Skip to content

NuGet-7.0.md

Latest commit

 

History

History
332 lines (214 loc) · 23.1 KB

NuGet-7.0.md

File metadata and controls

332 lines (214 loc) · 23.1 KB
title NuGet 7.0 Release Notes
description Release notes for NuGet 7.0 including new features, bug fixes, and DCRs.
author donnie-msft
ms.author eagoodso
ms.date 10/29/2025
ms.topic release-notes

NuGet 7.0 Release Notes

NuGet distribution vehicles:

NuGet version Available in Visual Studio version Available in .NET SDK(s)
7.0.0 Visual Studio 2026 version 18.0.0 10.0.1001
7.0.1 Visual Studio 2026 version 18.1.0
7.0.2 Visual Studio 2026 version 18.1.1 10.0.1021

1 Installed with Visual Studio 2026 with any .NET workload

Summary: What's New in 7.0.2

  • Vulnerability InfoBar in Visual Studio now has "How to fix with GitHub Copilot" link to NuGet's MCP Server documentation - #14680

Issues fixed in this release

  • dotnet nuget why is writing target package on new line instead of in package graph - #14664

List of commits in this release

Summary: What's New in 7.0.1

Issues fixed in this release

  • Fixed NU1011 error that occurred when using Central Package Management with floating versions allowed #14637

List of commits in this release

Summary: What's New in 7.0.0

  • Projects that target .NET 10 warn for vulnerabilities in transitive packages by defaulting to NuGetAuditMode=all #14161

  • Package pruning is enabled for all projects targeting .NET 10 #14345

  • Created the NuGet Model Context Protocol (MCP) Server, supported by .NET 10 SDK or later. NuGet's MCP is pre-installed in Visual Studio 2026, and installable in VS 17.14 and VS Code. The server is published on nuget.org as the NuGet.Mcp.Server package.

  • Enable packing legacy PackageReference projects without the need for a package - #14046

  • Deprecate SHA-1 usage in .NET 10 - #13814

  • Details pane reflects Vulnerability Data from Audit Sources - #14554

  • NuGet AuditSources support in the Package Manager UI - #13954

  • Migrate NuGet's settings to the new Visual Studio Options window

    • Migrate "Package sources" settings in Visual Studio Options - #14233

    • Migrate "Package Source Mapping" settings in Visual Studio Options - #14234

  • dotnet update package --vulnerable (Audit fix) - #13372

Breaking changes

  • Add package ID validation during restore - #14407

  • Project.json is no longer supported in 7.0. Visual Studio 2026 automatically migrated project.json projects to PackageReference

  • Package pruning will lead to a one-time diff in packages lock file - #14272

  • Pruning privatizes a direct references by apply PrivateAssets=all and IncludeAssets=none - #14196

  • Raise an error for SHA-1 fingerprints usage in NuGet.exe sign, mssign commands - #13962

  • Show an error when a non https source is used in a resource in a service index - #13364

SDK Breaking changes

  • Project.json deprecation

    • Remove project.json pack - #7931

    • Remove project.json support - #7199

    • Remove PackageSpec.Dependencies - #14446

    • Clean up Package Spec redudant APIs - #6231

  • Unused NuGet VS Extensibility APIs removed - #14403

  • Remove all unused APIs marked as obsolete in NuGet.Frameworks, NuGet.Protocol, NuGet.Commands & NuGet.PackageManagement - #14395

  • Remove obsolete APIs from NuGet.Common, NuGet.Configuration, NuGet.LibraryModel, NuGet.Packaging and NuGet.ProjectModel - #14393

  • Block and remove code for unused restore implementations such as Standalone. - #14184

  • Remove DotnetToolReference restore - #14183

Issues fixed in this release

NuGet SDK fixes

  • Don't use reflection based deserialization in NuGet.Protocol - #14470

  • JsonSerializerIsReflectionDisabled on update to Nuget.Protocols 6.13.1 in apps with JsonSerializerIsReflectionEnabledByDefault set to false - #14111

.NET CLI

  • Enable CanShowDialog for .NET core Authentication Plugins - #14010

  • "dotnet package update" modifies wrong project file (csproj) - #14585

  • dotnet nuget verify should output package content hash - #14384

  • dotnet package update should support --verbosity - #14319

  • dotnet package update should support CPM and VersionOverride - #14318

  • dotnet package update should support multiple packages - #14308

  • dotnet package update should support package source mapping - #14307

  • dotnet package update to a specific version - #14306

  • dotnet package update initial version - #14305

  • [Bug Bash][Unstable] An error “Attempted to divide by zero.” occurs when executing command “dotnet list [ProjectPath] package --vulnerable” - #14122

  • [Feature]: dotnet list [project | solution] package does not work with solution filters - #11789

Package Manager UI in Visual Studio

  • Convert Search Control to Fluent UI - #14469

  • Use Fluent TextBox for Project PM UI Installed Version - #14466

  • [Bug Bash] There is a tiny gap in the version drop-down list of PM UI - #11990

  • [Bug Bash] The dropdown list of PM UI doesn’t distinguish the background color between selected-item and hover-on item - #10977

