com/NuGet/Home/issues/13547) + +* SignatureUtility.GetCertificates in NuGet.Client can skip calling Dispose on error - [#13535](https://github.com/NuGet/Home/issues/13535) + +* 'dotnet nuget why' does not work when a directory is provided for the 'Path' argument - [#13527](https://github.com/NuGet/Home/issues/13527) + +* NuGet IntelliCode Package Suggestions are missing Author in packages list - [#13515](https://github.com/NuGet/Home/issues/13515) + +* Rebuilding in VS causes unnecessary restores - [#13505](https://github.com/NuGet/Home/issues/13505) + +* MSB4181: The "Restore Task" task returned false but did not log an error. - [#13460](https://github.com/NuGet/Home/issues/13460) + +* TaskResultCache incorrectly shares the same lock object for all the keys. - [#13448](https://github.com/NuGet/Home/issues/13448) + +* Calls to CompareTo and Equals should not allocate - [#13442](https://github.com/NuGet/Home/issues/13442) + +* Enable Nullable and throw in KnownOwnerViewModel - [#13425](https://github.com/NuGet/Home/issues/13425) + +* `PackageSourceProvider.UpdatePackageSource` doesn't respect a value from `disableTLSCertificateValidation` attribute - [#13423](https://github.com/NuGet/Home/issues/13423) + +* `PackageSourceProvider.UpdatePackageSource` doesn't respect a value from `AllowInsecureConnection` field - [#13418](https://github.com/NuGet/Home/issues/13418) + +* "nuget install -ExcludeVersion" inaccurate reports "already installed" when trying to install older version - [#13334](https://github.com/NuGet/Home/issues/13334) + +* Vulnerability InfoBar remains visible in the Solution Explorer after closing solution - [#13055](https://github.com/NuGet/Home/issues/13055) + +[List of commits in this release](https://github.com/NuGet/NuGet.Client/compare/6.10.1.5...6.11.0.122) + +### Community contributions + +Thank you to all the contributors who helped make this NuGet release awesome! + +* [seclerp](https://github.com/seclerp) + * [5783](https://github.com/NuGet/NuGet.Client/pull/5783) Fix `PackageSourceProvider.UpdatePackageSource` doesn't respect a value from `DisableTLSCertificateValidation` field + * [5767](https://github.com/NuGet/NuGet.Client/pull/5767) Fix `PackageSourceProvider.UpdatePackageSource` doesn't respect a value from `AllowInsecureConnection` field +* [mmitche](https://github.com/mmitche) + * [5749](https://github.com/NuGet/NuGet.Client/pull/5749) Build NuGet from the VMR + * [5752](https://github.com/NuGet/NuGet.Client/pull/5752) Fixup signing support conditional +* [ToddGrun](https://github.com/ToddGrun) + * [5859](https://github.com/NuGet/NuGet.Client/pull/5859) Reduce allocations in GetPackageInfo by conditionally calling GetNupkgMetadataPath +* [omajid](https://github.com/omajid) + * [5848](https://github.com/NuGet/NuGet.Client/pull/5848) Dispose certificates on failure in SignatureUtility.GetCertificates +* [SimonCropp](https://github.com/SimonCropp) + * [5842](https://github.com/NuGet/NuGet.Client/pull/5842) remove redundant .GetTypeInfo() +* [ryanmolden](https://github.com/ryanmolden) + * [5834](https://github.com/NuGet/NuGet.Client/pull/5834) Eliminate first-chance ArgumentExceptions when querying a legacy project for properties that don't exist via DTE +* [hickford](https://github.com/hickford) + * [5743](https://github.com/NuGet/NuGet.Client/pull/5743) Correct message in the case that a higher version of package is already installed +* [ViktorHofer](https://github.com/ViktorHofer) + * [5764](https://github.com/NuGet/NuGet.Client/pull/5764) Use .NET SDK sourcelink integration +* [NikolaMilosavljevic](https://github.com/NikolaMilosavljevic) + * [5738](https://github.com/NuGet/NuGet.Client/pull/5738) Disable CA2022 errors +* [jv42](https://github.com/jv42) + * [5717](https://github.com/NuGet/NuGet.Client/pull/5717) Fixed NullReferenceException in ResolverComparer diff --git a/docs/release-notes/NuGet-6.12.md b/docs/release-notes/NuGet-6.12.md new file mode 100644 index 000000000..51c3c9702 --- /dev/null +++ b/docs/release-notes/NuGet-6.12.md @@ -0,0 +1,181 @@ +--- +title: NuGet 6.12 Release Notes +description: Release notes for NuGet 6.12 including new features, bug fixes, and DCRs. +author: zivkan +ms.topic: release-notes +--- + +# NuGet 6.12 Release Notes + +> [!NOTE] +> In response to developers' feedback to ensure builds continuity when updating to .NET SDK 9, we have reverted the default value of NuGetAuditMode to `direct` in Visual Studio 17.12.3 and .NET 9.0.101. + +NuGet distribution vehicles: + +| NuGet version | Available in Visual Studio version | Available in .NET SDK(s) | +|:---|:---|:---| +| [**6.12**](https://nuget.org/downloads) | [Visual Studio 2022 version 17.12](https://visualstudio.microsoft.com/downloads/) | [9.0.1xx](https://dotnet.microsoft.com/download/dotnet/9.0)1 | +| [**6.12.4**](https://nuget.org/downloads) | [Visual Studio 2022 version 17.12.8](https://visualstudio.microsoft.com/downloads/) | [9.0.106](https://dotnet.microsoft.com/download/dotnet/9.0)1 | + +1 Installed with Visual Studio 2022 with any .NET workload + +## Known Issues + +* Project and package in the same graph with the same name but different dependencies may lead to incorrect versions of the dependencies of that id [#13888](https://github.com/NuGet/Home/issues/13888) +* VS PM UI shows warning icon about package vulnerability even after upgrade [#13866](https://github.com/NuGet/Home/issues/13866) +* dotnet nuget why reports missing argument, even though it ran [#13908](https://github.com/NuGet/Home/issues/13908) + +## Summary: What's New in 6.12.4 + +NuGet 6.12.4 is available in Visual Studio 17.12.8. + +### Issues fixed in this release + +* Restore should fail more quickly when using http sources - [#14210](https://github.com/NuGet/Home/issues/14210) + +## Summary: What's New in 6.12.3 + +NuGet 6.12.3 is available in Visual Studio 17.12.4. + +### Issues fixed in this release + +* Small Solution PM UI size can cause a System.ArgumentException SolutionView.ListView_SizeChanged - [#13928](https://github.com/NuGet/Home/issues/13928) + +## Summary: What's New in 6.12.1 + +NuGet 6.12.1 is available in Visual Studio 17.12.0 and the .NET 9.0.101 SDK. + +### Issues fixed in this release + +* Deserializing an empty version range in a package dependency fails in .NET SDK 9.0.100-rc.2 [#13869](https://github.com/NuGet/Home/issues/13869) + +## Summary: What's New in 6.12 + +NuGet 6.12.0 is available in the .NET 9.0.100 SDK. + +* Add new graph resolution algorithm for better performance with large graphs - [#13692](https://github.com/NuGet/Home/issues/13692) + +* NuGetAudit raises warnings for vulnerable transitive packages by default when the .NET 9 SDK is installed [#13293](https://github.com/NuGet/Home/issues/13293) + +* Change NuGetAuditMode default from direct to all, raising warnings for vulnerable transitive packages for non-SDK style projects - [#13584](https://github.com/NuGet/Home/issues/13584) + +* Audit security vulnerabilities without adding nuget.org as package source - [#12698](https://github.com/NuGet/Home/issues/12698) + +* Owner profile hyperlinks needed in Details Pane of PM UI - [#13686](https://github.com/NuGet/Home/issues/13686) + +* Deprecate SHA-1 fingerprints usage in NuGet Sign commands in favor of SHA-2 family fingerprints [#13891](https://github.com/NuGet/Home/issues/13891) + +* Bubble-up Known Vulnerability Indicators in Solution Explorer for Transitive Packages - [#13636](https://github.com/NuGet/Home/issues/13636) + +* Enable Transitive Dependencies and vulnerabilities for Solution-level in Visual Studio - [#13216](https://github.com/NuGet/Home/issues/13216) + +### Breaking changes + +* Deprecate http usage: Promote from warning to error - [#13289](https://github.com/NuGet/Home/issues/13289) + +### Issues fixed in this release + +* Enable `dotnet nuget why` on non-SDK style projects - [#13576](https://github.com/NuGet/Home/issues/13576) + +* NuGetAuditSuppress for packages.config - [#13575](https://github.com/NuGet/Home/issues/13575) + +* Roll-out new breaking change process for SDK tools, respect SdkAnalysisLevel - [#13309](https://github.com/NuGet/Home/issues/13309) + +* Add property for toggling the to the previous NuGet resolver: RestoreUseLegacyDependencyResolver - [#13700](https://github.com/NuGet/Home/issues/13700) + +* Reduce allocations in TokenSegment.TryMatch - [#12728](https://github.com/NuGet/Home/issues/12728) + +* Use `SDKAnalysisLevel` in restore "https everywhere: promote from warning to error" - [#13546](https://github.com/NuGet/Home/issues/13546) + +* tweak wording of NU1603 - [#13446](https://github.com/NuGet/Home/issues/13446) + +* Default Package icon shown even when embedded icon file exists on disk - [#13766](https://github.com/NuGet/Home/issues/13766) + +* Navigation telemetry for hyperlinks: License, ReportAbuse, Readme, ProjectUrl - [#13749](https://github.com/NuGet/Home/issues/13749) + +* Navigation telemetry for Owner Profile URLs in PM UI - [#13738](https://github.com/NuGet/Home/issues/13738) + +* PM UI should show transitive path - [#13574](https://github.com/NuGet/Home/issues/13574) + +* NuGetVersion should use a factory to intern parsed versions - [#13532](https://github.com/NuGet/Home/issues/13532) + +* Remove NuGet.Packaging.Core code - [#13385](https://github.com/NuGet/Home/issues/13385) + +* PM UI transitive dependencies should display all transitive dependencies, not just ones brought in through packages directly installed in a project - [#13060](https://github.com/NuGet/Home/issues/13060) + +* Remove deprecated field "owners" from VS UI Details Pane - [#10666](https://github.com/NuGet/Home/issues/10666) + +* "Value cannot be null; Parameter name: source" displays in error list when clicking installed tab in PM UI - [#13801](https://github.com/NuGet/Home/issues/13801) + +* New dependency resolver does not properly handle missing package versions when using CPM - [#13788](https://github.com/NuGet/Home/issues/13788) + +* Saving PackageManagementFormat throws Nullable object must have a value. - [#13773](https://github.com/NuGet/Home/issues/13773) + +* ProjectReference causing PM UI to error with "Value cannot be null. Parameter name: frameworkIdentifier" - [#13737](https://github.com/NuGet/Home/issues/13737) + +* LockFileUtils.CreateLockFileTargetProject allocates a lot - [#13712](https://github.com/NuGet/Home/issues/13712) + +* ConvertToProjectPaths causes extra allocations due to yield usage - [#13677](https://github.com/NuGet/Home/issues/13677) + +* dotnet add package with CPM installs a different version than what gets restored - [#13657](https://github.com/NuGet/Home/issues/13657) + +* `dotnet list package` does not work if project is using central package management system, after upgrading to `.NET 8.0` - [#13632](https://github.com/NuGet/Home/issues/13632) + +* Add a log code NuGetAuditSuppress duplicate items - [#13620](https://github.com/NuGet/Home/issues/13620) + +* Solution Explorer search can be broken by skipped dataflow updates - [#13619](https://github.com/NuGet/Home/issues/13619) + +* Add nullability declarations to ResolverUtility and RemoteWalkContext - [#13617](https://github.com/NuGet/Home/issues/13617) + +* Use of Obsolete X509Certificate2 ctor - [#13612](https://github.com/NuGet/Home/issues/13612) + +* nuget restore warnings can't be suppressed with NoWarn in Visual Studio - [#13571](https://github.com/NuGet/Home/issues/13571) + +* Restore may write nulls to project.assets.json - [#13563](https://github.com/NuGet/Home/issues/13563) + +* VS 17.10 - Error building projects with CPM explicitly enabled if ManagePackageVersionsCentrally is set to false in Directory.Build.props - [#13560](https://github.com/NuGet/Home/issues/13560) + +* PERF: Version and VersionRange allocations are very prevalent in profiles of Roslyn solution load - [#13559](https://github.com/NuGet/Home/issues/13559) + +* PERF: LockFileFormat is filled completely when common callers only need some of the data - [#13558](https://github.com/NuGet/Home/issues/13558) + +* PERF: Unnecessary construction of LockFileItem.Properties dictionary - [#13557](https://github.com/NuGet/Home/issues/13557) + +* Narator does not read the value of `allowInsecureConnections` - [#13555](https://github.com/NuGet/Home/issues/13555) + +* NuGet fails because of invalid characters in User-Agent header - [#13531](https://github.com/NuGet/Home/issues/13531) + +* 'why' and 'config' command does not show up in 'dotnet nuget --help' output - [#13517](https://github.com/NuGet/Home/issues/13517) + +* allocation: nuget.protocol.dll!NuGet.Protocol.HttpCacheUtility+<CreateCacheFileAsync>d__.MoveNext|nuget.protocol.dll!NuGet.Protocol.PackageDependencyGroupConverter.ReadJson - [#13445](https://github.com/NuGet/Home/issues/13445) + +* Reduce