v2.1.0

NuGet Package Manager 2.1.0

Prerelease becomes response

• Toggling Prerelease clears the stale count immediately instead of keeping the previous filter's number, and the Updates tab badge shows that it is recalculating.
• Both the Updates tab badge and the Activity Bar badge now follow the new filter, including when the Updates tab is not open.
• A Prerelease change rechecks updates for the newly selected filter; switching back rechecks again.

Live update-check progress

• The Updates tab no longer sits on an indefinite Checking for updates… spinner. It shows the current stage and item counts while the scan runs:
  • Resolving package sources…
  • Parsing projects (2/8)
  • Checking latest versions (23/60)
  • Checking dependency constraints (3/5)
  • Preparing results…
• A determinate progress bar tracks overall completion, so a slow NuGet source no longer looks like a hang.
• Progress polling stops as soon as the scan finishes, fails or the view is closed.

Everything in 2.0.0

• Dependency-aware update suggestions with a Dependency conflicts section and restore rollback.
• Per-target-framework Central Package Management resolution, including framework-scoped versions.
• Faster Updates scanning: persisted last scan, disk-cached NuGet HTTP responses, reused registration dependency groups and configurable concurrency.

v2.0.0

NuGet Package Manager 2.0.0

Breaking: new identity

• The extension is now NuGet Package Manager for Visual Studio Code (nugetpackagemanager, ID I-Synergy.nugetpackagemanager). This is a new Marketplace listing; the earlier build under the previous ID was unpublished.
• Commands, the webview panel, views and settings moved to the nugetpackagemanager.* namespace.
• The legacy i-synergy-nugetpackagemanager.* settings and nugetpackage.* command IDs were removed without compatibility shims, so existing keybindings and settings must be recreated.
• The view container ID changed, so its Activity Bar placement resets once.
• The Marketplace treats this as a new listing, so existing installations will not auto-update.

Dependency-aware updates

• Restore failures now surface the real dotnet diagnostics, including the full NU1107 constraint chain and the dependencies that declare the conflicting ranges.
• Update suggestions are capped to versions accepted by installed dependencies, using project.assets.json and NuGet dependency metadata.
• Unsafe versions appear in a Dependency conflicts section with the blocked version and the packages or ranges that pin it; the latest-overall action remains an explicit override.
• A failed restore after a single install, update or uninstall rolls the project file and Directory.Packages.props back instead of leaving the workspace modified.
• The extension restores after a write and never invokes dotnet build.

Faster updates

• The Updates tab paints the last persisted scan immediately and refreshes in the background; selections survive the refresh.
• NuGet HTTP responses are cached on disk for 30 minutes under the extension's global storage, and Reload clears the cache.
• dependencyGroups embedded in registration data are reused, so package details and constraint checks no longer issue a second request.
• Constraint checks fetch metadata only for packages that directly declare the dependency, instead of the whole transitive closure.
• Latest-version check concurrency is configurable through nugetpackagemanager.updateCheckConcurrency (default 8).

Diagnostics

• Per-phase timings for the Updates scan are logged: project parse, framework sources, latest-version checks and constraint checks.

v1.2.14

NuGet Package Manager 1.2.14

Updates

• Each Updates group has its own select/deselect-all checkbox.

• Project and package data now refresh immediately after a successful update.

Local Package Sources

• Local folder feeds are supported by scanning .nupkg files and reading .nuspec metadata.
• Fixes Unsupported protocol c: when a machine NuGet.config contains an offline packages folder.

Framework Selection

• Platform TFMs (windows/android/ios) are grouped under their base .NET line.
• Shared is a separate selector option and is not updated with a .NET-specific run.
• One global framework selector now serves Installed, Updates and Consolidate.
• Updates scrolling and installed-framework availability are fixed.

Fixes and UI

• Excluded all dot-directories from project discovery and cleanup scans.

• Hard-excluded .ai/ and .reasonix/ from all scans; malformed scratch projects no longer break the Cleanup report.

• Fixed the invisible NuGet tab icon in dark themes with theme-aware icons.

• Added a guarded literal TFM fast path for faster project loading.

• Fixed the literal false text shown while projects are loading.

• Added an assets-based target-framework fast path to avoid the long first-load delay in large CPM workspaces.

• Fixed remaining multi-TFM gaps in Consolidate and Vulnerabilities.

• Added the framework selector to Consolidate.

• Added the mandatory multi-TFM regression checklist for future changes.

• Fixed multi-target CPM packages disappearing from Updates on net11.0.

• Added the framework selector to Updates for per-framework review and updates.

• Added a Projects loading indicator, kept the previous list during refresh, and collapsed the Projects sidebar by default.