  • [Bug Bash] Pressing the page-down button on the keyboard when focusing on ‘Version’ drop-down box with Tab key makes the box empty - #13605

  • Dead Code: ActionsAndVersions View - #14464

Visual Studio options

  • Decommission Legacy VS Options NuGet Settings - #14398

  • When adding an http source in the options dialog, have the user click on a checkbox to more explicitly agree to AllowInsecureConnections being added - #14377

  • Error needed in Package Sources settings for HTTP source without AllowInsecureConnections - #14367

  • Improve validation of NuGet's settings in Visual Studio Options - #14359

  • Show validation errors on NuGet options pages while typing - #14358

  • [Bug Bash] [Unstable] The first removing of a source mapping from the ‘Package Source Mappings’ list in ‘Package Source Mapping’ dialog doesn’t work - #13520

  • [Localization] The table title ‘Package Source Mapping’ in the ‘Options->NuGet Package Manager->Package Source Mapping’ page was not localized - #14550

  • [Bug Bash] The offline package source cannot be enabled after disabling it from the ‘Machine-wide package sources’ source list previously in the ‘Options->NuGet Package Manager->Package Sources’ window - #13434

  • [Bug Bash] The “source” column of the “Add New Package Source Mapping” dialog doesn’t have the minimum width set which makes it can be dragged out of sight - #13355

  • [Bug Bash] The first reopening of Options dialog should bring back the default package source "Microsoft Visual Studio Offline Packages" in "package sources" list when all the sources were deleted previously - #13278

  • [Bug Bash] Newly added package source mapping shouldn’t be case-sensitive in “Option->NuGet Package Manager->Package Source Mapping” window - #13210

  • [Bug Bash] New added package source mapping will lost after switching back to the "Package Source Mapping" tab from other tab in “Option->NuGet Package Manager” window - #13150

  • [Bug Bash] The “Remove” button should be disable when no package source mapping is selected in the “Package Source Mappings” list - #13115

  • [CSY] Duplicated hotkeys show in “Options->NuGet Package Manager->Package Sources” dialog - #7822

  • VS NuGet PMUI - Machine-wide package sources area should be vertically resize-able as well - #7560

  • [Bug Bash] There will be a duplicated package source when modifying the name of source “Microsoft Visual Studio Offline Packages” - #13057

  • [Bug Bash] The “Options->NuGet Package Manager->Package Sources” page is disabled after checking or unchecking the checkbox “Enabled” of any one of the package sources having duplicated sources - #14499

  • Have to manually select pre-populated text on Add Package Source dialog - #14450

  • VS should not delete Package Source attributes when Name is updated - #14370

Package Pruning

  • Warning rollout for PrunePackageReference - #14126

  • Missing audit warnings from "nuget install" when nuget.org is not a package source - #14096

  • It's not possible to push to HTTP sources specified via command line - #14047

  • Package pruning is enabled for all projects targeting .NET 10 including multi-targeted ones - #14345

  • Move pruning enabled frameworks to the NuGet.targets - #14424

  • Change _RestorePackagePruningDefault to RestorePackagePruningDefault - #14511

Restore

  • dotnet restore/Visual Studio conflicting with .esproj + Nx project.json - #13512

  • Improve NU1004 when pruning is used with locked mode - #14075

  • Consider not writing NuGetToolVersion to generated MSBuild props files on Restore - #14355

  • NuGet Restore fails if SQL Server Management Studio 21 is installed - #14349

  • Remove NUGET_EXPERIMENTAL_USE_NJ_FOR_FILE_PARSING - #14257

  • Remove RestoreTargetGraph.Name as it's redundant with restoreTargetGraph.TargetGraphName being the widely used version - #14529

  • Remove RestoreArgs.LockFileVersion as it's functionality unused - #14524

  • Remove NUGET_BULK_RESTORE_COORDINATION and NUGET_SOLUTION_CACHE_INITIALIZATION fallbacks - #14502

Dependency resolver

  • New dependency resolver does not properly handle floating prerelease versions - #13833

  • Reenable new algorithm resolution with lock files - #13800

Other

  • Stop ilmerging pack - #13079

  • Make NuGet.Client's Build.ps1 more friendly to GitHub Copilot in VSCode - #14453

  • Generate identical [Content_Types].xml on repeated builds - #14357

  • pack legacy csproj: include pack targets and tasks in VS build tools - #14520

  • VS crashes when the only project in the solution is a project.json project - #14553

  • review exception handling - #14440

  • Improve perf by avoiding redundant dictionary lookups - #14432

  • LockFileLibrary does not need to be mutable - #14385

List of commits in this release

Community contributions

Thank you to all the contributors who helped make this NuGet release awesome!