allocations in ContentItemCollection - [#12657](https://github.com/NuGet/Home/issues/12657) + +* When a source isn't accessible, service index cannot be read issues suppress the internal message making it difficult to understand the root cause - [#12530](https://github.com/NuGet/Home/issues/12530) + +* [Bug]: Extra space at start of package description in tooltip - [#12105](https://github.com/NuGet/Home/issues/12105) + +* Map branch name from sourcelink to RepositoryBranch for NuGet pack - [#13625](https://github.com/NuGet/Home/issues/13625) + +[List of commits in this release](https://github.com/NuGet/NuGet.Client/compare/6.12.1.1...6.11.1.2) + +### Community contributions + +Thank you to all the contributors who helped make this NuGet release awesome! + +* [akoeplinger](https://github.com/NuGet/NuGet.Client/pull/6005) + * [6005](https://github.com/NuGet/NuGet.Client/pull/6005) Improve build.sh and fixes for building on arm64 macOS + * [5956](https://github.com/NuGet/NuGet.Client/pull/5956) Add System.Formats.Asn1 into Version.Details.xml + * [5911](https://github.com/NuGet/NuGet.Client/pull/5911) Don't use obsolete X509Certificate2 constructor on net9.0 +* [ToddGrun](https://github.com/NuGet/NuGet.Client/pull/5862) + * [5862](https://github.com/NuGet/NuGet.Client/pull/5862) Reduce allocations for version / versionranges + * [5857](https://github.com/NuGet/NuGet.Client/pull/5857) Reduce memory allocations during solution load in VS + * [5861](https://github.com/NuGet/NuGet.Client/pull/5861) Defer LockFileItem.Properties dictionary construction until needed +* [KirillOsenkov](https://github.com/NuGet/NuGet.Client/pull/6008) + * [6008](https://github.com/NuGet/NuGet.Client/pull/6008) Always debug RestoreTask and RestoreEx when environment variable is set +* [vernou](https://github.com/NuGet/NuGet.Client/pull/5982) + * [5982](https://github.com/NuGet/NuGet.Client/pull/5982) Fix restore when a package is installed with a version specified in CPM +* [mthalman](https://github.com/NuGet/NuGet.Client/pull/5959) + * [5959](https://github.com/NuGet/NuGet.Client/pull/5959) Allow override of System.Formats.Asn1 package version +* [MattKotsenas](https://github.com/NuGet/NuGet.Client/pull/5923) + * [5923](https://github.com/NuGet/NuGet.Client/pull/5923) Map SourceBranchName from sourcelink to RepositoryBranch for NuGet pack diff --git a/docs/release-notes/NuGet-6.13.md b/docs/release-notes/NuGet-6.13.md new file mode 100644 index 000000000..1c09115b4 --- /dev/null +++ b/docs/release-notes/NuGet-6.13.md @@ -0,0 +1,136 @@ +--- +title: NuGet 6.13 Release Notes +description: Release notes for NuGet 6.13 including new features, bug fixes, and DCRs. +author: Nigusu-Allehu +ms.author: nyenework +ms.date: 2/4/2025 +ms.topic: release-notes +--- + +# NuGet 6.13 Release Notes + +NuGet distribution vehicles: + +| NuGet version | Available in Visual Studio version | Available in .NET SDK(s) | +|:---|:---|:---| +| [**6.13.0**](https://nuget.org/downloads) | N/A | [9.0.200](https://dotnet.microsoft.com/download/dotnet/9.0)1 | +| [**6.13.1**](https://nuget.org/downloads) | [Visual Studio 2022 version 17.13.0](https://visualstudio.microsoft.com/downloads/) | [9.0.201](https://dotnet.microsoft.com/download/dotnet/9.0)1 | +| [**6.13.2**](https://nuget.org/downloads) | [Visual Studio 2022 version 17.13.2](https://visualstudio.microsoft.com/downloads/) | [9.0.203](https://dotnet.microsoft.com/download/dotnet/9.0)1 | + +1 Installed with Visual Studio 2022 with any .NET workload + +## Summary: What's New in 6.13.2 + +* New restore dependency resolver fails when resolving identical child dependencies - [#14025](https://github.com/NuGet/Home/issues/14025) + +[List of commits in this release](https://github.com/NuGet/NuGet.Client/compare/6.13.1.3...6.13.2.1) + +## Summary: What's New in 6.13.1 + +NuGet 6.13.1 is available in Visual Studio 17.13 and .NET 9.0.201 SDK. + +* Support for new slnx solution format in dotnet nuget why and dotnet list package - [#14034](https://github.com/NuGet/Home/issues/14034) + +[List of commits in this release](https://github.com/NuGet/NuGet.Client/compare/6.13.0.113...6.13.1.3) + +## Summary: What's New in 6.13.0 + +NuGet 6.13.0 is available in the .NET 9.0.200 SDK. + +* Support for credential providers deployed via .NET tools - [#12567](https://github.com/NuGet/Home/issues/12567) + +* Opt-in feature: "Supplied by Platform", which removes packages that are supplied by the .NET platform from the dependency graph. This results in better performance and eliminates false positives for vulnerabilities in transitive dependencies. + +* dotnet nuget why should check RID specific packages - [#13718](https://github.com/NuGet/Home/issues/13718) + +* Allow specifying the msbuild binlog path when invoking static graph restore to avoid modifying the environment - [#10789](https://github.com/NuGet/Home/issues/10789) + +* New Dependency Resolver Fixes + + * New dependency resolver downloads more packages than before - [#13943](https://github.com/NuGet/Home/issues/13943) + + * New dependency resolver does not handle floating versions correctly in some situations - [#13992](https://github.com/NuGet/Home/issues/13992) + + * New dependency resolver erroneously reports NU1605 (downgrade) when using transitive pinning a direct dependency and a downgrade exists in a package graph - [#13938](https://github.com/NuGet/Home/issues/13938) + + * NuGet Restore restoring old versions of transitive dependencies when direct dependency does not have guidelines for user's targeted .NET Framework - [#13934](https://github.com/NuGet/Home/issues/13934) + + * Project and package in the same graph with the same name but different dependencies may lead to incorrect versions of the dependencies of that id - [#13888](https://github.com/NuGet/Home/issues/13888) + +* Package Manager UI in Visual Studio now shows embedded READMEs for NuGet packages, if available - [#12583](https://github.com/NuGet/Home/issues/12583) + +### Issues fixed in this release + +* Detect if restore used NuGetAudit or not for PackageReference projects - [#13778](https://github.com/NuGet/Home/issues/13778) + +* Add indicator for deprecated and vulnerable packages to Package Details tab header. - [#13974](https://github.com/NuGet/Home/issues/13974) + +* Navigation telemetry for 'Clear All NuGet Storage' Command in VS Settings - [#13968](https://github.com/NuGet/Home/issues/13968) + +* Nuget Package Manager for Solution automatically selects transitive dependencies - [#13893](https://github.com/NuGet/Home/issues/13893) + +* Debugging large repos with static graph-based restore is slow - [#13876](https://github.com/NuGet/Home/issues/13876) + +* NuGet Client SDK packages updating to net8.0 - [#13842](https://github.com/NuGet/Home/issues/13842) + +* Promote NU3043 warning to error in .NET 10 - [#13814](https://github.com/NuGet/Home/issues/13814) + +* Setting "Allow format selection on first package install" meaning is unclear - [#14016](https://github.com/NuGet/Home/issues/14016) + +* `dotnet nuget why` reports missing argument, even though it ran - [#13908](https://github.com/NuGet/Home/issues/13908) + +* Spacing adjustments in Details Pane Tabs - [#13880](https://github.com/NuGet/Home/issues/13880) + +* The focus border on the Details Pane Tab content is being truncated - [#13879](https://github.com/NuGet/Home/issues/13879) + +* JAWS is reading the entire contents of the Package Details Tab when first visiting it - [#13878](https://github.com/NuGet/Home/issues/13878) + +* ContentItemCollection.PopulateItemGroups unnecessarily allocates - [#13851](https://github.com/NuGet/Home/issues/13851) + +* Read and write .nupkg.metadata files with System.Text.Json - [#13835](https://github.com/NuGet/Home/issues/13835) + +* NuGet Fails in Containers When HOME Is Not Set - [#13834](https://github.com/NuGet/Home/issues/13834) + +* Signing: key not disposed - [#13823](https://github.com/NuGet/Home/issues/13823) + +* Walk TFMs in parallel when collecting pack outputs - [#13776](https://github.com/NuGet/Home/issues/13776) + +* PERF: NuGet Cloning operations are showing heavily in allocations during VS solution load - [#13647](https://github.com/NuGet/Home/issues/13647) + +* Fetching Vulnerability Resources doesn't respect cancellation - [#13644](https://github.com/NuGet/Home/issues/13644) + +* Wrong order of arguments in logs for centralized package version (string `Info_AddPkgCPM`) - [#13155](https://github.com/NuGet/Home/issues/13155) + +* Satellite assemblies for three-letter languages are not copied from NuGet package - [#12253](https://github.com/NuGet/Home/issues/12253) + +* Nuget pack doesn't support blank <version> in .nuspec even though version is passed on the command line - [#7987](https://github.com/NuGet/Home/issues/7987) + +[List of commits in this release](https://github.com/NuGet/NuGet.Client/compare/6.12.3.1...6.13.1.3) + +### Community contributions + +Thank you to all the contributors who helped make this NuGet release awesome! + +* [SimonCropp](https://github.com/NuGet/NuGet.Client/pull/6185) + * [6185](https://github.com/NuGet/NuGet.Client/pull/6185) reduce memory in ManifestMetadata + * [6168](https://github.com/NuGet/NuGet.Client/pull/6168) remove duplicate dictionary lookups + * [6166](https://github.com/NuGet/NuGet.Client/pull/6166) remove redundant Count() in GlobalPackageFolderRepositories + * [6165](https://github.com/NuGet/NuGet.Client/pull/6165) avoid Any call in GetCommandAttribute + * [6167](https://github.com/NuGet/NuGet.Client/pull/6167) remove redundant casts +* [baronfel](https://github.com/NuGet/NuGet.Client/pull/6124) + * [6124](https://github.com/NuGet/NuGet.Client/pull/6124) Expand Locale parser to support three-character language codes + * [6018](https://github.com/NuGet/NuGet.Client/pull/6018) Update _WalkEachTargetPerFramework to walk TFMs in parallel +* [ToddGrun](https://github.com/NuGet/NuGet.Client/pull/6098) + * [6098](https://github.com/NuGet/NuGet.Client/pull/6098) Modify ContentItemCollection.PopulateItemGroups to use pooling for highly allocated temporary data structures + * [5930](https://github.com/NuGet/NuGet.Client/pull/5930) Attempt to move several data structures to be immutable +* [mthalman](https://github.com/NuGet/NuGet.Client/pull/6212) + * [6212](https://github.com/NuGet/NuGet.Client/pull/6212) Fix formatting in GraphOperations +* [kasperk81](https://github.com/NuGet/NuGet.Client/pull/6072) + * [6072](https://github.com/NuGet/NuGet.Client/pull/6072) add SpecialFolder.UserProfile fallback +* [MichaelSimons](https://github.com/NuGet/NuGet.Client/pull/6102) + * [6102](https://github.com/NuGet/NuGet.Client/pull/6102) Update source-build team references +* [akoeplinger](https://github.com/NuGet/NuGet.Client/pull/6025) + * [6025](https://github.com/NuGet/NuGet.Client/pull/6025) Fix typo in EnhancedHttpRetryHelper.cs +* [jimmylewis](https://github.com/NuGet/NuGet.Client/pull/6027) + * [6027](https://github.com/NuGet/NuGet.Client/pull/6027) Refactor calls to EnsureVisualStudioHost() to a base [TestInitialize] method + diff --git a/docs/release-notes/NuGet-6.14.md b/docs/release-notes/NuGet-6.14.md new file mode 100644 index 000000000..d14104ce5 --- /dev/null +++ b/docs/release-notes/NuGet-6.14.md @@ -0,0 +1,131 @@ +--- +title: NuGet 6.14 Release Notes +description: Release notes for NuGet 6.14 including new features, bug fixes, and DCRs. +author: zivkan +ms.date: 5/6/2025 +ms.topic: release-notes +--- + +# NuGet 6.14 Release Notes + +NuGet distribution vehicles: + +| NuGet version | Available in Visual Studio version | Available in .NET SDK(s) | +|:---|:---|:---| +| [**6.14.0**](https://nuget.org/downloads) | [Visual Studio 2022 version 17.14.0](https://visualstudio.microsoft.com/downloads/) | [9.0.300](https://dotnet.microsoft.com/download/dotnet/9.0)1 | + +1 Installed with Visual Studio 2022 with any .NET workload + +## Summary: What's New in 6.14.0 + +* (preview feature) NuGet onboards to Unified Settings and create General page - [#14040](https://github.com/NuGet/Home/issues/14040) + +* Support for new `slnx` solution format - [#14034](https://github.com/NuGet/Home/issues/14034) + +* dotnet-nuget-push now supports --config-file - [#4879](https://github.com/NuGet/Home/issues/4879) + +* `dotnet list package --vulnerable` should support auditSources - [#13767](https://github.com/NuGet/Home/issues/13767) + +* [DCR]: Focus shifts from Output window to Error List after every package operation, even with no error or warnings - [#11728](https://github.com/NuGet/Home/issues/11728) + +### Issues fixed in this release + +* Event tracing in new dependency resolver - [#14134](https://github.com/NuGet/Home/issues/14134) + +* Support for new slnx format in static graph-based restore - [#14086](https://github.com/NuGet/Home/issues/14086) + +* Add Net90 to FrameworkConstants.CommonFrameworks - [#14067](https://github.com/NuGet/Home/issues/14067) + +* Don't show usage help when dotnet cli command throws unhandled exception - [#14200](https://github.com/NuGet/Home/issues/14200) + +* Multiple callers check for NuGet entries before calling Error List `BringToFrontIfSettingsPermitAsync` - [#14163](https://github.com/NuGet/Home/issues/14163) + +* NuGetAudit should report transitive packages with vulnerabilities when targeting .NET 10 or higher - [#14161](https://github.com/NuGet/Home/issues/14161) + +* Update README preview to render with same font size as Visual Studio - [#14112](https://github.com/NuGet/Home/issues/14112) + +* NU5100 (AssemblyOutsideLibWarning): Why build is allowed but buildTransitive is not? - [#14080](https://github.com/NuGet/Home/issues/14080) + +* Can't copy the text from NuGet package manager gold bar - [#14074](https://github.com/NuGet/Home/issues/14074) + +* NuGet 6.13.2.1 does no longer support prerelease versions - [#14219](https://github.com/NuGet/Home/issues/14219) + +* Badly specified framework leads to an uninformative error - [#14216](https://github.com/NuGet/Home/issues/14216) + +* Restore should fail more quickly when using http sources - [#14210](https://github.com/NuGet/Home/issues/14210) + +* README spins indefinitely if the Readme URI does not result in a readme - [#14201](https://github.com/NuGet/Home/issues/14201) + +* Error in Visual Studio if Path contains directory you do not have permission to view - [#14192](https://github.com/NuGet/Home/issues/14192) + +* list package doesn't work with a solution argument in 9.0.201 - [#14177](https://github.com/NuGet/Home/issues/14177) + +* Focus shifts from Output window to Error List after Clear NuGet Locals command - [#14157](https://github.com/NuGet/Home/issues/14157) + +* NuGet adding a bunch of generally unuseful information to VS activity log - [#14153](https://github.com/NuGet/Home/issues/14153) + +* NuGet authentication plug-in discovery fails when environment variable has trailing semicolon - [#14144](https://github.com/NuGet/Home/issues/14144) + +* nuget.exe fails to find Microsoft.VisualStudio.SolutionPersistence.dll - [#14136](https://github.com/NuGet/Home/issues/14136) + +* NuGet restore writes dgspec too frequently - [#14135](https://github.com/NuGet/Home/issues/14135) + +* dotnet list package does not display resolved versions when AuditSources are used - [#14116](https://github.com/NuGet/Home/issues/14116) + +* The REAMDE tab always shows “Loading README” for the latest version of the package in the detail panel of PM UI - [#14098](https://github.com/NuGet/Home/issues/14098) + +* [Bug Bash] The second time clicking ‘Installed’ tab for a remote source which doesn’t allow for downloading a README shows the README tab - [#14097](https://github.com/NuGet/Home/issues/14097) + +* HttpFileSystemBasedFindPackageByIdResource.ConsumeFlatContainerIndexAsync allocates significantly more than necessary - [#14095](https://github.com/NuGet/Home/issues/14095) + +* UnresolvedMessages.GetMessageAsync is allocating more heavily than necessary - [#14094](https://github.com/NuGet/Home/issues/14094) + +* New dependency resolver does not properly detect a cycle with a transitive dependency with the same name as the root project - [#14052](https://github.com/NuGet/Home/issues/14052) + +* dotnet nuget why does not give an error if only a project path was specified - [#14030](https://github.com/NuGet/Home/issues/14030) + +* Cleanup ServiceProviderExtensions, remove GetFreeThreadedServiceAsync - [#14007](https://github.com/NuGet/Home/issues/14007) + +* Value cannot be null. Parameter name: versionRange when opening the PM UI - [#13933](https://github.com/NuGet/Home/issues/13933) + +* Reenable new algorithm resolution with lock files with .NET 10 SDK - [#13800](https://github.com/NuGet/Home/issues/13800) + +* Report the path when unable to read corrupted .nupkg.metadata - [#13763](https://github.com/NuGet/Home/issues/13763) + +* [Bug Bash] The vulnerability InfoBar disappears in the Solution Explorer window after restoring packages for .NET SDK based project - [#13318](https://github.com/NuGet/Home/issues/13318) + +* Use System.Text.Json to read the cache file in CacheFileFormat - [#13059](https://github.com/NuGet/Home/issues/13059) + +* [Bug]: dotnet nuget push symbols not working as expected - [#11871](https://github.com/NuGet/Home/issues/11871) + +* nuget.exe restore fails when MSBuildPath ends with a slash - [#8634](https://github.com/NuGet/Home/issues/8634) + +* nuget.exe -msbuildpath c:\foo\msbuild.exe gives bad error experience - [#4195](https://github.com/NuGet/Home/issues/4195) + +* Address comments in `Implement Support for NuGet Authentication Plugins as .NET Tools` PR - [#13975](https://github.com/NuGet/Home/issues/13975) + +[List of commits in this release](https://github.com/NuGet/NuGet.Client/compare/6.13.2.1...6.14.0.116) + +### Community contributions + +Thank you to all the contributors who helped make this NuGet release awesome! + +* [ViktorHofer](https://github.com/NuGet/NuGet.Client/pull/6309) + * [6309](https://github.com/NuGet/NuGet.Client/pull/6309) Define MicrosoftVisualStudioSolutionPersistenceVersion property + * [6292](https://github.com/NuGet/NuGet.Client/pull/6292) Upgrade ProtectedData version when building source-only + * [6270](https://github.com/NuGet/NuGet.Client/pull/6270) Update dependencies and remove unused runtime dependencies + * [6261](https://github.com/NuGet/NuGet.Client/pull/6261) React to NuGet package pruning warnings +* [jkoritzinsky](https://github.com/NuGet/NuGet.Client/pull/6306) + * [6306](https://github.com/NuGet/NuGet.Client/pull/6306) Don't publish RID-agnostic nuget packages when we only want RID-specific artifacts + * [6233](https://github.com/NuGet/NuGet.Client/pull/6233) Use the documented Artifact extension point to add artifacts +* [ToddGrun](https://github.com/NuGet/NuGet.Client/pull/6294) + * [6294](https://github.com/NuGet/NuGet.Client/pull/6294) Reduce activity log output from VsSolutionRestoreService.NominateProjectAsync + * [6264](https://github.com/NuGet/NuGet.Client/pull/6264) Reduce allocations under UnresolvedMessages.GetMessageAsync +* [AlexDelepine](https://github.com/NuGet/NuGet.Client/pull/6338) + * [6338](https://github.com/NuGet/NuGet.Client/pull/6338) Update ngen Priorities for VS +* [mmitche](https://github.com/NuGet/NuGet.Client/pull/6305) + * [6305](https://github.com/NuGet/NuGet.Client/pull/6305) Set build number to arcade build revision for VMR builds +* [premun](https://github.com/NuGet/NuGet.Client/pull/6251) + * [6251](https://github.com/NuGet/NuGet.Client/pull/6251) Remove extra spaces in Publishing.props +* [baronfel](https://github.com/NuGet/NuGet.Client/pull/6219) + * [6219](https://github.com/NuGet/NuGet.Client/pull/6219) Use new serializer library to parse solution files diff --git a/docs/release-notes/NuGet-6.2.md b/docs/release-notes/NuGet-6.2.md index 1789b57db..dc09706ea 100644 --- a/docs/release-notes/NuGet-6.2.md +++ b/docs/release-notes/NuGet-6.2.