# Reported issues for Microsoft NuGet

Pod holds 24 of 74 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to [Microsoft NuGet](/mcp/microsoft-nuget).

## Most discussed

### [Bug]: Unexpected NU1008 errors

### NuGet Product Used

Visual Studio Package Manager Console

### Product Version

VS Internal Previews

### Worked before?

17.2 Preview 3

### Impact

It's more difficult to complete my work

### Workaround
Restore from the command-line before building in Visual Studio

### Repro Steps & Context

1. Install internal preview of VS
2. Clone our repo (not public, so can't link - I can provide directly if needed - but it is a solution with 5 SDK-style .NET Framework projects

[Read the thread](https://github.com/NuGet/Home/issues/11748) · 2022-04-14 · closed · external user · 9 comments

### [Bug]: KeyNotFoundException in LockFileBuilder.CreateLockFile

### NuGet Product Used

dotnet.exe

### Product Version

5.0.301

### Worked before?

_No response_

### Impact

Other

### Repro Steps & Context

I ran dotnet restore on my solution on CI after first installing .NET 5.0.301.

I saw a NullReferenceException and a KeyNotFoundException.

```
2021-07-14T00:34:23.5238067Z   Determining projects to restore...
2021-07-14T00:34:23.8636897Z C:\a\_tool\dotnet\sdk\5.0.301\Sdks\Microsoft.NET.Sdk\targets\Microsoft.NET.EolTargetFrameworks.targets(28,5)

[Read the thread](https://github.com/NuGet/Home/issues/11028) · 2021-07-14 · closed · external user · 16 comments

### Command “dotnet restore -f --use-lock-file” created a lock file for every project when the solution have project reference

## Details about Problem
NuGet version: NuGet Client Dev\5.8.0.6783
VS Version: Master\30423.24
OS: Windows-10-Enterprise-RS5
## Detailed repro steps 
1. Create a solution with two projects [e.g. C# Class Library (.NET Core 5.0)] called “CL1” and “CL2” in VS.
2. Make the project graph structure: CL1 -> CL2 and **close the solution/VS**.
3. Open “Developer Command Prompt”, cd to CL1 project path and input command “dotnet restore -f --use-lock-file”.
4. Open the solution and check the Solu

[Read the thread](https://github.com/NuGet/Home/issues/9933) · 2020-08-24 · closed · external user · 15 comments

### How to copy non assembly files to output directory of application

Hello.

How is it possible to copy none assembly files, like .xml, .txt .cat, and so on to the output directory of the application which uses my nuget package.

This is how my projectfile of my nuget package in visual studio looks like

```xml
<?xml version="1.0" encoding="utf-8"?>
<Project Sdk="Microsoft.NET.Sdk">
  <PropertyGroup>
    <TargetFramework>net40</TargetFramework>
    <PackageId>SomeId</PackageId>
    <Version>1.0.0.0</Version>
    <Authors>booster</Authors>
    <Compa

[Read the thread](https://github.com/NuGet/Home/issues/8843) · 2019-11-20 · closed · external user · 22 comments

### Misleading message "NU3028: The certificate is revoked."

Using `nuget.exe sign -Timestamper http://tsa.starfieldtech.com` from the command line:

```
Timestamping package(s) with:               
http://tsa.starfieldtech.com                
NU3028: The certificate is revoked.         
NU3028: Certificate chain validation failed.
```

It would seem like the next step would be to go to our certificate issuer who runs that timestamp server and as them why our tools are saying that their timestamp certificate is revoked, but that just sounded too 

[Read the thread](https://github.com/NuGet/Home/issues/7979) · 2019-04-09 · closed · external user · 9 comments

### Repository Signatures

Status: **Reviewing**

Use this issue to discuss the [Repository Signatures](https://github.com/NuGet/Home/wiki/Repository-Signatures) spec.

[Read the thread](https://github.com/NuGet/Home/issues/6378) · 2018-01-03 · closed · external user · 19 comments

### Improve NuGet package debugging and symbols experience

Currently the NuGet package debugging and symbols experience is not streamlined.

