License terms
What are the default license terms if a package doesn't provide specific license information?
Each package is governed by the terms that are included with the package. You should review the applicable terms before accessing, downloading, or acquiring any packages. On NuGet.org, use the License Info link on the package page.
If a package does not specify the licensing terms, contact the package owner directly using the Contact owners link on the NuGet.org package page. Microsoft does not license any intellectual property to you from third party package providers and is not responsible for information provided by third parties.
Managing packages on NuGet.org
Can I edit package metadata after it's been uploaded?
NuGet recommends all packages to be signed. A design principle of package signing is that signed package content must be immutable, which includes the nuspec. Editing the package metadata results in changes to the nuspec, invalidating existing signatures. We recommend modifying existing workflows to not require editing the package metadata after the package has been created.
Note that dependencies listed for your package are generated automatically from the package itself and cannot be edited.
In addition, uploading packages to int.nugettest.org is a great way to test and validate your package without making a package available in the public gallery. API Endpoint: https://apiint.nugettest.org/v3/index.json
Can I delete a package published to NuGet.org?
In general, we do not support deleting a package published to NuGet.org. Read more about our policy on deleting packages.
Is it possible to reserve names for packages that will be published in future?
Yes. You can reserve IDs for packages on NuGet.org by requesting a package ID prefix for your account. In order to request a package ID prefix, follow the instructions in the documentation.
How do I claim ownership for packages ?
How do I deal with a package owner who is violating my software license?
We encourage the NuGet community to work together to resolve any disputes that may arise between package owners and the owners of other software. We have crafted a dispute resolution process to follow before asking NuGet.org administrators to intercede.
Is it recommended to upload my test packages to NuGet.org?
For test purposes, you can use int.nugettest.org, or alternative public NuGet servers like myget.org or Azure DevOps.
Note that packages uploaded to int.nugettest.org may not be preserved.
What is the maximum size of packages I can upload to NuGet.org?
NuGet.org allows packages up to 250MB, but we recommend keeping packages under 1MB if possible and using dependencies to link packages together. As a rule of thumb, packages contain only one assembly to avoid collisions.
NuGet uses HTTP to download packages, so larger packages have a higher likelihood of failed installs than smaller ones.
It is possible to share dependencies between multiple packages, making the total download size for consumers of your NuGet packages smaller.
Dependencies are mostly static and never change. When fixing a bug in code, the dependencies may not need to be updated. If you bundle dependencies, you end up reshipping larger packages every time. By splitting NuGet packages into related dependencies, upgrades are much more fine-grained for consumers of your package.
NuGet.org not accessible
What SSL/TLS version and cipher suites does NuGet.org support?
NuGet.org supports TLS 1.2 and the following cipher suites:
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
Why can't I restore packages from NuGet.org?
If you meet transient failures when restoring packages from NuGet.org, we suggest you:
- use the latest versions of NuGet clients with a better resilience support.
- use environment variables of NuGet clients to enhance the retry policy on CI machines.
Environment Variable | Description | Remarks |
---|---|---|
NUGET_ENABLE_ENHANCED_HTTP_RETRY | Enables or disables enhanced HTTP retry in NuGet. | Possible values are true (default since .NET CLI 6.0.300, NuGet CLI 6.2, Visual Studio 2022 version 17.2) or false . |
NUGET_ENHANCED_MAX_NETWORK_TRY_COUNT | Configures the maximum number of times an HTTP connection should be retried when enhanced retries are enabled. | A number representing how many retries to perform, the default value is 6 . |
NUGET_ENHANCED_NETWORK_RETRY_DELAY_MILLISECONDS | Configures the amount of time to wait in milliseconds before retrying an HTTP connection when enhanced retries are enabled. | Number of millseconds to wait, the default value is 1000 . |
Note
These environment variables are available since .NET CLI (.NET SDK) 6.0.100, NuGet CLI 6.0, Visual Studio 2022 version 17.0 and corresponding MSBuild version. See NuGet Release Notes.
Important
NuGet.org recommends Alpine Linux users to upgrade to Alpine Linux 3.18.0 or newer. These versions support TCP fallback in the DNS resolver. If you use older versions of Alpine Linux that only support DNS over UDP, you may encounter DNS failures when accessing the V3 API.
If that version of NuGet client continues to fail, contact support and provide additional connection troubleshooting information including:
- The package sources you're using
- The version of NuGet client you're using
- A restore log with detailed verbosity
- MTR or a Fiddler traces (see below)
- Your geographical area
- Whether your machine is behind a proxy or firewall?
- Is your machine located on a cloud providers' data center (Azure, AWS etc)? If yes, please provide the name of the provider and the region.
To capture MTR:
Download WinMTR.
Enter
api.nuget.org
as the hostname and click Start.Wait until the Sent column is >= 100.
Copy text to clipboard.