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 6.2 including new features, bug fixes, and author: martinrrm ms.author: mruizmares ms.date: 5/9/2022 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 6.2 Release Notes diff --git a/docs/release-notes/NuGet-6.3.md b/docs/release-notes/NuGet-6.3.md index fef6084e8..8e9b5fb30 100644 --- a/docs/release-notes/NuGet-6.3.md +++ b/docs/release-notes/NuGet-6.3.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 6.3 including new features, bug fixes, and author: martinrrm ms.author: mruizmares ms.date: 8/2/2022 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 6.3 Release Notes @@ -127,4 +127,4 @@ NuGet distribution vehicles: * Transitive lock files (with wildcard) result in NU1004 - [#8465](https://github.com/NuGet/Home/issues/8465) -* Enhance the experimentation infrastructure in NuGet code to support transitive dependencies - [#10758](https://github.com/NuGet/Home/issues/10758) \ No newline at end of file +* Enhance the experimentation infrastructure in NuGet code to support transitive dependencies - [#10758](https://github.com/NuGet/Home/issues/10758) diff --git a/docs/release-notes/NuGet-6.4.md b/docs/release-notes/NuGet-6.4.md index 0693d8d2e..ffbcdc7d9 100644 --- a/docs/release-notes/NuGet-6.4.md +++ b/docs/release-notes/NuGet-6.4.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 6.4 including new features, bug fixes, and author: jebriede ms.author: jebriede ms.date: 10/27/2022 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 6.4 Release Notes diff --git a/docs/release-notes/NuGet-6.5.md b/docs/release-notes/NuGet-6.5.md index 503095188..8ee257234 100644 --- a/docs/release-notes/NuGet-6.5.md +++ b/docs/release-notes/NuGet-6.5.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 6.5 including new features, bug fixes, and author: martinrrm ms.author: mruizmares ms.date: 2/21/2023 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 6.5 Release Notes @@ -124,4 +124,4 @@ Thank you to all the contributors who helped make this NuGet release awesome! * [davidegiacometti](https://github.com/davidegiacometti) * [4840](https://github.com/NuGet/NuGet.Client/pull/4840) Refactor PackageDependencyGroup Equals and GetHashCode * [danjagnow](https://github.com/danjagnow) - * [4843](https://github.com/NuGet/NuGet.Client/pull/4843) Updated NU1012 error message to display item paths \ No newline at end of file + * [4843](https://github.com/NuGet/NuGet.Client/pull/4843) Updated NU1012 error message to display item paths diff --git a/docs/release-notes/NuGet-6.6.md b/docs/release-notes/NuGet-6.6.md index f6e1d1f37..29eb769cf 100644 --- a/docs/release-notes/NuGet-6.6.md +++ b/docs/release-notes/NuGet-6.6.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 6.6 including new features, bug fixes, and author: donnie-msft ms.author: eagoodso ms.date: 5/1/2023 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 6.6 Release Notes @@ -84,4 +84,4 @@ Thank you to all the contributors who helped make this NuGet release awesome! * [5046](https://github.com/NuGet/NuGet.Client/pull/5046) Limit concurrent connections via NUGET_CONCURRENCY_LIMIT * [marcin-krystianc](https://github.com/marcin-krystianc) * [4954](https://github.com/NuGet/NuGet.Client/pull/4954) Improved performance of calculation of PrivateAssets for transitively pinned centrally managed dependencies - * [4953](https://github.com/NuGet/NuGet.Client/pull/4953) Effective PrivateAssets of centrally managed transitive dependencies should be an intersection of parent dependencies \ No newline at end of file + * [4953](https://github.com/NuGet/NuGet.Client/pull/4953) Effective PrivateAssets of centrally managed transitive dependencies should be an intersection of parent dependencies diff --git a/docs/release-notes/NuGet-6.7.md b/docs/release-notes/NuGet-6.7.md index 29a3e4cb0..ac9bbe4db 100644 --- a/docs/release-notes/NuGet-6.7.md +++ b/docs/release-notes/NuGet-6.7.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 6.7 including new features, bug fixes, and author: jeffkl ms.author: jeffkl ms.date: 7/31/2023 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 6.7 Release Notes diff --git a/docs/release-notes/NuGet-6.8.md b/docs/release-notes/NuGet-6.8.md index d650e9fa9..bd351673e 100644 --- a/docs/release-notes/NuGet-6.8.md +++ b/docs/release-notes/NuGet-6.8.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 6.8 including new features, bug fixes, and author: nkolev92 ms.author: nikolev ms.date: 10/30/2023 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 6.8 Release Notes diff --git a/docs/release-notes/NuGet-6.9.md b/docs/release-notes/NuGet-6.9.md index 84bb7e35e..4870ba3d2 100644 --- a/docs/release-notes/NuGet-6.9.md +++ b/docs/release-notes/NuGet-6.9.md @@ -4,7 +4,7 @@ description: Release notes for NuGet 6.9 including new features, bug fixes, and author: jgonz120 ms.author: jongonza ms.date: 2/1/2024 -ms.topic: conceptual +ms.topic: release-notes --- # NuGet 6.9 Release Notes @@ -109,4 +109,4 @@ Thank you to all the contributors who helped make this NuGet release awesome! * [NikolaMilosavljevic](https://github.com/NikolaMilosavljevic) * Eliminate obsolete API warnings/errors in product source-build - [5496](https://github.com/NuGet/NuGet.Client/pull/5496) * [amis92](https://github.com/amis92) - * Add MemberNotNullWhen to SemanticVersion.HasMetadata - [5465](https://github.com/NuGet/NuGet.Client/pull/5465) \ No newline at end of file + * Add MemberNotNullWhen to SemanticVersion.HasMetadata - [5465](https://github.com/NuGet/NuGet.Client/pull/5465) diff --git a/docs/release-notes/NuGet-7.0.md b/docs/release-notes/NuGet-7.0.md new file mode 100644 