Some areas that need improvement are:
1. Optimize the NuGet package and symbol authoring story to encourage     ####production of symbols 
2. Support for the new portable PDB format for .NET Core and .NET Standard applications
3. Better integration in Visual Studio tooling.

This issue will be used for discussion of the spec [here.](https://github.com/NuGet/Home/wiki/NuGet-Package-Debugging-&-Symbols-Improve

[Read the thread](https://github.com/NuGet/Home/issues/6104) · 2017-10-25 · closed · external user · 93 comments

### Consider installer for NuGet.exe (w/ adding to path, etc...)

The release for nuget states that nuget "is only available with Visual Studio 2015, and was included in the distribution of Visual Studio 2015 Update 1".  I have a clean development machine with VS 2015 and can open up Package Manager Console, type nuget, and get an error.  This is crazy, it should just work.

I know Windows users shy away from the command line, but stuff like this is why.  Please set the path upon install so nuget 'just works'.  It is so annoying every time I try to do anything

[Read the thread](https://github.com/NuGet/Home/issues/2468) · 2016-04-06 · closed · external user · 29 comments

## Most recent

### Review Supply Chain security with Copilot using a VS Error List fixer

Particularly for Supply Chain features, we'd like to use the NuGet MCP Server when available to assist the customer in resolving their issues.

For example, for [NU1507](https://learn.microsoft.com/en-us/nuget/reference/errors-and-warnings/nu1507) when CPM is enabled, and a customer enables Warnings as Errors, our MCP tool can possibly help them enable PackageSourceMapping for their repo, or let them know that it's safe to ignore this warning/error.

[Read the thread](https://github.com/NuGet/Home/issues/15049) · 2026-08-15 · closed · outside contributor · 0 comments

### Skill to explore a NuGet package API (offline, from local cache)

_Transferred from https://github.com/dotnet/skills/issues/981 — originally filed by @verdie-g._

When using a NuGet package, it would be useful for an AI agent to explore its API (including XML docs) without relying solely on LSP. The proposal outlines a tiered approach:

1. **Locate the package/type** in the local NuGet cache (`~/.nuget/packages/`)
2. **Read shipped XML docs** next to the DLL
3. **Enumerate public surface** via reflection
4. **Resolve real source** files via Source Link embedde

[Read the thread](https://github.com/NuGet/Home/issues/15041) · 2026-08-12 · open · external user · 0 comments

### Review your Package Source Mapping & Supply Chain Security with GitHub Copilot

Introduce a Button (Command) to the Package Source Mapping VS Settings which attempts to prompt GitHub Copilot with "Review this repository's package source mappings.", invoking the NuGet MCP tool to review supply chain security.

[Read the thread](https://github.com/NuGet/Home/issues/15021) · 2026-08-04 · closed · outside contributor · 0 comments

### The NuGet Solver tool is still unavailable after the NuGet MCP Server is enabled from MCP Server Manager

### NuGet Product Used

Visual Studio Package Management UI

### Product Version

VS Main\11820.301 + NuGet Client Dev\7.8.0.39

### Worked before?

It's a regression since it doesn’t repro on VS Main\11813.22 + NuGet Client Dev\7.8.0.24.

### Impact

It's more difficult to complete my work

### Repro Steps & Context

#### Note:
1.	Repro rate: 100%.
#### Repro Steps:
1.	Create a C# Console App (.NET 10.0) in VS and open the project-level PM UI.
2.	Go back to the ‘Browse’ tab of PM UI, select the

[Read the thread](https://github.com/NuGet/Home/issues/14912) · 2026-05-21 · closed · external user · 5 comments

### Add minimum package age policy

Add minimum package release age policy for restore/install/update to mitigate supply-chain attacks.
Similar to pnpm/Renovate/+others minimumReleaseAge and Dependabot cooldown but as close to the development as possible.

This would protect developers machines and CI from picking up packages created before a set age enforced at the package manager level.