Documentation

• Added a real VS Code screenshot showing the NuGet Activity Bar/sidebar launcher.
• Fixed README TOC anchors and aligned the workflow sections with the actual tab order.
• Refreshed the README for the full-page workspace, Activity Bar badge and background checks, transactional updates, Cleanup tab, transitive vulnerabilities, global vulnerability banner and solution-wide removal.
• Regenerated screenshots and the demo GIF for the current marketplace-style UI.

Maintenance

• Aligned production/test TypeScript scopes and added an ESLint-specific tsconfig.
• Aligned dependency peers so npm ci no longer needs legacy flags.
• npm audit --audit-level=high passes in CI.

Highlights

• Full-page package workspace — the NuGet UI now opens in an editor tab instead of the terminal area. A NuGet icon in the Activity Bar opens or reveals it, with a compact sidebar launcher.
• Marketplace-style interface — rounded cards, grouped framework sections, pill tabs, richer package details and theme-aware surfaces across all screens.
• Cleanup tab — replaces Remove-UnusedPackages.ps1. It reports unused PackageVersion entries, shows packages used but missing from Directory.Packages.props, backs up each props file, and removes unused entries across conditional groups.
• Solution-wide package removal — remove a package from every project that references it, alongside the existing per-project uninstall.
• Transactional updates — updates are written one package at a time, restored once after the full set, and rolled back if a write or restore fails.
• Deeper vulnerability scanning — transitive packages from project.assets.json are included, marked as transitive, and shown with the direct packages that pull them in. A yellow banner appears across all tabs when vulnerabilities exist.
• Update badge — the Activity Bar icon shows the number of available updates. Checks run from the extension host every 15 minutes while the icon is visible, even when the page is closed.

Multi-framework CPM

• Conditional ItemGroups are resolved against each project's real target frameworks instead of using first-match attribution.
• Negated conditions are evaluated and labelled distinctly, e.g. not net11.0.
• Framework lines are never consolidated accidentally; consolidation is scoped to one condition and target framework.
• Runtime-aligned packages stay on the target framework's major line, with the overall latest version available as an explicit action.

Reliability and security

• CPM writes use snapshots, single-read/write batches, verification and a per-file mutex.
• Stale global PackageVersion entries are removed when the last project reference is uninstalled.
• Project paths, package IDs, versions and source URLs are validated before writes.
• Password scripts require a trusted workspace and a machine-scoped allowlist.
• Workspace %VAR% expansion is disabled for credentials.
• RPC cancellation and dotnet process timeouts release locks and stop work cleanly.

Upgrade notes

• The NuGet view is no longer in the bottom panel. Use the Activity Bar icon or NuGet Package Manager: Open Packages.
• The Activity Bar icon is hidden in workspaces without a supported .csproj / .fsproj / .vbproj.
• Bulk update behavior is now transactional; on restore failure, file snapshots are restored and the operation reports a rollback.
• The Cleanup tab creates timestamped backups before modifying Directory.Packages.props.

Fixes

• Corrected per-framework Installed, Updates, Consolidate and Vulnerabilities results.
• Fixed ambiguous updates, stale row removal, vulnerability case matching, SemVer latest selection, RPC cancellation and parallel CPM write corruption.
• Fixed documentation, screenshots, packaging and CI release gating.

Full changelog: CHANGELOG.md

v1.2.13

NuGet Package Manager 1.2.13

Updates

• Project and package data now refresh immediately after a successful update.

Local Package Sources

• Local folder feeds are supported by scanning .nupkg files and reading .nuspec metadata.
• Fixes Unsupported protocol c: when a machine NuGet.config contains an offline packages folder.

Framework Selection

• Platform TFMs (windows/android/ios) are grouped under their base .NET line.
• Shared is a separate selector option and is not updated with a .NET-specific run.
• One global framework selector now serves Installed, Updates and Consolidate.
• Updates scrolling and installed-framework availability are fixed.

Fixes and UI

• Excluded all dot-directories from project discovery and cleanup scans.

• Hard-excluded .ai/ and .reasonix/ from all scans; malformed scratch projects no longer break the Cleanup report.

• Fixed the invisible NuGet tab icon in dark themes with theme-aware icons.

• Added a guarded literal TFM fast path for faster project loading.

• Fixed the literal false text shown while projects are loading.

• Added an assets-based target-framework fast path to avoid the long first-load delay in large CPM workspaces.

• Fixed remaining multi-TFM gaps in Consolidate and Vulnerabilities.

• Added the framework selector to Consolidate.

• Added the mandatory multi-TFM regression checklist for future changes.

• Fixed multi-target CPM packages disappearing from Updates on net11.0.

• Added the framework selector to Updates for per-framework review and updates.

• Added a Projects loading indicator, kept the previous list during refresh, and collapsed the Projects sidebar by default.