index 000000000..0582d19aa --- /dev/null +++ b/docs/release-notes/NuGet-7.0.md @@ -0,0 +1,26 @@ +--- +title: NuGet 7.0 Release Notes +description: Release notes for NuGet 7.0 including new features, bug fixes, and DCRs. +author: zivkan +ms.topic: release-notes +--- +# NuGet 7.0 Release Notes + + + +NuGet distribution vehicles: + +| NuGet version | Available in Visual Studio version | Available in .NET SDK(s) | +|:---|:---|:---| +| [**7.0**](https://nuget.org/downloads) | TBD | TBD | + +## Not yet released + +This version of NuGet is in preview and these release notes will be updated when it is released. diff --git a/docs/resources/NuGet-FAQ.yml b/docs/resources/NuGet-FAQ.yml index ba838716b..07bb046b1 100644 --- a/docs/resources/NuGet-FAQ.yml +++ b/docs/resources/NuGet-FAQ.yml @@ -5,7 +5,7 @@ metadata: author: shishirx34 ms.author: shishirh ms.date: 01/31/2022 - ms.topic: conceptual + ms.topic: faq title: NuGet frequently-asked questions summary: | @@ -23,11 +23,9 @@ sections: - question: | Does NuGet support Mono? answer: | - The command-line tool, `nuget.exe`, builds and runs under Mono 3.2+ and can create packages in Mono. - - Although `nuget.exe` works fully on Windows, there are known issues on Linux and OS X. Refer to [Mono issues](https://github.com/NuGet/Home/issues?utf8=%E2%9C%93&q=is%3Aissue+is%3Aopen+mono) on GitHub. - - A [graphical client](https://github.com/mrward/monodevelop-nuget-addin) is available as an add-in for MonoDevelop. + The command-line tool, `nuget.exe`, builds and runs typically under Windows. NuGet can run on Unix operating systems using `mono`, but it is not officially supported by [NuGet's Support Policy](https://devblogs.microsoft.com/nuget/announcing-nuget-exe-and-nuget-client-sdk-packages-support-policy-keeping-you-informed-and-secure/). + + [Mono has transferred ownership to Wine and is no longer maintained by Microsoft](https://github.com/mono/mono/issues/21796). - question: | How can I determine what a package contains and whether it's stable and useful for my application? @@ -181,3 +179,12 @@ sections: If the `target` has been modified manually, NuGet might not be able to detect that it needs removed when migrating. If your project is `PackageReference` and you still have this target in project file, it should be safe to remove. + + - question: | + There is no README in Visual Studio NuGet Package Manager for the selected package. + answer: | + If you see the message "There is no README available for the selected package version" in Visual Studio NuGet Package Manager, that means that the selected version of the NuGet package does not have an embedded README file. + - If this is not the latest version of the package, consider checking the latest version. + - If the latest version doesn't have the README file embedded either, and you are not the maintainer of this package, consider filing an issue or contacting the maintainer to request a README. + - If you are the maintainer of the package, here is the guide on [how to embed the README in your package](https://aka.ms/nuget/readme). Please note that if you have added the README file on NuGet.org but didn't embed it in your package, the README will not be shown in Visual Studio. + diff --git a/docs/resources/check-project-format.md b/docs/resources/check-project-format.md index b59c1e3aa..b7ed7d665 100644 --- a/docs/resources/check-project-format.md +++ b/docs/resources/check-project-format.md @@ -4,7 +4,7 @@ description: Describes how to identity your project format author: mikejo5000 ms.author: mikejo ms.date: 07/09/2019 -ms.topic: conceptual +ms.topic: article --- # Identify the project format diff --git a/docs/visual-studio-extensibility/Visual-Studio-Templates.md b/docs/visual-studio-extensibility/Visual-Studio-Templates.md index 6e12d412e..aa1cf0484 100644 --- a/docs/visual-studio-extensibility/Visual-Studio-Templates.md +++ b/docs/visual-studio-extensibility/Visual-Studio-Templates.md @@ -4,7 +4,7 @@ description: Instructions for including NuGet packages as part of Visual Studio author: JonDouglas ms.author: jodou ms.date: 01/03/2018 -ms.topic: conceptual +ms.topic: article --- # Packages in Visual Studio templates diff --git a/docs/visual-studio-extensibility/nuget-api-in-visual-studio.md b/docs/visual-studio-extensibility/nuget-api-in-visual-studio.md index 3ba582ab3..e49186605 100644 --- a/docs/visual-studio-extensibility/nuget-api-in-visual-studio.md +++ b/docs/visual-studio-extensibility/nuget-api-in-visual-studio.md @@ -49,13 +49,11 @@ From NuGet 6.0, all of these APIs are available in the package [NuGet.VisualStud - [`IVsFrameworkCompatibility3`](#ivsframeworkcompatibility3-interface) Contains methods to discover frameworks and compatibility between frameworks. (5.8+) - [`IVsFrameworkParser`](#ivsframeworkparser-interface) An interface for dealing with the conversion between strings and [FrameworkName](/dotnet/api/system.runtime.versioning.frameworkname) (4.0+) - [`IVsFrameworkParser2`](#ivsframeworkparser2-interface) An interface to parse .NET Framework strings. See [NuGet-IVsFrameworkParser](https://aka.ms/NuGet-IVsFrameworkParser). (5.8+) -- [`IVsGlobalPackagesInitScriptExecutor`](#ivsglobalpackagesinitscriptexecutor-interface) Execute powershell scripts from package(s) in a solution (4.0+) - [`IVsPackageInstaller`](#ivspackageinstaller-interface): Methods to install NuGet packages into projects. (3.3+) - [`IVsPackageInstaller2](#ivspackageinstaller2-interface) Contains method to install latest version of a single package into a project within the current solution. - [`IVsPackageInstallerEvents`](#ivspackageinstallerevents-interface): Events for package install/uninstall. (3.3+) - [`IVsPackageInstallerProjectEvents`](#ivspackageinstallerprojectevents-interface): Batch events for package install/uninstall. (3.3+) - [`IVsPackageInstallerServices`](#ivspackageinstallerservices-interface): Methods to retrieve installed packages in the current solution and to check whether a given package is installed in a project. (3.3+) -- [`IVsPackageManagerProvider`](#ivspackagemanagerprovider-interface): Methods to provide alternative Package Manager suggestions for a NuGet package. (3.3 - 5.11) - [`IVsPackageRestorer`](#ivspackagerestorer-interface): Methods to restore packages installed in a project. (3.3+) - [`IVsPackageSourceProvider`](#ivspackagesourceprovider-interface): Methods to retrieve