Need to decide where the policy can be set. Ideas are at least `Directory.Build.props` (and therefore also csprojs?), maybe `nuget.config` glob

[Read the thread](https://github.com/NuGet/Home/issues/14899) · 2026-05-06 · closed · external user · 2 comments

### [MCP Server]: MCP Server .exe is not code signed

### Issue Type

Bug

### MCP Server Package Version

1.2.3

### .NET Version

.NET 10.0

### Environment

- [ ] Visual Studio
- [x] VS Code
- [x] GitHub Copilot Coding Agent
- [ ] CLI
- [ ] Other (please specify below)

### If "Other", please specify

_No response_

### Prompt or Input

Starting the MCP server is not possible in high security environments where applications are whitelisted via AppLocker.

The root of the issue is that the following .exe is not code signed with any certificate.

[Read the thread](https://github.com/NuGet/Home/issues/14861) · 2026-04-16 · closed · external user · 1 comment

### [MCP Server]: MCP Server .exe is not code signed

### Issue Type

Bug

### MCP Server Package Version

1.2.3

### .NET Version

.NET 10

### Environment

- [ ] Visual Studio
- [x] VS Code
- [x] GitHub Copilot Coding Agent
- [ ] CLI
- [ ] Other (please specify below)

### If "Other", please specify

_No response_

### Prompt or Input

Starting the MCP server is not possible in high security environments where applications are whitelisted via AppLocker.

The root of the issue is that the following .exe is not code signed with any certificate.

C:

[Read the thread](https://github.com/NuGet/Home/issues/14860) · 2026-04-16 · closed · external user · 1 comment

### NuGet.Mcp.Server 1.1.29 grows to 50+ GB RSS and is killed by kernel jetsam on macOS (C# Dev Kit pre-release only)

### Summary

`NuGet.Mcp.Server@1.1.29`, auto-launched by the VS Code C# Dev Kit extension (`ms-dotnettools.csdevkit` / `csdevkit.nuget-mcp` provider), grew from zero to **50,522 MB resident (≈49.3 GB)** in roughly 5 hours on Apple M4 silicon, exhausted physical RAM and the compressor, and was killed by the XNU jetsam mechanism as the system's `largestProcess` at the moment of OOM.

**Scope:** this reproduces only on the **pre-release channel** of C# Dev Kit (`3.11.200`). After switching to the c

[Read the thread](https://github.com/NuGet/Home/issues/14854) · 2026-04-11 · closed · external user · 3 comments

### NuGet MCP Server doesn’t work in GitHub Copilot Chat window even after restarting

### NuGet Product Used

Visual Studio Package Management UI

### Product Version

VS Main\11625.112 + NuGet Client Dev\7.6.0.33

### Worked before?

It's a regression since it doesn’t repro on VS Main\11617.104 + NuGet Client Dev\7.6.0.22.

### Impact

It's more difficult to complete my work

### Repro Steps & Context

#### Note:
1.	Repro rate: 100%
#### Repro Steps:
1.	Create a C# Console App (.NET 10.0) in VS and open the project-level PM UI.
2.	Go back to the ‘Browse’ tab of PM UI, select the

[Read the thread](https://github.com/NuGet/Home/issues/14829) · 2026-03-26 · closed · external user · 4 comments

### [MCP Server]: hangs when accessing Azure DevOps private NuGet feed

### Issue Type

Bug

### MCP Server Package Version

came with VS 18.4.0

### .NET Version

.NET 10.0.200

### Environment

- [x] Visual Studio
- [ ] VS Code
- [ ] GitHub Copilot Coding Agent
- [ ] CLI
- [ ] Other (please specify below)

### If "Other", please specify

_No response_

### Prompt or Input

What NuGet package should I use for HttpClient logging?

### Expected Response

Microsoft.Extensions.Http.Diagnostics

### Actual Response

Timed out attempting to retrieve the package list.

