NullReferenceException with incorrect package source in NuGet.Config - local package source and protocolversion attribute

[dtivel]

Repro steps:

1. Create a C# class library project.
2. Add a package reference (e.g.: Newtonsoft.Json).
3. Save the solution.
4. Exit Visual Studio.
5. Delete the project's .\packages directory.
6. Create a NuGet.Config file with the following contents:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <clear />
    <add key="CSV sources" value="file://C:\packages,https://api.nuget.org/v3/index.json" protocolVersion="3" />
  </packageSources>
</configuration>

7. Open a command prompt and path to the directory which contains the .sln file.
8. Execute:

nuget.exe restore -ConfigFile <PathToNuGetConfigFile>

Result:

MSBuild auto-detection: using msbuild version '14.0' from 'C:\Program Files (x86)\MSBuild\14.0\bin'.
Restoring NuGet package Newtonsoft.Json.9.0.1.
WARNING: Unable to find version '9.0.1' of package 'Newtonsoft.Json'.
  file://C:\packages,https://api.nuget.org/v3/index.json: Object reference not set to an instance of an object.


Errors in packages.config projects
    Unable to find version '9.0.1' of package 'Newtonsoft.Json'.
      file://C:\packages,https://api.nuget.org/v3/index.json: Object reference not set to an instance of an object.

NuGet Config files used:
    C:\repro\NuGet.Config
    C:\Users\dtivel\AppData\Roaming\NuGet\NuGet.Config
    C:\ProgramData\nuget\Config\Microsoft.VisualStudio.Offline.config

Feeds used:
    file://C:\packages,https://api.nuget.org/v3/index.json

The visible NullReferenceException exception reproes on 3.6.0 beta 1, 3.5.0, 3.4.4, but not 3.3.0.

Observation:
The -Source command line option without the project's NuGet.Config file handles the input more gracefully.

nuget.exe restore -Source file://C:\packages,https://api.nuget.org/v3/index.json

MSBuild auto-detection: using msbuild version '14.0' from 'C:\Program Files (x86)\MSBuild\14.0\bin'.
Restoring NuGet package Newtonsoft.Json.9.0.1.
WARNING: Unable to find version '9.0.1' of package 'Newtonsoft.Json'.
  file://C:\packages,https://api.nuget.org/v3/index.json: Failed to retrieve information from remote source 'file://C:\packages,https://api.nuget.org/v3/index.json'.
  The given path's format is not supported.


Errors in packages.config projects
    Unable to find version '9.0.1' of package 'Newtonsoft.Json'.
      file://C:\packages,https://api.nuget.org/v3/index.json: Failed to retrieve information from remote source 'file://C:\packages,https://api.nuget.org/v3/index.json'.
      The given path's format is not supported.

NuGet Config files used:
    C:\Users\dtivel\AppData\Roaming\NuGet\NuGet.Config
    C:\ProgramData\nuget\Config\Microsoft.VisualStudio.Offline.config

Feeds used:
    file://C:\packages,https://api.nuget.org/v3/index.json

[AArnott]

Just hit this with nuget.exe 4.9.2.5706 after adding this local package source that accidentally retained protocolVersion="3" from another line:

    <add key="local" value="D:\git\DevCore\bin\Debug\Packages" protocolVersion="3" />

nuget restore C:\Users\andarno\source\repos\SampleServiceHubUser
MSBuild auto-detection: using msbuild version '16.1.68.42340' from 'C:\Program Files (x86)\Microsoft Visual Studio\2019\Preview\MSBuild\Current\bin'.
Restoring packages for C:\Users\andarno\source\repos\SampleServiceHubUser\SampleServiceHubUser\SampleServiceHubUser.csproj...
Restoring packages for C:\Users\andarno\source\repos\SampleServiceHubUser\EchoService\EchoService.csproj...
Object reference not set to an instance of an object.

Note the unhelpful error message. I was only able to determine the root cause being the inappropriate xml attribute after attaching a debugger to nuget.exe and observing first chance exceptions.

[Rekkonnect]

I'm encountering this in a private NuGet feed in the Browse tab. On some projects that use packages from that feed, it works just fine. On others it shows just this error.

For my case at least, the private feed contains packages that contain package references to other packages, though those are from other feeds. For example, I have a package called Custom.Package in my private feed, which contains a reference to Newtonsoft.Json from NuGet Gallery. The information about where to retrieve the package from is not contained in the package reference, so it has to do guess work and assume that the package is retrievable and it's up to the user to include the necessary package feeds.

On that regard, this shows that the package manager is not quite resilient. One minor inconvenience tears the entire UX apart, and tells the user nothing but a message that the process failed. Ironically, when I build the solution with the proper package sources enabled, it succeeds. It's only the UI that shows that an error occurred while browsing the feed's packages.

At least add the ability to show the full stack trace in the output. This classic null reference error says absolutely nothing other than a middle finger to the user.