Documentation

• Added a real VS Code screenshot showing the NuGet Activity Bar/sidebar launcher.
• Fixed README TOC anchors and aligned the workflow sections with the actual tab order.
• Refreshed the README for the full-page workspace, Activity Bar badge and background checks, transactional updates, Cleanup tab, transitive vulnerabilities, global vulnerability banner and solution-wide removal.
• Regenerated screenshots and the demo GIF for the current marketplace-style UI.

Maintenance

• Aligned production/test TypeScript scopes and added an ESLint-specific tsconfig.
• Aligned dependency peers so npm ci no longer needs legacy flags.
• npm audit --audit-level=high passes in CI.

Highlights

• Full-page package workspace — the NuGet UI now opens in an editor tab instead of the terminal area. A NuGet icon in the Activity Bar opens or reveals it, with a compact sidebar launcher.
• Marketplace-style interface — rounded cards, grouped framework sections, pill tabs, richer package details and theme-aware surfaces across all screens.
• Cleanup tab — replaces Remove-UnusedPackages.ps1. It reports unused PackageVersion entries, shows packages used but missing from Directory.Packages.props, backs up each props file, and removes unused entries across conditional groups.
• Solution-wide package removal — remove a package from every project that references it, alongside the existing per-project uninstall.
• Transactional updates — updates are written one package at a time, restored once after the full set, and rolled back if a write or restore fails.
• Deeper vulnerability scanning — transitive packages from project.assets.json are included, marked as transitive, and shown with the direct packages that pull them in. A yellow banner appears across all tabs when vulnerabilities exist.
• Update badge — the Activity Bar icon shows the number of available updates. Checks run from the extension host every 15 minutes while the icon is visible, even when the page is closed.

Multi-framework CPM

• Conditional ItemGroups are resolved against each project's real target frameworks instead of using first-match attribution.
• Negated conditions are evaluated and labelled distinctly, e.g. not net11.0.
• Framework lines are never consolidated accidentally; consolidation is scoped to one condition and target framework.
• Runtime-aligned packages stay on the target framework's major line, with the overall latest version available as an explicit action.

Reliability and security

• CPM writes use snapshots, single-read/write batches, verification and a per-file mutex.
• Stale global PackageVersion entries are removed when the last project reference is uninstalled.
• Project paths, package IDs, versions and source URLs are validated before writes.
• Password scripts require a trusted workspace and a machine-scoped allowlist.
• Workspace %VAR% expansion is disabled for credentials.
• RPC cancellation and dotnet process timeouts release locks and stop work cleanly.

Upgrade notes

• The NuGet view is no longer in the bottom panel. Use the Activity Bar icon or NuGet Package Manager: Open Packages.
• The Activity Bar icon is hidden in workspaces without a supported .csproj / .fsproj / .vbproj.
• Bulk update behavior is now transactional; on restore failure, file snapshots are restored and the operation reports a rollback.
• The Cleanup tab creates timestamped backups before modifying Directory.Packages.props.

Fixes

• Corrected per-framework Installed, Updates, Consolidate and Vulnerabilities results.
• Fixed ambiguous updates, stale row removal, vulnerability case matching, SemVer latest selection, RPC cancellation and parallel CPM write corruption.
• Fixed documentation, screenshots, packaging and CI release gating.

Full changelog: CHANGELOG.md

v1.2.12

NuGet Package Manager 1.2.12

Local Package Sources

• Local folder feeds are supported by scanning .nupkg files and reading .nuspec metadata.
• Fixes Unsupported protocol c: when a machine NuGet.config contains an offline packages folder.

Framework Selection

• Platform TFMs (windows/android/ios) are grouped under their base .NET line.
• Shared is a separate selector option and is not updated with a .NET-specific run.
• One global framework selector now serves Installed, Updates and Consolidate.
• Updates scrolling and installed-framework availability are fixed.

Fixes and UI

• Excluded all dot-directories from project discovery and cleanup scans.

• Hard-excluded .ai/ and .reasonix/ from all scans; malformed scratch projects no longer break the Cleanup report.

• Fixed the invisible NuGet tab icon in dark themes with theme-aware icons.

• Added a guarded literal TFM fast path for faster project loading.

• Fixed the literal false text shown while projects are loading.

• Added an assets-based target-framework fast path to avoid the long first-load delay in large CPM workspaces.

• Fixed remaining multi-TFM gaps in Consolidate and Vulnerabilities.

• Added the framework selector to Consolidate.

• Added the mandatory multi-TFM regression checklist for future changes.

• Fixed multi-target CPM packages disappearing from Updates on net11.0.

• Added the framework selector to Updates for per-framework review and updates.

• Added a Projects loading indicator, kept the previous list during refresh, and collapsed the Projects sidebar by default.

Documentation

• Added a real VS Code screenshot showing the NuGet Activity Bar/sidebar launcher.
• Fixed README TOC anchors and aligned the workflow sections with the actual tab order.
• Refreshed the README for the full-page workspace, Activity Bar badge and background checks, transactional updates, Cleanup tab, transitive vulnerabilities, global vulnerability banner and solution-wide removal.
• Regenerated screenshots and the demo GIF for the current marketplace-style UI.

