Skip to content

Conversation

Copilot
Copy link
Contributor

@Copilot Copilot AI commented Sep 6, 2025

This PR adds documentation for a breaking change introduced in .NET 10 RC 1 where NuGet now validates package IDs when they're used to create URLs.

Changes Made

New Breaking Change Document: Created docs/core/compatibility/sdk/10.0/nuget-packageid-validation.md that documents:

  • NuGet now validates package IDs when constructing URLs and throws exceptions for invalid formats
  • Previously, invalid or malformed package IDs could be used without validation
  • This is a behavioral change that may affect existing binaries at runtime
  • Users can bypass validation by setting the NUGET_DISABLE_PACKAGEID_VALIDATION environment variable to true

Updated Index: Added an entry to docs/core/compatibility/10.0.md in the SDK and MSBuild section table.

Updated TOC: Added an entry to docs/core/compatibility/toc.yml to make the new document discoverable.

The document follows the established .NET documentation guidelines and breaking change format. All files pass markdownlint validation and maintain proper YAML structure.

This change was introduced in NuGet.Client PR #6646 and affects the security posture by reducing the risk of unsafe or unintended inputs being processed when constructing URLs from package IDs.

Fixes #47984.


💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.

@Copilot Copilot AI changed the title [WIP] [Breaking change]: NuGet logs an error for invalid package ids Add NuGet package ID validation breaking change documentation for .NET 10 RC 1 Sep 6, 2025
@Copilot Copilot AI requested a review from gewarren September 6, 2025 02:44
Copilot finished work on behalf of gewarren September 6, 2025 02:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[Breaking change]: NuGet logs an error for invalid package ids
2 participants