NuGet

This section documents MSBuild 18.9, the .NET SDK 10.0.402 (with its dotnet CLI) and NuGet 7.9, as published in the MSBuild, .NET and NuGet documentation on learn.microsoft.com, which is the reference these pages are written and verified against. Material about .NET 11 / NuGet 8.0 is still in preview and is always flagged as such — never presented as baseline.

This content was generated with the assistance of AI and should be verified against the official documentation before being relied on in production.

The C# Reference bibliography lists the reference material consulted while preparing these pages.

NuGet is the package manager of .NET: a package format (.nupkg, a ZIP with a manifest), a protocol for feeds, the public registry nuget.org, and the client built into the dotnet CLI, MSBuild, Visual Studio and nuget.exe. This group covers the consuming side — how packages are found, versioned, resolved, restored, configured, audited and trusted — at NuGet 7.9.0, the version in .NET SDK 10.0.400 and 10.0.402 (and in nuget.exe 7.9.0). Producing and publishing packages is the Publishing and Distributing Libraries group; the C# Reference’s introduction is Namespaces, Assemblies and Projects — NuGet Packages.

Creators, hosts and consumers

flowchart LR C["Creators
dotnet pack, nuget pack"] -- "push .nupkg" --> H["Hosts
nuget.org, Azure Artifacts,
GitHub Packages, BaGetter, folders"] H -- "search, restore" --> U["Consumers
dotnet restore, Visual Studio,
nuget.exe"] U -. "become creators of
their own packages" .-> C

A package declares its dependencies; a consuming project records only the packages it uses directly (PackageReference); restore computes the full graph and downloads what is missing, so packages are never committed to source control.

Source: What is NuGet: The flow of packages, Managing dependencies, Tracking references and restoring packages.

The client tools

Client Use

dotnet CLI

dotnet restore, dotnet package …, dotnet nuget …, dotnet pack — every platform, all SDK-style projects (dotnet package and nuget Commands).

MSBuild

msbuild -t:restore, -t:pack — the same NuGet code as the CLI (Package Restore).

Visual Studio

Package manager UI and Package Manager Console, Windows (nuget.exe, Visual Studio and packages.config).

nuget.exe

Standalone CLI, needed mainly for packages.config projects.

Support follows the host: the NuGet inside an SDK is supported as long as that SDK, the NuGet in Visual Studio as long as that Visual Studio; for nuget.exe only the latest version is fully supported, patched versions are released only for critical security fixes for LTS releases, and out-of-support or vulnerable versions are removed from the tools.json feed. Not every feature is in every client — packages.config restore, for example, needs nuget.exe or MSBuild, not dotnet — and the "feature availability" table in the documentation lists which client version brought what.

Source: Install NuGet client tools: Tools overview, Support policy, Patch releases, nuget.exe unlisting, .NET SDK, Feature availability, What is NuGet: NuGet tools.

nuget.org

nuget.org is the default source — https://api.nuget.org/v3/index.json, the V3 service index (NuGet Server API). It repository-signs every package, publishes vulnerability data, reserves ID prefixes for verified owners, and never deletes a published version (it can only be unlisted). Accounts, API keys and Trusted Publishing are covered in the publishing group.

Source: nuget.org overview: API endpoint.

Baseline and history

dotnet nuget --version
7.9.0-rc.611+a8dd0577c5c13f43a2f57fe33b4ff11b90f6371e.a8dd0577c5c13f43a2f57fe33b4ff11b90f6371e

Visual Studio 2026 18.10 carries NuGet 7.10.0, a Visual Studio-only release; the .NET 11 release candidates carry a NuGet 8.0 prerelease. The milestones for consumers:

NuGet Change

4.9

lock files; trusted signers

6.0

package source mapping

6.4

Central Package Management production ready

6.8 (.NET 8)

NuGetAudit

6.11

dotnet nuget why

6.12 (.NET 9)

new dependency resolver; HTTP sources are errors (NU1302)

7.0 (.NET 10)

transitive auditing and package pruning for net10.0+; dotnet package update

7.9 (SDK 10.0.4xx)

this group’s baseline

8.0 (.NET 11 preview)

minimum publish age

The full table, with the SDK and Visual Studio mapping, is on NuGet Versions and Release History.

Source: NuGet 7.9 release notes, NuGet release notes.

Reading order

How it works — How Package Installation Works, Package Versions and Ranges, Dependency Resolution.

In the project — PackageReference, Central Package Management, Lock Files and Locked Mode.

Configuration and sources — nuget.config, Package Sources and Source Mapping, Global Packages and Cache Folders, Package Restore.

Security — Auditing Packages for Vulnerabilities, Signed Packages and Trust Policies, Authenticated Feeds and Credential Providers.

Reference — dotnet package and nuget Commands, nuget.exe, Visual Studio and packages.config, NuGet Server API, Troubleshooting NuGet Errors and Warnings, NuGet Versions and Release History.

References