Troubleshooting NuGet Errors and Warnings

This section documents MSBuild 18.9, the .NET SDK 10.0.402 (with its dotnet CLI) and NuGet 7.9, as published in the MSBuild, .NET and NuGet documentation on learn.microsoft.com, which is the reference these pages are written and verified against. Material about .NET 11 / NuGet 8.0 is still in preview and is always flagged as such — never presented as baseline.

This content was generated with the assistance of AI and should be verified against the official documentation before being relied on in production.

The C# Reference bibliography lists the reference material consulted while preparing these pages.

NuGet reports problems with NUxxxx codes, grouped by hundreds: NU10xx project and CPM configuration, NU11xx resolution, NU13xx sources, NU14xx lock files and integrity, NU15xx project content, NU16xx dependency graph warnings, NU17xx compatibility, NU18xx source warnings and NU19xx auditing. This page gives a method and the real messages, almost all reproduced on the other NuGet pages with NuGet 7.9.0 (.NET SDK 10.0.402); each row links where.

A diagnosis method

  1. Read the first NU code and its page — https://learn.microsoft.com/nuget/reference/errors-and-warnings/nuNNNN (each page has Issue and Solution).

  2. Restore alone, verbosely. dotnet restore -v:detailed shows the sources queried (GET/CACHE), the nuget.config files used and why versions were chosen; -bl records it for the Structured Log Viewer.

  3. Rule out caches. --no-http-cache, an empty RestorePackagesPath, or dotnet nuget locals all --clear (Global Packages and Cache Folders).

  4. Explain the graph. dotnet nuget why <project> <package> and dotnet package list --include-transitive (Dependency Resolution).

Source: NuGet errors and warnings reference.

Configuration and CPM (NU10xx)

Code Message (paths shortened) Page

NU1004

A new package reference was found Ledgerline.Fx for the project target framework net10.0.The packages lock file is inconsistent with the project dependencies so restore can’t be run in locked mode. …

Lock Files

NU1008

The following PackageReference items cannot define a value for Version: Ledgerline.Money. …

CPM

NU1009

The following PackageReference items are implicitly defined and cannot define a PackageVersion item: NETStandard.Library. …

CPM

NU1010

The following PackageReference items do not define a corresponding PackageVersion item: Ledgerline. …

CPM

NU1011

The following PackageVersion items cannot specify a floating version: Ledgerline.Money. …

CPM

NU1013

The following PackageReference items cannot specify a value for VersionOverride: Ledgerline.Money. …

CPM

NU1015

The following PackageReference item(s) do not have a version specified: Ledgerline.Money

(a reference without Version outside CPM)

Resolution (NU11xx)

Code Message Page

NU1101

Unable to find package Ledgerline.Nonexistent. No packages exist with this id in source(s): ledgerline-local. PackageSourceMapping is enabled, the following source(s) were not considered: ledgerline-bagetter, nuget.org.

Package Restore

NU1102

Unable to find package Ledgerline.Money with version (>= 3.0.0) … Found 4 version(s) in ledgerline-local [ Nearest version: 2.1.0-beta.1 ]

Package Restore

NU1103

Unable to find a stable package Ledgerline.Preview with version (>= 0.9.0) … [ Nearest version: 1.0.0-beta.1 ]

Package Restore

NU1107

Version conflict detected for Ledgerline.Money. Install/reference Ledgerline.Money 2.0.0 directly to project Deps to resolve this issue.

Dependency Resolution (legacy resolver only)

NU1109

Detected package downgrade: Ledgerline.Money from 2.0.0 to centrally defined 1.0.0. Update the centrally managed package version to a higher version.

CPM

NU1110

The package B is available in the Global packages folder, but the source it came from https://api.nuget.org/v3/index.json is not one of the configured sources. (documentation text)

Source Mapping

Sources, integrity and content (NU13xx-NU15xx)

Code Message Page

NU1301

Unable to load the service index for source https://localhost:9/v3/index.json. / Response status code does not indicate success: 401 (Unauthorized).

Package Restore, Authenticated Feeds

NU1302

You are running the 'restore' operation with an 'HTTP' source: http://localhost:5555/v3/index.json. NuGet requires HTTPS sources. …

Source Mapping

NU1403

Package content hash validation failed for Ledgerline.Money.1.5.0. The package is different than the last restore.

Lock Files

NU1504

Duplicate 'PackageReference' items found. … The duplicate 'PackageReference' items are: Ledgerline.Money 1.5.0, Ledgerline.Money 2.0.0.

