dotnet Aspire SDK, lock and private feed combination causes 401 responses

[herbatnik]

How are you running Renovate?

Self-hosted Renovate CLI

Which platform you running Renovate on?

Other (please specify) Azure DevOps

Which version of Renovate are you using?

43.212.2

Please tell us more about your question or problem

See minimal repro: Test.Aspire.AppHost.zip

When using an aspire project that has Aspire SDK in csproj:

<Project Sdk="Aspire.AppHost.Sdk/13.4.2">

with combination of private azure feed (that has nuget.org configured as an upstream) AND package source map that directs all packages at private feed

with combination of use of packages.lock.json file

I get the following logs in the self-hosted renovate runs:

2026-06-04T14:21:03.6327843Z DEBUG: rawExec err (repository=PROJECT/repo-name, branch=feature/renovate/major-refit-monorepo)
2026-06-04T14:21:03.6328200Z        "err": {
2026-06-04T14:21:03.6328568Z          "cmd": "dotnet restore Test.Aspire.AppHost/Test.Aspire.AppHost.csproj --force-evaluate --configfile /rnvt/cache/__renovate-private-cache/nuget/nuget.config",
2026-06-04T14:21:03.6329249Z          "stderr": "",
2026-06-04T14:21:03.6333410Z          "stdout": "Retrying 'FindPackagesByIdAsync' for source 'https://pkgs.dev.azure.com/ORGANIZATION/00000000-0000-0000-0000-000000000001/_packaging/00000000-0000-0000-0000-000000000002/nuget/v3/flat2/aspire.apphost.sdk/index.json'.\nResponse status code does not indicate success: 401 (Unauthorized).\nRetrying 'FindPackagesByIdAsync' for source 'https://pkgs.dev.azure.com/ORGANIZATION/00000000-0000-0000-0000-000000000001/_packaging/00000000-0000-0000-0000-000000000002/nuget/v3/flat2/aspire.apphost.sdk/index.json'.\nResponse status code does not indicate success: 401 (Unauthorized).\nRetrying 'FindPackagesByIdAsync' for source 'https://pkgs.dev.azure.com/ORGANIZATION/00000000-0000-0000-0000-000000000001/_packaging/00000000-0000-0000-0000-000000000002/nuget/v3/flat2/aspire.apphost.sdk/index.json'.\nResponse status code does not indicate success: 401 (Unauthorized).\nRetrying 'FindPackagesByIdAsync' for source 'https://pkgs.dev.azure.com/ORGANIZATION/00000000-0000-0000-0000-000000000001/_packaging/00000000-0000-0000-0000-000000000002/nuget/v3/flat2/aspire.apphost.sdk/index.json'.\nResponse status code does not indicate success: 401 (Unauthorized).\nRetrying 'FindPackagesByIdAsync' for source 'https://pkgs.dev.azure.com/ORGANIZATION/00000000-0000-0000-0000-000000000001/_packaging/00000000-0000-0000-0000-000000000002/nuget/v3/flat2/aspire.apphost.sdk/index.json'.\nResponse status code does not indicate success: 401 (Unauthorized).\n/tmp/renovate/repos/azure/PROJECT/repo-name/Test.Aspire.AppHost/Test.Aspire.AppHost.csproj : error : Could not resolve SDK \"Aspire.AppHost.Sdk\". Exactly one of the probing messages below indicates why we could not resolve the SDK. Investigate and resolve that message to correctly specify the SDK.\n/tmp/renovate/repos/azure/PROJECT/repo-name/Test.Aspire.AppHost/Test.Aspire.AppHost.csproj : error :   SDK resolver \"Microsoft.DotNet.MSBuildWorkloadSdkResolver\" returned null.\n/tmp/renovate/repos/azure/PROJECT/repo-name/Test.Aspire.AppHost/Test.Aspire.AppHost.csproj : error :   Unable to find package Aspire.AppHost.Sdk. No packages exist with this id in source(s): iServer365. PackageSourceMapping is enabled, the following source(s) were not considered: nuget.org.\n/tmp/renovate/repos/azure/PROJECT/repo-name/Test.Aspire.AppHost/Test.Aspire.AppHost.csproj : warning :     [CredentialProvider]Warning: Cannot persist Microsoft authentication token cache securely!