-
Notifications
You must be signed in to change notification settings - Fork 266
Description
NuGet Product(s) Involved
dotnet.exe
The Elevator Pitch
Since packages are only deleted for severe issues (or on accident #14413)
The official policy on deleting packages
https://learn.microsoft.com/en-us/nuget/nuget-org/policies/deleting-packages
states that normally packages are not deleted as that causes ecosystem issues like what happened with npm and the left-pad incident as highlighted by Aaron in the discussion above.
nuget.org does not support permanent deletion of packages. Doing so would break every project depending on the availability of the package, especially with build workflows that involve package restore.
The exceptions talk about when packages can be deleted anyways
https://learn.microsoft.com/en-us/nuget/nuget-org/policies/deleting-packages#exceptions
In exceptional situations such as copyright infringement and potentially harmful content, packages can be deleted manually by the NuGet team. You can report a package using the "Report abuse" button on the NuGet.org package details page. If you are the package owner, login to your NuGet.org account to reach NuGet support using the "Contact support" button on the NuGet.org package details page.
Prohibited use goes into more details
https://learn.microsoft.com/en-us/nuget/nuget-org/policies/deleting-packages#prohibited-use
Packages that meet any of the following criteria are not allowed on the public NuGet gallery and will be immediately removed without discussion. Package owners will, however, be notified of the removal.
Contains malware, adware, or any kind of spyware.
Are designed to harm a developer's workstation or their organization.
Infringes copyrights or violates licenses.
Contains illegal content.
Are being used to squat on package identifiers, including packages that have zero productive content. Packages must contain code or the owners must concede the identifier to someone who actually has a product to ship.
Attempt to make the gallery do something that it's not explicitly designed to do.
Violates the nuget.org Terms of Use or Code of Conduct in any way. Terms such as "unexpected", "discriminatory", "hateful", and "abusive" are evaluated and decided at the sole discretion of the NuGet team.If you find a package that is in violation of any of these items, click the Report Abuse link on the package details page and submit a report.
Note that the NuGet team and the .NET Foundation reserves the right to change these criteria at any time.
So packages can be deleted for severe issues.
But today you would be blissfully unaware until you try to re-build your application or package that's dependent on a deleted package.
Moreover if your application or package is never re-built you would never know. And for some of the reasons you would very much like to not be dependent on that version anymore and have that in Production.
But maybe you have some CI that runs (using a package cache) and you still wouldn't know that the upstream package has been deleted. In those cases it would help if you could include dotnet list package --deleted and by default fail your build if any are detected.
A request for showing unlisted packages in the same way is also added here NuGet/NuGetGallery#10521
Additional Context and Details
N/A