To capture Fiddler:
- Install the latest version of Fiddler.
- Start Fiddler and disable capturing traffic using the File > Capture Traffic menu.
- Remove all sessions (select all items in the list, press the Delete key).
- Configure Fiddler to capture HTTPS traffic by checking Decrypt HTTPS traffic in the HTTPS tab of the Tools > Fiddler Options... menu.
- Close Visual Studio.
- Enable the File > Capture Traffic menu.
- Start Visual Studio or nuget.exe .exe and perform the actions that are not working. The traffic generated by these actions should show up in Fiddler.
- Once the actions have run, use File > Save > All Sessions to store the captured sessions.
Note: it may be required to set the HTTP_PROXY
environment variable to http://127.0.0.1:8888
for routing NuGet traffic through Fiddler.
If that fails, try the tips mentioned in this StackOverflow post.
NuGet.org account management
How to recover NuGet.org password login?
Please note that the NuGet.org Password login has been discontinued. Unfortunately, NuGet.org has no way to recover password accounts, you can only log in to NuGet.org with a personal Microsoft account (MSA) or Azure Active Directory (AAD) account.
If you are unable to use Microsoft login, please follow the steps to recover your NuGet.org account.
Please let us know if you need assistance in transferring ownership of your packages to a different account by sending an email to [email protected].
Which Microsoft account is linked to my NuGet.org account?
If you have forgotten which Microsoft account is associated with your NuGet.org account, please follow the steps below to get assistance.
- Go to NuGet.org login page and click on Need assistance signing in? link.
- This will show you the pop-up dialog box for assistance. Follow the steps in this dialog box to understand the associated Microsoft account(s) for your NuGet.org account.
How to change the Microsoft account I use for NuGet.org login?
If you wish to change the Microsoft account for NuGet.org user, follow the steps below. Lets say your Microsoft account with email [email protected]
is associated with your NuGet.org account with username MyNuGetAccount
. You wish to change the login to another Microsoft account with email [email protected]
Please sign in using currently associated Microsoft account i.e.
[email protected]
on the login page after clicking Sign in with Microsoft.Once logged in, go to your account settings page.
Expand the section for Login Account. Click on the Change Account button.
You will now be redirected to the microsoft login page. Please sign in with the account that you wish to change the association to i.e.
[email protected]
. Note: you might need to click on Sign out and sign in with different account during the sign in flow to be able to login with a different Microsoft account.If you see an error like below, see Microsoft account is linked with another NuGet.org account for more details.
Failed to update the Microsoft account with 'account2 [email protected]'. This could happen if it is already linked to another NuGet account. Contact support for more information.
Once you have successfully signed in with your second account, you will be redirected back to your NuGet.org account settings page and you should now see the new Microsoft account associated as the login account. Going forward you should use this account when signing into NuGet.org.
Microsoft account is linked with another NuGet.org account.
If you tried changing your Microsoft login and saw the error below:
Failed to update the Microsoft account with 'account2 [email protected]'. This could happen if it is already linked to another NuGet account. Contact support for more information.
Lets say you were trying to change Microsoft account login from [email protected]
for NuGet.org user with username MyNuGetAccount1
to another Microsoft account with email [email protected]
. And you see the error above.
**What does the error above mean?
It means that there is another NuGet.org account which is associated with the Microsoft account that you are trying to change it to i.e. in above example the Microsoft account with email <[email protected]>
is associated with another NuGet.org account with, say, username MyNuGetAccount2
.
You cannot change the associated login with a Microsoft account that is linked to a different NuGet.org account.
I forgot I had another NuGet.org account, how do I find out which NuGet.org account it is?
Login with the second Microsoft account on the login page. This will log you into the NuGet.org account that is currently associated with the second Microsoft account. You can then view the uploaded packages and perform account management on this account.
I do not care about this second NuGet.org account, I want to change my login for first NuGet.org account with the second Microsoft account. What do I do?
If you wish to not care about the second NuGet.org account and still want to re-use the associated Microsoft account with email [email protected]
.
You can release the association between the Microsoft account and NuGet.org account by deleting the NuGet.org account.
- Follow the steps to delete user for the second NuGet.org account
MyNuGetAccount2
. - Once this account is deleted, you can retry the steps to change Microsoft account login.
Wait, I care about this second account too. I do not want to lose this account but change my associated account logins for first account.
You will need to create/use a third Microsoft account, say, with email [email protected]
.
- First you should login with your second Microsoft account,
[email protected]
on NuGet.org. Follow the steps above to change associated logins and associate the third Microsoft account with this NuGet.org account. - Once done, your second Microsoft account with email
[email protected]
is free to be associated to your first NuGet.org account,MyNuGetAccount1
. Follow the same steps above to change microsoft logins to the second Microsoft account.