 — 

NU1506

Duplicate 'PackageVersion' items found. … The duplicate 'PackageVersion' items are: Ledgerline.Rates 1.0.0, Ledgerline.Rates 1.0.0.

CPM

NU1507

There are 2 package sources defined in your configuration. When using central package management, map your package sources with package source mapping …

CPM

NU1510

PackageReference System.Text.Json will not be pruned. This package is automatically available and does not need to be referenced explicitly. Remove the PackageReference item.

PackageReference

The duplicate PackageReference (NU1504) is only a warning: the restore went on with one of the two versions.

Graph and compatibility warnings (NU16xx-NU18xx)

Code Message Page

NU1603

Ledgerline.Rates 1.0.0 depends on Ledgerline.Money (>= 1.2.0) but Ledgerline.Money 1.2.0 was not found. Ledgerline.Money 1.5.0 was resolved instead.

Dependency Resolution

NU1604

Project dependency Ledgerline.Money (> 1.0.0) does not contain an inclusive lower bound. …

Versions and Ranges

NU1605

Warning As Error: Detected package downgrade: Ledgerline.Money from 2.0.0 to 1.0.0. …

Dependency Resolution

NU1608

Detected package version outside of dependency constraint: Ledgerline.Tax 1.0.0 requires Ledgerline.Money (>= 1.0.0 && < 2.0.0) but version Ledgerline.Money 2.0.0 was resolved.

Dependency Resolution

NU1701

Package 'Ledgerline.Legacy 1.0.0' was restored using '.NETFramework,Version=v4.6.1, … .NETFramework,Version=v4.8.1' instead of the project target framework 'net10.0'. …

Dependency Resolution

NU1703

Package 'Contoso.Android.Library' 1.0.0 uses the deprecated MonoAndroid framework instead of 'net6.0-android' or later. … (documentation text; new in 7.9)

 — 

NU1801

Unable to load the service index for source https://localhost:9/v3/index.json.

with --ignore-failed-sources

NU1803

You are running the 'restore' operation with an 'HTTP' source, 'http://localhost:5555/v3/index.json'. Non-HTTPS access will be removed in a future version. Consider migrating to an 'HTTPS' source.

below

The documentation prints NU1701 as "restored using 'TargetFrameworkA' instead the project target framework"; the real message reads "instead of the".

NU1803 is the pre-.NET 9 warning that NU1302 replaced — and it comes back when SdkAnalysisLevel is lowered. The same HTTP source that fails with NU1302 by default produced only NU1803 with -p:SdkAnalysisLevel=8.0.400. The HTTPS requirement is therefore one of the SDK behaviours that SdkAnalysisLevel controls, which is worth knowing before using that property to quiet new warnings (Format and Code Analysis).

Auditing (NU19xx)

Code Message Page

NU1900

Error occurred while getting package vulnerability data: Unable to load the service index for source https://localhost:9/v3/index.json.

Auditing

NU1901

Package 'NuGet.Protocol' 5.11.2 has a known low severity vulnerability, https://github.com/advisories/GHSA-g4vj-cjjj-v7hg

Auditing

NU1902

(moderate severity; same text)

Auditing

NU1903

Package 'Newtonsoft.Json' 9.0.1 has a known high severity vulnerability, https://github.com/advisories/GHSA-5crp-9r3c-p9vr

Auditing

NU1904

Package 'NuGet.Packaging' 5.11.2 has a known critical severity vulnerability, https://github.com/advisories/GHSA-68w7-72jg-6qpp

Auditing

NU1905

An audit source does not provide vulnerability data (documentation)

Auditing

Source: NU1015, NU1110, NU1504, NU1506, NU1510, NU1604, NU1701, NU1703, NU1801, NU1803, NU1900.

Documentation gaps

  • NU1606 and NU1607 appear in the errors-and-warnings index but have no page (the URLs return 404).

  • NU1020, the .NET 11 minimum-publish-age error (minPublishAgeHours), has no page yet.

  • NU1902 and NU1903/NU1904 share the NU1901-NU1904 page.

Common mistakes

  • Fixing the last NU code first — the first one usually causes the rest.

  • Clearing every cache before reading the message — slow, and it hides the evidence.

  • Suppressing NU1605, NU1608 or NU1701 globally — each describes a real run-time risk.

  • Lowering SdkAnalysisLevel to silence one warning — it also relaxes other checks, such as HTTPS enforcement.

References