  • SimonCropp
    • 6720 remove redundant default constructors
    • 6610 add "does not have a min version" to messages in GetNupkgInfo
    • 6581 remove redundant dictionary lookups in MarkTransitiveOrigin
    • 6596 enable nullability in PackageItemViewModelTests
    • 6634 remove IFrameworkTargetable
    • 6616 avoid redundant version parsing in PluginFindPackageByIdResource
    • 6595 enable nullability in ReadmePreviewViewModelTests
    • 6587 remove redundant dictionary lookup in ProcessUnrankedEntries
    • 6598 enable nullability in EmbeddedResourcesCapabilityTests
    • 6577 use fields instead of private properties
    • 6622 remove un-used list in GetPackagesToBeReinstalled
    • 6589 redundant null check for projectManagerService.GetMetadataAsync return value
    • 6605 enable nullable in VSRestoreSettingsUtilityTests
    • 6575 remove redundant dictionary lookup in CredentialServiceAdapter.GetCredentials
    • 6601 enable nullabe in NuGetInstallCommandTest
    • 6593 enable nullable in IProjectContextInfoExtensionsTests
    • 6614 remove redundant lists in DependencyGraphFileRequestProvider
    • 6625 remove un-used variables in PackageExtractor
    • 6609 fix nullability in UnresolvedMessages
    • 6608 remove un-used contextForGather
    • 6628 remove redundant enumeration in CredentialsItem
    • 6617 remove toolItems list instance in MSBuildRestoreUtility
    • 6599 fix parameter nullability in Constructor_SetReportAbuseUrl_Initialize…
    • 6604 enable nullable in LegacyPackageReferenceProjectTests
    • 6631 remove DependencyGraphSpecRequestProvider.CollectReferences
    • 6635 remove EnvDteProjectExtensions.PathComparer
    • 6623 remove redundant GetManifestResourceNames in ManifestSchemaUtility
    • 6619 remove unused packageID variable
    • 6620 remove un-used variables in PackageManagerControl
    • 6640 remove redundant exception handling
    • 6637 remove PackageManagerControl.AddMigratorBar
    • 6629 remove un-used HashSet instance in ResolverMetadataClient
    • 6602 enable nullable in MSBuildUtilityTest
    • 6641 remove redundant null condition in UpdateCommand.ExecuteCommandAsync
    • 6683 remove redundant string alloc in GetTempFilePath
    • 6626 remove un-used variables in SignedPackageArchiveIOUtility
    • 6574 remove redundant dictionary lookup in CreatePackageSourceMappingDictionary
    • 6594 enable nullability in InfiniteScrollListTests
    • 6682 Use async delay in SafeReadAsync
    • 6600 enable nullable in NuGetUpdateCommandTests
    • 6606 enable nullable in VSNominationUtilitiesTests
    • 6613 remove redundant type variable in GetExternalProject
    • 6611 remove un-used solutionService instances
    • 6643 remove MsBuildUtility.GetMsBuildPathInPathVar
    • 6632 remove PackageSpecFactory.GetTargetFrameworkStrings
    • 6573 avoid some allocation in ProjectFactory.ProcessDependencies
    • 6588 remove dictionary lookups from GetPreviewResultsAsync
    • 6597 fix nullability in PackageModelCreationTestHelper
    • 6612 remove un-used list instances in NuGetPackageManager
    • 6591 enable nullable in PackageSourceValidatorTests
    • 6603 fix nullability in IVsProjectBuildProperties
    • 6636 remove _project* fields from PackageReferenceProject
    • 6630 remove un-used identity instance in LocalV3FindPackageByIdResource
    • 6618 remove LoggerAdapter instance in NuGetPackageManager
    • 6621 remove un-used projectsByUniqueName in SolutionUpToDateChecker
    • 6624 remove un-used variables in PackageBuilder
    • 6633 remove JsonPackageSpecReader DelimitedStringSeparators and VersionSeparators
    • 6642 use cast instead of as and null check in CommandLineParser.AssignValue
    • 6615 remove redundant list in GetPluginAsync
    • 6627 remove un-used GetDirectoryName in MisplacedAssemblyOutsideLibRule
    • 6578 remove redundant dictionary lookup in PrunePackageTree.PruneDowngrades
    • 6576 remove redundant dictionary lookup in RecommenderPackageFeed
  • baronfel
    • 6554 Fix NuGet->SDK Codeflow
    • 6514 Pin and stabilize the NuGetToolVersion property in the generated NuGet props files during restore.
  • omajid
    • 6500 Ensure stable order of entries in Content_Types.xml
    • 6507 Support building on Linux when full signing is not available
  • AlexDelepine
    • 6793 Update Ngen Priorities for VS
  • hickford
    • 6475 Populate audit sources consistently
  • nohwnd
    • 6735 Disable loading profile in utility powershell.exe calls
  • mmitche
    • 6539 Move NuGet to xliff-tasks
  • dkurepa
    • 6644 Add Version.Details.props
  • bdukes
    • 6530 Fix nuget.exe restore finding MSBuild from SSMS instead of Visual Studio
  • ToddGrun
    • 6519 Make LockFileLibrary immutable for performance and sanity reasons