Maintenance

• Aligned production/test TypeScript scopes and added an ESLint-specific tsconfig.
• Aligned dependency peers so npm ci no longer needs legacy flags.
• npm audit --audit-level=high passes in CI.

Highlights

• Full-page package workspace — the NuGet UI now opens in an editor tab instead of the terminal area. A NuGet icon in the Activity Bar opens or reveals it, with a compact sidebar launcher.
• Marketplace-style interface — rounded cards, grouped framework sections, pill tabs, richer package details and theme-aware surfaces across all screens.
• Cleanup tab — replaces Remove-UnusedPackages.ps1. It reports unused PackageVersion entries, shows packages used but missing from Directory.Packages.props, backs up each props file, and removes unused entries across conditional groups.
• Solution-wide package removal — remove a package from every project that references it, alongside the existing per-project uninstall.
• Transactional updates — updates are written one package at a time, restored once after the full set, and rolled back if a write or restore fails.
• Deeper vulnerability scanning — transitive packages from project.assets.json are included, marked as transitive, and shown with the direct packages that pull them in. A yellow banner appears across all tabs when vulnerabilities exist.
• Update badge — the Activity Bar icon shows the number of available updates. Checks run from the extension host every 15 minutes while the icon is visible, even when the page is closed.

Multi-framework CPM

• Conditional ItemGroups are resolved against each project's real target frameworks instead of using first-match attribution.
• Negated conditions are evaluated and labelled distinctly, e.g. not net11.0.
• Framework lines are never consolidated accidentally; consolidation is scoped to one condition and target framework.
• Runtime-aligned packages stay on the target framework's major line, with the overall latest version available as an explicit action.

Reliability and security

• CPM writes use snapshots, single-read/write batches, verification and a per-file mutex.
• Stale global PackageVersion entries are removed when the last project reference is uninstalled.
• Project paths, package IDs, versions and source URLs are validated before writes.
• Password scripts require a trusted workspace and a machine-scoped allowlist.
• Workspace %VAR% expansion is disabled for credentials.
• RPC cancellation and dotnet process timeouts release locks and stop work cleanly.

Upgrade notes

• The NuGet view is no longer in the bottom panel. Use the Activity Bar icon or NuGet Package Manager: Open Packages.
• The Activity Bar icon is hidden in workspaces without a supported .csproj / .fsproj / .vbproj.
• Bulk update behavior is now transactional; on restore failure, file snapshots are restored and the operation reports a rollback.
• The Cleanup tab creates timestamped backups before modifying Directory.Packages.props.

Fixes

• Corrected per-framework Installed, Updates, Consolidate and Vulnerabilities results.
• Fixed ambiguous updates, stale row removal, vulnerability case matching, SemVer latest selection, RPC cancellation and parallel CPM write corruption.
• Fixed documentation, screenshots, packaging and CI release gating.

Full changelog: CHANGELOG.md

v1.2.11

NuGet Package Manager 1.2.11

Framework Selection

• Platform TFMs (windows/android/ios) are grouped under their base .NET line.
• Shared is a separate selector option and is not updated with a .NET-specific run.
• One global framework selector now serves Installed, Updates and Consolidate.
• Updates scrolling and installed-framework availability are fixed.

Fixes and UI

• Excluded all dot-directories from project discovery and cleanup scans.

• Hard-excluded .ai/ and .reasonix/ from all scans; malformed scratch projects no longer break the Cleanup report.

• Fixed the invisible NuGet tab icon in dark themes with theme-aware icons.

• Added a guarded literal TFM fast path for faster project loading.

• Fixed the literal false text shown while projects are loading.

• Added an assets-based target-framework fast path to avoid the long first-load delay in large CPM workspaces.

• Fixed remaining multi-TFM gaps in Consolidate and Vulnerabilities.

• Added the framework selector to Consolidate.

• Added the mandatory multi-TFM regression checklist for future changes.

• Fixed multi-target CPM packages disappearing from Updates on net11.0.

• Added the framework selector to Updates for per-framework review and updates.

• Added a Projects loading indicator, kept the previous list during refresh, and collapsed the Projects sidebar by default.

Documentation

• Added a real VS Code screenshot showing the NuGet Activity Bar/sidebar launcher.
• Fixed README TOC anchors and aligned the workflow sections with the actual tab order.
• Refreshed the README for the full-page workspace, Activity Bar badge and background checks, transactional updates, Cleanup tab, transitive vulnerabilities, global vulnerability banner and solution-wide removal.
• Regenerated screenshots and the demo GIF for the current marketplace-style UI.

