Plan for NuGet in 2023

[JonDouglas]

Today we are excited to share with you the plan for NuGet and NuGet.org. This issue contains summary of the plan for the year and acts as a place for you to leave feedback.

This plan is a collection of input from many stakeholders and outlines where we intend to invest our time in NuGet and NuGet.org.

IMPORTANT
This plan is not a commitment; it will evolve as we continue to learn throughout the release. Some things that are not currently planned for NuGet may get pulled in. Some things currently planned may even be pushed out.

General information

NuGet has a major release following NuGet 6.4 and is currently scheduled for release in November 2023 at the same time as .NET 8.

NuGet will align with the .NET support policy and will therefore be a long-term support (LTS) release.

NuGet.org does not currently follow any specific schedule and releases features & bug fixes regularly throughout the year.

Breaking changes

NuGet may contain a small number of breaking changes as we continue to evolve NuGet with the .NET platform. Our goal is to minimize breaking changes as much as possible to keep you productive when upgrading. You'll be able to find them at the .NET 8 Breaking Changes.

Themes

The large investments in NuGet are the following themes:

Highly Requested Features

As always, a major input into our planning process comes from votes (👍) for features on GitHub.

These features are areas we are actively engaged in with regards to designing, implementing, and polishing the respective experiences for.

Security

• [Epic] NuGet Package Vulnerability Auditing #8087
• nuget source password encryption story #1851
• Signing: re-enable signed package verification on Linux and macOS #11262
• Design Package Source mapping package installation experiences epic #10730
• The http removal will break private NuGet servers (NU1803 warning) #12015
• NuGet cannot restore from HTTPS sources that have SSL certificate problems #4387
• [Epic] Support SBOMs for NuGet packages #12497

Tooling

• [Epic]: Tooling support for central package management #9015

Season of Giving

• Machine readable output for dotnet list package #7752
• 'GeneratePathProperty' does not work on 'PackageDownload' #8476
• Suggestion: NuGet config -list command to list configuration file locations #8420
• Deprecate NuGet.exe list in favor of NuGet.exe search #7912
• PrivateAssets and ExcludeAssets should be independent #6938
• Why is there no 'dotnet nuget setApiKey' command? #6437
• project.assets.json should indicate "analyzer" assets like "compile" and "runtime" #6279
• Support for dotnet search command (equivalent to nuget.exe list, later search) #6060
• NuGet locals command should allow deleting specific packages from NuGet global packages folder #5713
• Allow an upper limit Version for ProjectReference references in nupkg from dotnet pack to support semver #5556
• exact match and version search for nuget.exe list command #5138
• dotnet-nuget-push: does not support --config-file included in examples #4879
• Expand dotnet nuget to include more of the commands that nuget.exe has such as dotnet nuget config  #4855
• allow dotnet pack to pack nuspec file without needing a csproj file #4254
• support for bulk-updating references into csproj from commandline(s) #4103

NuGet Gallery

• Package discovery: Show and search by TFM/package-compatibility  NuGetGallery#3098
• [UI]: Add a dark mode/theme to nuget.org NuGetGallery#8773
• [Feature]: Show and score packages based on popularity, quality, maintenance, and community. NuGetGallery#8964
• [Feature]: Provide capability to mark a package as "needs funding" / include "sponsor URL" NuGetGallery#9339
• Flow deprecation and vulnerability info into search service NuGetGallery#7297

.NET Platforms and Ecosystem

Much of the work planned for NuGet involves improving the package management experience for .NET across different platforms and ecosystem. This involves work in NuGet to ensure a great experience across .NET technologies.

• Nuget restore/package download C# API #10430
• Switch batching method in order to get all build errors from multi-targeted projects #10872
• Treat TargetFramework(s) values as aliases #5154

Migrating to .NET

NuGet has always supported many scenarios for package management. In our continued efforts to help you migrate to the latest version of .NET, we will be working on improvements to the Upgrade Assistant and core package management experiences to help you migrate your project to use the latest version of NuGet.

Performance

With each new release of NuGet & Visual Studio comes a plethora of performance improvements when restoring NuGet packages, managing project dependencies, and browsing for the next great package to include in your solution. We will continue to invest time to improve your experiences every .NET & Visual Studio release.

Feedback

Your feedback is important to us. The best way to indicate the importance of an issue is to vote (👍) for that issue on GitHub and Visual Studio Developer Community. We use this data to help us with our regular planning so we can work on the things that matter most to you.

Please comment on this issue if you believe we are missing something that is critical for NuGet, or are focusing on the wrong areas. Give us a little bit of context as to why you believe so and feel free to upvote each other's comments to help us make changes to our future plans.

Huge thanks to @ajcvickers and the Entity Framework Core team for a wonderful format and forum to discuss product plans in OSS. 🎉

Last year's plan can be found in #11571

[msftbot]

@JonDouglas Issue is missing Type label, remember to add a Type label

[msftbot]

@JonDouglas Issue is missing Type label, remember to add a Type label

[marco-carvalho]

@JonDouglas any chance of #4387 being prioritized?

[JonDouglas]

@marco-carvalho I believe that one and #12015 are related. Can you check if that's the case? Will add them both until we de-dupe.

[Varorbc]

Could you please include #12473 in the plan?

[JonDouglas]

@Varorbc we will triage this issue, but right now it is too new to include in the plan although it is an excellent suggestion.

[zlsmith86]

Can dotnet/sdk#9500 be included as well?

[baronfel]

@zlsmith86 dotnet/sdk#9500 (and dotnet tools generally) is owned by the SDK team, not the NuGet team, and so isn't in scope for NuGet's 2023 plan. We (the SDK team) are actively working on it though - see the linked PR from that issue.

[smarts]

Can #1851 and #6437 be handled together? Seems like the problems are fairly similar, no?

It's not clear to me why 6437 is not categorized under Security, and why it's not prioritized higher. It's got more 👍🏼 votes than nearly all of the items in that category.

[zivkan]

@smarts I think that #12539 is a better solution than #6437, at least for CI scenarios. It should also be much easier to implement. Unfortunately I have too many other higher priority things to have worked on it myself yet, but I think it might be simple enough for someone else to contribute, if someone wants to try before I, or someone else in the team, finds time to do it ourselves.