##

[Read the thread](https://github.com/NuGet/Home/issues/14803) · 2026-03-11 · closed · external user · 7 comments

### [MCP Server]:

### Issue Type

Bug

### MCP Server Package Version

_No response_

### .NET Version

_No response_

### Environment

- [x] Visual Studio
- [x] VS Code
- [x] GitHub Copilot Coding Agent
- [x] CLI
- [ ] Other (please specify below)

### If "Other", please specify

_No response_

### Prompt or Input

mkdir your/build/directory
cd your/build/directory
cmake -DCMAKE_EXPORT_COMPILE_COMMANDS=ON path/to/llvm/sources

### Expected Response

A don't have access and he don't give any solutions code. No np

[Read the thread](https://github.com/NuGet/Home/issues/14794) · 2026-03-09 · closed · external user · 4 comments

### [MCP Server]:

### Issue Type

Bug

### MCP Server Package Version

0.1.0

### .NET Version

10

### Environment

- [x] Visual Studio
- [ ] VS Code
- [ ] GitHub Copilot Coding Agent
- [ ] CLI
- [ ] Other (please specify below)

### If "Other", please specify

_No response_

### Prompt or Input

I am trying to access github copilot from visual studio. But not able to access

### Expected Response

Response from Github copilot

### Actual Response

<img width="534" height="557" alt="Image" src="https://github.co

[Read the thread](https://github.com/NuGet/Home/issues/14736) · 2026-02-04 · closed · external user · 2 comments

### NugetProjectServiceV1 brokered service is not usable from out-of-proc consumers

### NuGet Product Used

Visual Studio Package Management UI

### Product Version

Visual Studio (any version)

### Worked before?

no

### Impact

I'm unable to use this version

### Repro Steps & Context

NugetProjectServiceV1 service descriptor is using MessagePack formatter and HttpLikeHeaders which are not compatible so out of proc usage of the service is not possible today. For message pack formatter, the delimiter should be BigEndianInt32LengthHeader.

To test these interfaces and descript

[Read the thread](https://github.com/NuGet/Home/issues/14732) · 2026-02-03 · closed · external user · 0 comments

### [MCP Server]: AI tutor / best practices for supply chain security in .NET

### Issue Type

Feature

### MCP Server Package Version

_No response_

### .NET Version

_No response_

### Environment

- [ ] Visual Studio
- [ ] VS Code
- [ ] GitHub Copilot Coding Agent
- [ ] CLI
- [ ] Other (please specify below)

### If "Other", please specify

_No response_

### Prompt or Input

"Help me setup my NuGet supply chain security"

### Expected Response

non-existing tool

### Actual Response

non-existing tool

### Additional Context or Description

More and more tools are pro

[Read the thread](https://github.com/NuGet/Home/issues/14713) · 2026-01-12 · open · external user · 2 comments

### Vulnerability InfoBar in Visual Studio now has "How to fix with GitHub Copilot" link to NuGet's MCP Server documentation

When the package vulnerability InfoBar is shown, add an action to link to our MCP Server docs so customers can learn how to resolve the vulnerability warning using GitHub Copilot

[Read the thread](https://github.com/NuGet/Home/issues/14680) · 2025-12-10 · closed · outside contributor · 0 comments

### [MCP Server]: Unhandled exception. System.DllNotFoundException: Dll was not found.

### Issue Type

Bug

### MCP Server Package Version

1.1.12

### .NET Version

10.0.100

### Environment

- [ ] Visual Studio
- [ ] VS Code
- [ ] GitHub Copilot Coding Agent
- [ ] CLI
- [x] Other (please specify below)

### If "Other", please specify

Cherry Studio 

### Prompt or Input

N/A

### Expected Response

N/A

### Actual Response

```
Unhandled exception. System.DllNotFoundException: Dll was not found.
   at Microsoft.Build.Locator.NativeMethods.hostfxr_resolve_sdk2(String exe_dir, Str

[Read the thread](https://github.com/NuGet/Home/issues/14677) · 2025-12-09 · closed · external user · 7 comments

The remaining reports are on [the project's issue tracker](https://github.com/NuGet/Home/issues).