Maintenance

• Aligned production/test TypeScript scopes and added an ESLint-specific tsconfig.
• Aligned dependency peers so npm ci no longer needs legacy flags.
• npm audit --audit-level=high passes in CI.

Highlights

• Full-page package workspace — the NuGet UI now opens in an editor tab instead of the terminal area. A NuGet icon in the Activity Bar opens or reveals it, with a compact sidebar launcher.
• Marketplace-style interface — rounded cards, grouped framework sections, pill tabs, richer package details and theme-aware surfaces across all screens.
• Cleanup tab — replaces Remove-UnusedPackages.ps1. It reports unused PackageVersion entries, shows packages used but missing from Directory.Packages.props, backs up each props file, and removes unused entries across conditional groups.
• Solution-wide package removal — remove a package from every project that references it, alongside the existing per-project uninstall.
• Transactional updates — updates are written one package at a time, restored once after the full set, and rolled back if a write or restore fails.
• Deeper vulnerability scanning — transitive packages from project.assets.json are included, marked as transitive, and shown with the direct packages that pull them in. A yellow banner appears across all tabs when vulnerabilities exist.
• Update badge — the Activity Bar icon shows the number of available updates. Checks run from the extension host every 15 minutes while the icon is visible, even when the page is closed.

Multi-framework CPM

• Conditional ItemGroups are resolved against each project's real target frameworks instead of using first-match attribution.
• Negated conditions are evaluated and labelled distinctly, e.g. not net11.0.
• Framework lines are never consolidated accidentally; consolidation is scoped to one condition and target framework.
• Runtime-aligned packages stay on the target framework's major line, with the overall latest version available as an explicit action.

Reliability and security

• CPM writes use snapshots, single-read/write batches, verification and a per-file mutex.
• Stale global PackageVersion entries are removed when the last project reference is uninstalled.
• Project paths, package IDs, versions and source URLs are validated before writes.
• Password scripts require a trusted workspace and a machine-scoped allowlist.
• Workspace %VAR% expansion is disabled for credentials.
• RPC cancellation and dotnet process timeouts release locks and stop work cleanly.

Upgrade notes

• The NuGet view is no longer in the bottom panel. Use the Activity Bar icon or NuGet Package Manager: Open Packages.
• The Activity Bar icon is hidden in workspaces without a supported .csproj / .fsproj / .vbproj.
• Bulk update behavior is now transactional; on restore failure, file snapshots are restored and the operation reports a rollback.
• The Cleanup tab creates timestamped backups before modifying Directory.Packages.props.

Fixes

• Corrected per-framework Installed, Updates, Consolidate and Vulnerabilities results.
• Fixed ambiguous updates, stale row removal, vulnerability case matching, SemVer latest selection, RPC cancellation and parallel CPM write corruption.
• Fixed documentation, screenshots, packaging and CI release gating.

Full changelog: CHANGELOG.md

v1.2.10

NuGet Package Manager 1.2.10

Fixes and UI

• Excluded all dot-directories from project discovery and cleanup scans.

• Hard-excluded .ai/ and .reasonix/ from all scans; malformed scratch projects no longer break the Cleanup report.

• Fixed the invisible NuGet tab icon in dark themes with theme-aware icons.

• Added a guarded literal TFM fast path for faster project loading.

• Fixed the literal false text shown while projects are loading.

• Added an assets-based target-framework fast path to avoid the long first-load delay in large CPM workspaces.

• Fixed remaining multi-TFM gaps in Consolidate and Vulnerabilities.

• Added the framework selector to Consolidate.

• Added the mandatory multi-TFM regression checklist for future changes.

• Fixed multi-target CPM packages disappearing from Updates on net11.0.

• Added the framework selector to Updates for per-framework review and updates.

• Added a Projects loading indicator, kept the previous list during refresh, and collapsed the Projects sidebar by default.

Documentation

• Added a real VS Code screenshot showing the NuGet Activity Bar/sidebar launcher.
• Fixed README TOC anchors and aligned the workflow sections with the actual tab order.
• Refreshed the README for the full-page workspace, Activity Bar badge and background checks, transactional updates, Cleanup tab, transitive vulnerabilities, global vulnerability banner and solution-wide removal.
• Regenerated screenshots and the demo GIF for the current marketplace-style UI.

Maintenance

• Aligned production/test TypeScript scopes and added an ESLint-specific tsconfig.
• Aligned dependency peers so npm ci no longer needs legacy flags.
• npm audit --audit-level=high passes in CI.