Signing in with Microsoft account shows me my email is linked to another Microsoft account
If you tried to sign in with your Microsoft account, say, with email [email protected]
and you see an error like below:
The account with email '[email protected]' is linked with another microsoft account.
If you would like to update the linked Microsoft account you can do so from the account settings page.
What does the error above mean?
When an account is created on NuGet.org, there is a communication email address associated with that account. This is usually same as the email address that is used for associated Microsoft account. However, you could choose to specify a different email address for communication. So, technically, you could have a different Microsoft account, say with [email protected]
that is linked to NuGet.org account with communication email address as [email protected]
.
So the error above means that there already exists NuGet.org account with communication email address [email protected]
but is associated with another Microsoft account with email that is not [email protected]
.
How do I find which Microsoft account is linked to this NuGet.org account?
You should use the sign in assistance flow to figure out which Microsoft account is linked to the NuGet.org account with the email address [email protected]
.
Unable to use Microsoft login, how do I recover my NuGet.org account?
If you tried using the sign in assistance and you do not have access to the Microsoft account that is associated with your NuGet.org account, please contact your Microsoft account support:
- Microsoft Account (MSA): Get help with your Microsoft account
- Work or school account (AAD): Work or school account help or contact your admin tenant.
How to transform my NuGet.org account to an organization?
If you want to transform your account to an organization, please follow the steps given in the documentation for organizations on nuget.org.
NuGet.org login issues for AAD accounts with unmanaged tenant?
If you see an error like below during your login flow with your email account domain(@yourdomain.com), see the steps below to recover your NuGet.org account.
What is this unmanaged state thing during login? And why is this happening now?
Your account seems to be previously registered as a personal Microsoft account and it worked fine, however, now it seems like your account has been registered as an "Unmanaged" tenant in the Azure Active Directory (the identity service which we use to authenticate Microsoft accounts).
This could have happened if you or someone from your organization(with @yourdomain.com email address) registered with one of the AAD integrated services or did a self-service signup for Azure Active Directory, which creates such an "Unmanaged" tenant for the used Microsoft account domain(@yourdomain.com in your case).
What can I do to recover my account?
At this moment there is not a way for us (NuGet.org) to authenticate accounts with such "Unmanaged" tenant accounts in Azure Active directory. We are looking in to a better way to authenticate such accounts.
If you want to login to NuGet.org with your Microsoft account(@yourdomain.com), you(or an administrator at your company) will need to claim the ownership of the AAD by doing a DNS validation to authenticate users with email address "@yourdomain.com". Please follow the steps for domains admin takeover documented by the Azure Active directory. Once this is done, your normal login should start working.
How do I change my NuGet.org account username?
You can request a username change by sending an email to [email protected] from the email address that is attached to the account you want to update. Be sure to include the old username and the new username you would like to change to. We will then review your request and, upon approval, get confirmation from you that we are about to take the correct action and that you understand the consequences. Once you have confirmed, we will change your username.
Important
- The old username will still be reserved. You will not be able to reuse the old username again and this includes the change of casings.
- As a consequence of the above, we will not be able to revert this change either.
- Any links to your old username profile page (e.g.
https://www.nuget.org/profiles/OldUsername
) will not be redirected to your new profile. - Package versions currently owned by your account will still contain the old username in the repository signature. New package versions will contain the new username.
- Any author-provided metadata in the existing package versions referring to the old username or other identifying information will not be changed.
- NuGet client policies asserting trust of your old username will not implicitly trust packages published by your new username. Package consumers with these client policies configured will need to manual update them to trust your new username when they attempt to update to a newly published package version.
How to delete my NuGet.org account?
To delete your account, please note that we recommend that you transfer the ownership of any packages where you are the sole owner. You can read more about managing package owners on how to do it. This will also help us expedite your request.
If you are looking to transform your account to an organization, follow the steps given in transform my NuGet.org account to an organization.
Important
Deleting the user will result in following:
- Your username will be reserved and no one will be able to re-use it to create an individual account or an organization account
- Revoke associated API key(s).
- Remove the account as an owner for any child packages.
- Dissociate all previously existent ID prefix reservations with this account.
- Remove the account as a member of any organizations.
Follow the following steps to proceed with account deletion.
- Login to NuGet.org with the account you wish to delete.
- Click on this url: https://www.nuget.org/account/delete and follow the steps to submit the request for deleting the account.
Our customer support will process this request and perform the account deletion.
What happens to my NuGet.org account when my Microsoft account gets deleted?
When the Microsoft or Azure Active Directory account you use to sign in to your nuget.org account is deleted, your nuget.org account will be deleted as well. The account delete action is completed by the nuget.org customer support within 30 days from the date of the Microsoft account deletion.
If you have packages associated with your account, we will notify you 3 business days before proceeding with deletion and offer assistance to transfer the packages to a different nuget.org account.