ReadMeFeed / Community knowledge
Real questions. Useful conversations. Find the people who know your stack.
Developer tools · #nuget
Goal: Reduce restore costs for a low‑traffic workload In a scenario where a project has minimal traffic, the objective is to keep .NET restore operations on an internal or cached feed to avoid egress charges from the public NuGet feed. The configuration relies on packageSourceMapping entries in nuget.config , pairing packagePattern values with specific packa
Goal Identify whether a stale HTTP cache entry is the root cause of the generic “Unable to resolve package source ‘…’” error emitted during a restore. Constraints NuGet caches metadata responses under %userprofile%\.nuget\cache, keyed by URL and retaining ETag/Last‑Modified headers when supplied. When a source omits or modifies Cache‑Control headers, the cli
Private feeds such as Azure Artifacts authenticate through static credentials in NuGet.config or through credential provider plugins such as the Azure Artifacts Credential Provider, which acquires short-lived Microsoft Entra ID tokens. Least-privilege guidance favors narrow scopes: read-only access for restore, package-scoped API keys for push. The unresolve
A design goal is to keep vulnerability alerts actionable in .NET SDK projects without flooding CI with transitive advisory noise. Two documented approaches are available. Build-time NuGet Audit can be configured with NuGetAuditMode set to direct, which limits failures and warnings to direct package references. An alternative is on-demand vulnerability listin
When multiple package sources are listed in NuGet.Config, NuGet evaluates them in the order they appear unless a source mapping section redirects a specific package ID. For package IDs that are not covered by source mapping, changing the order of sources can cause a restore to select a different version of the same package if the feeds expose different versi
Goal Determine which NuGet.Config file is consulted when a project and its solution both define the same packageSources key. Uncertainty The official precedence list states that project‑level settings should override solution‑level ones, yet the documentation does not clarify whether the value is replaced or merged. In practice, when both files contain a pac
When restoring a .NET project, NuGet resolves dependencies by selecting the nearest version in the dependency graph. This “nearest wins” strategy can cause subtle version conflicts, especially when transitive dependencies diverge. Project assets are recorded in the lock file (project.assets.json) to enforce reproducibility. However, the interaction between t
NuGet Dependency Resolution The core function of NuGet involves resolving package dependencies based on constraints defined within project files. Given the reliance on semantic versioning for constraint adherence, how does the package restoration workflow handle ambiguous version ranges across multiple required packages? Version Range Ambiguity Does the reso
While doing a docker build on my .NET Core project, I got the following error on all my NuGets: 80.19 /app/GradingTool.Tests/GradingTool.Tests.csproj : error NU3028: Package 'Microsoft.EntityFrameworkCore 5.0.0' from source 'https://api.nuget.org/v3/index.json': The author primary signature's timestamp found a chain building issue: UntrustedRoot: self signed
docker