Highlights

• Full-page package workspace — the NuGet UI now opens in an editor tab instead of the terminal area. A NuGet icon in the Activity Bar opens or reveals it, with a compact sidebar launcher.
• Marketplace-style interface — rounded cards, grouped framework sections, pill tabs, richer package details and theme-aware surfaces across all screens.
• Cleanup tab — replaces Remove-UnusedPackages.ps1. It reports unused PackageVersion entries, shows packages used but missing from Directory.Packages.props, backs up each props file, and removes unused entries across conditional groups.
• Solution-wide package removal — remove a package from every project that references it, alongside the existing per-project uninstall.
• Transactional updates — updates are written one package at a time, restored once after the full set, and rolled back if a write or restore fails.
• Deeper vulnerability scanning — transitive packages from project.assets.json are included, marked as transitive, and shown with the direct packages that pull them in. A yellow banner appears across all tabs when vulnerabilities exist.
• Update badge — the Activity Bar icon shows the number of available updates. Checks run from the extension host every 15 minutes while the icon is visible, even when the page is closed.

Multi-framework CPM

• Conditional ItemGroups are resolved against each project's real target frameworks instead of using first-match attribution.
• Negated conditions are evaluated and labelled distinctly, e.g. not net11.0.
• Framework lines are never consolidated accidentally; consolidation is scoped to one condition and target framework.
• Runtime-aligned packages stay on the target framework's major line, with the overall latest version available as an explicit action.

Reliability and security

• CPM writes use snapshots, single-read/write batches, verification and a per-file mutex.
• Stale global PackageVersion entries are removed when the last project reference is uninstalled.
• Project paths, package IDs, versions and source URLs are validated before writes.
• Password scripts require a trusted workspace and a machine-scoped allowlist.
• Workspace %VAR% expansion is disabled for credentials.
• RPC cancellation and dotnet process timeouts release locks and stop work cleanly.

Upgrade notes

• The NuGet view is no longer in the bottom panel. Use the Activity Bar icon or NuGet Package Manager: Open Packages.
• The Activity Bar icon is hidden in workspaces without a supported .csproj / .fsproj / .vbproj.
• Bulk update behavior is now transactional; on restore failure, file snapshots are restored and the operation reports a rollback.
• The Cleanup tab creates timestamped backups before modifying Directory.Packages.props.

Fixes

• Corrected per-framework Installed, Updates, Consolidate and Vulnerabilities results.
• Fixed ambiguous updates, stale row removal, vulnerability case matching, SemVer latest selection, RPC cancellation and parallel CPM write corruption.
• Fixed documentation, screenshots, packaging and CI release gating.

Full changelog: CHANGELOG.md

v1.2.9

NuGet Package Manager 1.2.9

Fixes and UI

• Hard-excluded .ai/ and .reasonix/ from all scans; malformed scratch projects no longer break the Cleanup report.

• Fixed the invisible NuGet tab icon in dark themes with theme-aware icons.

• Added a guarded literal TFM fast path for faster project loading.

• Fixed the literal false text shown while projects are loading.

• Added an assets-based target-framework fast path to avoid the long first-load delay in large CPM workspaces.

• Fixed remaining multi-TFM gaps in Consolidate and Vulnerabilities.

• Added the framework selector to Consolidate.

• Added the mandatory multi-TFM regression checklist for future changes.

• Fixed multi-target CPM packages disappearing from Updates on net11.0.

• Added the framework selector to Updates for per-framework review and updates.

• Added a Projects loading indicator, kept the previous list during refresh, and collapsed the Projects sidebar by default.

Documentation

• Added a real VS Code screenshot showing the NuGet Activity Bar/sidebar launcher.
• Fixed README TOC anchors and aligned the workflow sections with the actual tab order.
• Refreshed the README for the full-page workspace, Activity Bar badge and background checks, transactional updates, Cleanup tab, transitive vulnerabilities, global vulnerability banner and solution-wide removal.
• Regenerated screenshots and the demo GIF for the current marketplace-style UI.

Maintenance

• Aligned production/test TypeScript scopes and added an ESLint-specific tsconfig.
• Aligned dependency peers so npm ci no longer needs legacy flags.
• npm audit --audit-level=high passes in CI.

Highlights

• Full-page package workspace — the NuGet UI now opens in an editor tab instead of the terminal area. A NuGet icon in the Activity Bar opens or reveals it, with a compact sidebar launcher.
• Marketplace-style interface — rounded cards, grouped framework sections, pill tabs, richer package details and theme-aware surfaces across all screens.
• Cleanup tab — replaces Remove-UnusedPackages.ps1. It reports unused PackageVersion entries, shows packages used but missing from Directory.Packages.props, backs up each props file, and removes unused entries across conditional groups.
• Solution-wide package removal — remove a package from every project that references it, alongside the existing per-project uninstall.
• Transactional updates — updates are written one package at a time, restored once after the full set, and rolled back if a write or restore fails.
• Deeper vulnerability scanning — transitive packages from project.assets.json are included, marked as transitive, and shown with the direct packages that pull them in. A yellow banner appears across all tabs when vulnerabilities exist.
• Update badge — the Activity Bar icon shows the number of available updates. Checks run from the extension host every 15 minutes while the icon is visible, even when the page is closed.

