Remote NuGet package cached after unlisting

yaakov.smith_7984

Hi,

We recently had a case where Visual Studio as well as some internal tooling was recommending that our projects update System.CompnentModel.Composition to version 2010.2.11.1, which looks to have been built in either 2013 or 2018 and has been unlisted for a long time.

It looks like somehow ProGet cached this version and did not keep track that this package was unlisted by the public Gallery.

Deleting the cached package from ProGet reset it and now it is recommending 9.0.10 as the highest available version again, which is correct.

Do you have any ideas how this would have happened and what can be done to prevent it occurring again on the same or other packages in future?

stevedennis

Hi @yaakov-smith_7984 ,

This behavior is expected and by design. "Deprecation" and "Unlisted" are server-side metadata (i.e. stored in the remote repository, not the package itself), and once a package is brought into to a different server (i.e. ProGet), it's "disconnected" from the other server.

That being said, there is a feature in ProGet that can routinely "sync" this server-side metadata:

This feature obviously comes with some performance costs, though you'd really have to enable it to see if that has any impact on operation.

Another approach is to use a retention policy that deletes cached packages older than 90 days.

Thanks,
Steve