a list of NuGet package sources. (3.3+) - [`IVsPackageUninstaller`](#ivspackageuninstaller-interface): Methods to uninstall NuGet packages from projects. (3.3+) @@ -75,6 +73,7 @@ These interfaces are designed for project systems to interact with NuGet, allowi - [`IVsSolutionRestoreService2`](#ivssolutionrestoreservice2-interface) (4.3+) - [`IVsSolutionRestoreService3`](#ivssolutionrestoreservice3-interface) (5.1+) - [`IVsSolutionRestoreService4`](#ivssolutionrestoreservice4-interface) (6.0+) +- [`IVsSolutionRestoreService5`](#ivssolutionrestoreservice5-interface) (6.11+) - [`IVsSolutionRestoreStatusProvider`](#ivssolutionrestorestatusprovider-interface) (6.0+) ## Using NuGet Services @@ -414,31 +413,6 @@ public interface IRegistryKey } ``` -## IVsGlobalPackagesInitScriptExecutor interface - -```cs - /// - /// Execute powershell scripts from package(s) in a solution - /// - /// Intended for internal use only. - public interface IVsGlobalPackagesInitScriptExecutor - { - /// - /// Executes the init script of the given package if available. - /// 1) If the init.ps1 script has already been executed by the powershell host, it will not be executed again. - /// True is returned. - /// 2) If the package is found in the global packages folder it will be used. - /// If not, it will return false and do nothing. - /// 3) Also, note if other scripts are executing while this call was made, it will wait for them to complete. - /// - /// Id of the package whose init.ps1 will be executed. - /// Version of the package whose init.ps1 will be executed. - /// Returns true if the script was executed or has been executed already. - /// This method throws if the init.ps1 being executed throws. - Task ExecuteInitScriptAsync(string packageId, string packageVersion); - } -``` - ## IVsPackageInstaller interface ```cs @@ -810,53 +784,6 @@ public interface IRegistryKey } ``` -## IVsPackageManagerProvider interface - -This interface was primarily used by the ASP.NET team, to suggest that Javascript and CSS packages like `jQuery` and `bootstrap` are installed with Bower instead of NuGet. Since they removed that functionality From Visual Studio, NuGet has obsolete this interface, and it will no longer be used by the Package Manager UI in Visual Studio 2022 (version 17.0) and later. - -```cs - /// - /// Interface allowing integration of alternate package manager suggestion for a NuGet package. - /// For example jQuery may appear on Bower and npm, - /// it might be more appropriate to install a package from them for certain projects. - /// - [Obsolete] - public interface IVsPackageManagerProvider - { - /// - /// Localized display package manager name. - /// - string PackageManagerName { get; } - - /// - /// Package manager unique id. - /// - string PackageManagerId { get; } - - /// - /// The tool tip description for the package - /// - string Description { get; } - - /// - /// Check if a recommendation should be surfaced for an alternate package manager. - /// This code should not rely on slow network calls, and should return rapidly. - /// - /// Current package id - /// Unique project name for finding the project through VS dte - /// Cancellation Token - /// return true if need to direct to integrated package manager for this package - Task CheckForPackageAsync(string packageId, string projectName, CancellationToken token); - - /// - /// This Action should take the user to the other package manager. - /// - /// Current package id - /// Unique project name for finding the project through VS dte - void GoToPackage(string packageId, string projectName); - } -``` - ## IVsPackageRestorer interface ```cs @@ -1249,6 +1176,7 @@ This interface was primarily used by the ASP.NET team, to suggest that Javascrip /// Thrown if is not the path of a project file. /// Thrown if is null. /// Thrown if is cancelled. + [Obsolete("Use IVsSolutionRestoreService5 instead")] Task NominateProjectAsync(string projectUniqueName, IVsProjectRestoreInfo projectRestoreInfo, CancellationToken token); } ``` @@ -1315,6 +1243,7 @@ This interface was primarily used by the ASP.NET team, to suggest that Javascrip /// Thrown if is not the path of a project file. /// Thrown if is null. /// Thrown if is cancelled. + [Obsolete("Use IVsSolutionRestoreService5 instead")] Task NominateProjectAsync(string projectUniqueName, IVsProjectRestoreInfo2 projectRestoreInfo, CancellationToken token); } ``` @@ -1342,6 +1271,36 @@ This interface was primarily used by the ASP.NET team, to suggest that Javascrip } ``` +## IVsSolutionRestoreService5 interface + +```cs + /// + /// Represents a package restore service API for integration with a project system. + /// Implemented by NuGet. + /// + public interface IVsSolutionRestoreService5 : IVsSolutionRestoreService4 + { + /// + /// An entry point used by CPS to indicate given project needs to be restored. + /// + /// + /// The full path to the project file. In the VS SDK's IVsSolution, this is also known as the unique name. + /// + /// Metadata needed for restoring the project. + /// Cancellation token. + /// + /// Returns a restore task corresponding to the nominated project request. + /// NuGet will batch restore requests so it's possible the same restore task will be returned for multiple projects. + /// When the requested restore operation for the given project completes the task will indicate operation success or failure. + /// + /// Thrown if is not the path of a project file, + /// or if has some basic validation errors. + /// Thrown if is . + /// Thrown if is cancelled. + Task NominateProjectAsync(string projectUniqueName, IVsProjectRestoreInfo3 projectRestoreInfo, CancellationToken token); + } +``` + ## IVsProjectRestoreInfoSource interface ```cs diff --git a/docs/what-is-nuget.md b/docs/what-is-nuget.md index b66de09cb..5c0537b68 100644 --- a/docs/what-is-nuget.md +++ b/docs/what-is-nuget.md @@ -106,9 +106,7 @@ Take a moment to browse the table of contents for this documentation, and you se ## Related video -> [!Video https://learn.microsoft.com/shows/NuGet-101/What-is-NuGet-1-of-5/player] - -Find more NuGet videos on [Channel 9](/shows/NuGet-101/) and [YouTube](https://www.youtube.com/playlist?list=PLdo4fOcmZ0oVLvfkFk8O9h6v2Dcdh2bh_). +Find NuGet videos on [Channel 9](/shows/NuGet-101/) and [YouTube](https://www.youtube.com/playlist?list=PLdo4fOcmZ0oVLvfkFk8O9h6v2Dcdh2bh_). ## Comments, contributions, and issues