Multi-framework CPM

• Conditional ItemGroups are resolved against each project's real target frameworks instead of using first-match attribution.
• Negated conditions are evaluated and labelled distinctly, e.g. not net11.0.
• Framework lines are never consolidated accidentally; consolidation is scoped to one condition and target framework.
• Runtime-aligned packages stay on the target framework's major line, with the overall latest version available as an explicit action.

Reliability and security

• CPM writes use snapshots, single-read/write batches, verification and a per-file mutex.
• Stale global PackageVersion entries are removed when the last project reference is uninstalled.
• Project paths, package IDs, versions and source URLs are validated before writes.
• Password scripts require a trusted workspace and a machine-scoped allowlist.
• Workspace %VAR% expansion is disabled for credentials.
• RPC cancellation and dotnet process timeouts release locks and stop work cleanly.

Upgrade notes

• The NuGet view is no longer in the bottom panel. Use the Activity Bar icon or NuGet Package Manager: Open Packages.
• The Activity Bar icon is hidden in workspaces without a supported .csproj / .fsproj / .vbproj.
• Bulk update behavior is now transactional; on restore failure, file snapshots are restored and the operation reports a rollback.
• The Cleanup tab creates timestamped backups before modifying Directory.Packages.props.

Fixes

• Corrected per-framework Installed, Updates, Consolidate and Vulnerabilities results.
• Fixed ambiguous updates, stale row removal, vulnerability case matching, SemVer latest selection, RPC cancellation and parallel CPM write corruption.
• Fixed documentation, screenshots, packaging and CI release gating.

Full changelog: CHANGELOG.md

v1.2.8

NuGet Package Manager 1.2.8

Fixes and UI

• Fixed the invisible NuGet tab icon in dark themes with theme-aware icons.

• Added a guarded literal TFM fast path for faster project loading.

• Fixed the literal false text shown while projects are loading.

• Added an assets-based target-framework fast path to avoid the long first-load delay in large CPM workspaces.

• Fixed remaining multi-TFM gaps in Consolidate and Vulnerabilities.

• Added the framework selector to Consolidate.

• Added the mandatory multi-TFM regression checklist for future changes.

• Fixed multi-target CPM packages disappearing from Updates on net11.0.

• Added the framework selector to Updates for per-framework review and updates.

• Added a Projects loading indicator, kept the previous list during refresh, and collapsed the Projects sidebar by default.

Documentation

• Added a real VS Code screenshot showing the NuGet Activity Bar/sidebar launcher.
• Fixed README TOC anchors and aligned the workflow sections with the actual tab order.
• Refreshed the README for the full-page workspace, Activity Bar badge and background checks, transactional updates, Cleanup tab, transitive vulnerabilities, global vulnerability banner and solution-wide removal.
• Regenerated screenshots and the demo GIF for the current marketplace-style UI.

Maintenance

• Aligned production/test TypeScript scopes and added an ESLint-specific tsconfig.
• Aligned dependency peers so npm ci no longer needs legacy flags.
• npm audit --audit-level=high passes in CI.

Highlights

• Full-page package workspace — the NuGet UI now opens in an editor tab instead of the terminal area. A NuGet icon in the Activity Bar opens or reveals it, with a compact sidebar launcher.
• Marketplace-style interface — rounded cards, grouped framework sections, pill tabs, richer package details and theme-aware surfaces across all screens.
• Cleanup tab — replaces Remove-UnusedPackages.ps1. It reports unused PackageVersion entries, shows packages used but missing from Directory.Packages.props, backs up each props file, and removes unused entries across conditional groups.
• Solution-wide package removal — remove a package from every project that references it, alongside the existing per-project uninstall.
• Transactional updates — updates are written one package at a time, restored once after the full set, and rolled back if a write or restore fails.
• Deeper vulnerability scanning — transitive packages from project.assets.json are included, marked as transitive, and shown with the direct packages that pull them in. A yellow banner appears across all tabs when vulnerabilities exist.
• Update badge — the Activity Bar icon shows the number of available updates. Checks run from the extension host every 15 minutes while the icon is visible, even when the page is closed.

Multi-framework CPM

• Conditional ItemGroups are resolved against each project's real target frameworks instead of using first-match attribution.
• Negated conditions are evaluated and labelled distinctly, e.g. not net11.0.
• Framework lines are never consolidated accidentally; consolidation is scoped to one condition and target framework.
• Runtime-aligned packages stay on the target framework's major line, with the overall latest version available as an explicit action.

Reliability and security

• CPM writes use snapshots, single-read/write batches, verification and a per-file mutex.
• Stale global PackageVersion entries are removed when the last project reference is uninstalled.
• Project paths, package IDs, versions and source URLs are validated before writes.
• Password scripts require a trusted workspace and a machine-scoped allowlist.
• Workspace %VAR% expansion is disabled for credentials.
• RPC cancellation and dotnet process timeouts release locks and stop work cleanly.

