Skip to content

Conversation

Copilot
Copy link
Contributor

@Copilot Copilot AI commented Sep 6, 2025

This PR adds documentation for a breaking change introduced in .NET 10 RC 1 where NuGet now validates package IDs when they're used to create URLs.

Changes Made

New Breaking Change Document: Created docs/core/compatibility/sdk/10.0/nuget-packageid-validation.md that documents:

  • NuGet now validates package IDs when constructing URLs and throws exceptions for invalid formats
  • Previously, invalid or malformed package IDs could be used without validation
  • This is a behavioral change that may affect existing binaries at runtime
  • Users can bypass validation by setting the NUGET_DISABLE_PACKAGEID_VALIDATION environment variable to true

Updated Index: Added an entry to docs/core/compatibility/10.0.md in the SDK and MSBuild section table.

Updated TOC: Added an entry to docs/core/compatibility/toc.yml to make the new document discoverable.

The document follows the established .NET documentation guidelines and breaking change format. All files pass markdownlint validation and maintain proper YAML structure.

This change was introduced in NuGet.Client PR #6646 and affects the security posture by reducing the risk of unsafe or unintended inputs being processed when constructing URLs from package IDs.

Fixes #47984.


💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.


Internal previews

📄 File 🔗 Preview link
docs/core/compatibility/10.0.md Breaking changes in .NET 10
docs/core/compatibility/sdk/10.0/nuget-packageid-validation.md NuGet logs an error for invalid package IDs
docs/core/compatibility/toc.yml docs/core/compatibility/toc

@Copilot Copilot AI changed the title [WIP] [Breaking change]: NuGet logs an error for invalid package ids Add NuGet package ID validation breaking change documentation for .NET 10 RC 1 Sep 6, 2025
@Copilot Copilot AI requested a review from gewarren September 6, 2025 02:44
Copilot finished work on behalf of gewarren September 6, 2025 02:44
@gewarren gewarren marked this pull request as ready for review September 8, 2025 20:43
@gewarren gewarren requested a review from a team as a code owner September 8, 2025 20:43
@gewarren gewarren merged commit 00192e9 into main Sep 9, 2025
10 checks passed
@gewarren gewarren deleted the copilot/fix-47984 branch September 9, 2025 21:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[Breaking change]: NuGet logs an error for invalid package ids
3 participants