\n/tmp/renovate/repos/azure/PROJECT/repo-name/Test.Aspire.AppHost/Test.Aspire.AppHost.csproj : warning :     [CredentialProvider]Warning: Using plain-text fallback token cache\n/tmp/renovate/repos/azure/PROJECT/repo-name/Test.Aspire.AppHost/Test.Aspire.AppHost.csproj : warning : The plugin credential provider could not acquire credentials. Authentication may require manual action. Consider re-running the command with --interactive for `dotnet`, /p:NuGetInteractive=\"true\" for MSBuild or removing the -NonInteractive switch for `NuGet`\n/tmp/renovate/repos/azure/PROJECT/repo-name/Test.Aspire.AppHost/Test.Aspire.AppHost.csproj : warning : The plugin credential provider could not acquire credentials. Authentication may require manual action. Consider re-running the command with --interactive for `dotnet`, /p:NuGetInteractive=\"true\" for MSBuild or removing the -NonInteractive switch for `NuGet`\n/tmp/renovate/repos/azure/PROJECT/repo-name/Test.Aspire.AppHost/Test.Aspire.AppHost.csproj : warning : The plugin credential provider could not acquire credentials. Authentication may require manual action. Consider re-running the command with --interactive for `dotnet`, /p:NuGetInteractive=\"true\" for MSBuild or removing the -NonInteractive switch for `NuGet`\n/tmp/renovate/repos/azure/PROJECT/repo-name/Test.Aspire.AppHost/Test.Aspire.AppHost.csproj : warning : The plugin credential provider could not acquire credentials. Authentication may require manual action. Consider re-running the command with --interactive for `dotnet`, /p:NuGetInteractive=\"true\" for MSBuild or removing the -NonInteractive switch for `NuGet`\n/tmp/renovate/repos/azure/PROJECT/repo-name/Test.Aspire.AppHost/Test.Aspire.AppHost.csproj : warning : Failed to retrieve information about 'Aspire.AppHost.Sdk' from remote source 'https://pkgs.dev.azure.com/ORGANIZATION/00000000-0000-0000-0000-000000000001/_packaging/00000000-0000-0000-0000-000000000002/nuget/v3/flat2/aspire.apphost.sdk/index.json'.\n/tmp/renovate/repos/azure/PROJECT/repo-name/Test.Aspire.AppHost/Test.Aspire.AppHost.csproj : warning : Failed to retrieve information about 'Aspire.AppHost.Sdk' from remote source 'https://pkgs.dev.azure.com/ORGANIZATION/00000000-0000-0000-0000-000000000001/_packaging/00000000-0000-0000-0000-000000000002/nuget/v3/flat2/aspire.apphost.sdk/index.json'.\n/tmp/renovate/repos/azure/PROJECT/repo-name/Test.Aspire.AppHost/Test.Aspire.AppHost.csproj : error MSB4236: The SDK 'Aspire.AppHost.Sdk/13.2.4' specified could not be found.\n",
2026-06-04T14:21:03.6338248Z          "options": {
2026-06-04T14:21:03.6338481Z            "cwd": "/tmp/renovate/repos/azure/PROJECT/repo-name",
2026-06-04T14:21:03.6338702Z            "env": [
2026-06-04T14:21:03.6338890Z              "NUGET_PACKAGES",
2026-06-04T14:21:03.6339096Z              "MSBUILDDISABLENODEREUSE",
2026-06-04T14:21:03.6339298Z              "HOME",
2026-06-04T14:21:03.6339477Z              "PATH",
2026-06-04T14:21:03.6339655Z              "LC_ALL",
2026-06-04T14:21:03.6339850Z              "LANG",
2026-06-04T14:21:03.6340040Z              "CONTAINERBASE_CACHE_DIR"
2026-06-04T14:21:03.6340224Z            ],
2026-06-04T14:21:03.6340402Z            "maxBuffer": 10485760,
2026-06-04T14:21:03.6340591Z            "timeout": 900000,
2026-06-04T14:21:03.6340790Z            "stdin": "pipe",
2026-06-04T14:21:03.6340971Z            "stdout": "pipe",
2026-06-04T14:21:03.6341161Z            "stderr": "pipe"
2026-06-04T14:21:03.6341344Z          },
2026-06-04T14:21:03.6341524Z          "exitCode": 1,
2026-06-04T14:21:03.6341707Z          "name": "ExecError",
2026-06-04T14:21:03.6342044Z          "message": "Command failed: dotnet restore Test.Aspire.AppHost/Test.Aspire.AppHost.csproj --force-evaluate --configfile /rnvt/cache/__renovate-private-cache/nuget/nuget.config\n"
2026-06-04T14:21:03.6342355Z        },
2026-06-04T14:21:03.6342532Z        "durationMs": 7580
2026-06-04T14:21:03.6342853Z        ExecError: Command failed: dotnet restore Test.Aspire.AppHost/Test.Aspire.AppHost.csproj --force-evaluate --configfile /rnvt/cache/__renovate-private-cache/nuget/nuget.config
2026-06-04T14:21:03.6343180Z        
2026-06-04T14:21:03.6343411Z            at ChildProcess.<anonymous> (file:///usr/local/renovate/lib/util/exec/common.ts:169:13)
2026-06-04T14:21:03.6343786Z            at ChildProcess.emit (node:events:521:24)
2026-06-04T14:21:03.6344025Z            at ChildProcess.emit (node:domain:489:12)
2026-06-04T14:21:03.6344302Z            at Process.ChildProcess._handle.onexit (node:internal/child_process:295:12)

Logs (if relevant)

Logs

Replace this text with your logs, between the starting and ending triple backticks

[RahulGautamSingh]

Issue created: #43985

PR welcome!