Upgrade notes

• The NuGet view is no longer in the bottom panel. Use the Activity Bar icon or NuGet Package Manager: Open Packages.
• The Activity Bar icon is hidden in workspaces without a supported .csproj / .fsproj / .vbproj.
• Bulk update behavior is now transactional; on restore failure, file snapshots are restored and the operation reports a rollback.
• The Cleanup tab creates timestamped backups before modifying Directory.Packages.props.

Fixes

• Corrected per-framework Installed, Updates, Consolidate and Vulnerabilities results.
• Fixed ambiguous updates, stale row removal, vulnerability case matching, SemVer latest selection, RPC cancellation and parallel CPM write corruption.
• Fixed documentation, screenshots, packaging and CI release gating.

Full changelog: CHANGELOG.md

v1.2.7

NuGet Package Manager 1.2.7

Fixes and UI

• Fixed the literal false text shown while projects are loading.

• Added an assets-based target-framework fast path to avoid the long first-load delay in large CPM workspaces.

• Fixed remaining multi-TFM gaps in Consolidate and Vulnerabilities.

• Added the framework selector to Consolidate.

• Added the mandatory multi-TFM regression checklist for future changes.

• Fixed multi-target CPM packages disappearing from Updates on net11.0.

• Added the framework selector to Updates for per-framework review and updates.

• Added a Projects loading indicator, kept the previous list during refresh, and collapsed the Projects sidebar by default.

Documentation

• Added a real VS Code screenshot showing the NuGet Activity Bar/sidebar launcher.
• Fixed README TOC anchors and aligned the workflow sections with the actual tab order.
• Refreshed the README for the full-page workspace, Activity Bar badge and background checks, transactional updates, Cleanup tab, transitive vulnerabilities, global vulnerability banner and solution-wide removal.
• Regenerated screenshots and the demo GIF for the current marketplace-style UI.

Maintenance

• Aligned production/test TypeScript scopes and added an ESLint-specific tsconfig.
• Aligned dependency peers so npm ci no longer needs legacy flags.
• npm audit --audit-level=high passes in CI.

Highlights

• Full-page package workspace — the NuGet UI now opens in an editor tab instead of the terminal area. A NuGet icon in the Activity Bar opens or reveals it, with a compact sidebar launcher.
• Marketplace-style interface — rounded cards, grouped framework sections, pill tabs, richer package details and theme-aware surfaces across all screens.
• Cleanup tab — replaces Remove-UnusedPackages.ps1. It reports unused PackageVersion entries, shows packages used but missing from Directory.Packages.props, backs up each props file, and removes unused entries across conditional groups.
• Solution-wide package removal — remove a package from every project that references it, alongside the existing per-project uninstall.
• Transactional updates — updates are written one package at a time, restored once after the full set, and rolled back if a write or restore fails.
• Deeper vulnerability scanning — transitive packages from project.assets.json are included, marked as transitive, and shown with the direct packages that pull them in. A yellow banner appears across all tabs when vulnerabilities exist.
• Update badge — the Activity Bar icon shows the number of available updates. Checks run from the extension host every 15 minutes while the icon is visible, even when the page is closed.

Multi-framework CPM

• Conditional ItemGroups are resolved against each project's real target frameworks instead of using first-match attribution.
• Negated conditions are evaluated and labelled distinctly, e.g. not net11.0.
• Framework lines are never consolidated accidentally; consolidation is scoped to one condition and target framework.
• Runtime-aligned packages stay on the target framework's major line, with the overall latest version available as an explicit action.

Reliability and security

• CPM writes use snapshots, single-read/write batches, verification and a per-file mutex.
• Stale global PackageVersion entries are removed when the last project reference is uninstalled.
• Project paths, package IDs, versions and source URLs are validated before writes.
• Password scripts require a trusted workspace and a machine-scoped allowlist.
• Workspace %VAR% expansion is disabled for credentials.
• RPC cancellation and dotnet process timeouts release locks and stop work cleanly.

Upgrade notes

• The NuGet view is no longer in the bottom panel. Use the Activity Bar icon or NuGet Package Manager: Open Packages.
• The Activity Bar icon is hidden in workspaces without a supported .csproj / .fsproj / .vbproj.
• Bulk update behavior is now transactional; on restore failure, file snapshots are restored and the operation reports a rollback.
• The Cleanup tab creates timestamped backups before modifying Directory.Packages.props.

Fixes

• Corrected per-framework Installed, Updates, Consolidate and Vulnerabilities results.
• Fixed ambiguous updates, stale row removal, vulnerability case matching, SemVer latest selection, RPC cancellation and parallel CPM write corruption.
• Fixed documentation, screenshots, packaging and CI release gating.

Full changelog: CHANGELOG.md