Nugget - NuGet Package Manager

A Visual Studio-like graphical NuGet package manager for VS Code: Browse / Installed / Updates tabs, version picker, README preview, and one-click install, update or uninstall, right from your editor.

Features

• 🔍 Browse: live search with optional prerelease versions.
• 📦 Installed: top-level and transitive packages of the selected .csproj, like Visual Studio.
• ⬆️ Updates: detects packages with a newer version available, with an update counter badge.
• 📖 README preview: displays the package README (from the feed, the .nupkg or the local NuGet cache), like the Visual Studio package details.
• 🛡️ Vulnerability audit: known CVEs of your whole dependency tree (OSV.dev / GitHub Advisory Database), with severity badges on installed packages, warning markers in the version picker and a Vulnerabilities tab showing affected ranges and fixed versions.
• 🔀 Multiple sources, like the "Package source" picker in Visual Studio:
  • automatic discovery of sources declared in NuGet.config files (workspace and user level);
  • nuget.org, private v3 feeds and local folders / network shares;
  • credentials stored securely in VS Code Secret Storage;
  • an "All sources" mode that aggregates results.
• 🗂️ Project picker for multi-.csproj solutions.
• 🎨 Follows your VS Code theme.

Install, update and uninstall operations run through the dotnet CLI, so your .csproj is modified exactly as dotnet add package would.

Getting started

1. Open a folder containing at least one .csproj project.
2. Run "NuGet: Manage Packages":
   • from the command palette (Ctrl/Cmd+Shift+P), or
   • by right-clicking a .csproj file or a project folder in the explorer, or
   • from the editor title icon when a .csproj is open.
3. Pick the target project, search for a package, select a version, install.

Requirements

• The .NET SDK installed and dotnet available in the PATH (install operations use dotnet add/remove package).

Package sources

Two ways to add a private feed:

1. From the panel: gear button next to the source picker, then enter a name, a URL and, if needed, credentials.
2. From the palette: the "NuGet: Add Package Source" command.

Sources declared in a NuGet.config are detected automatically and show up in the dropdown. Two kinds of sources are supported:

• HTTP v3 feeds: URLs ending with index.json (e.g. https://my-feed/v3/index.json). v2 (OData) feeds are not supported.
• Folders / network shares: a local path (C:\packages), a UNC share (\\server\share\Nuget) or a file:// URL. The extension lists the .nupkg files in the folder (recursively) for search and versions.

Note: the stored credentials are used to browse the feed from the extension. For installation, the dotnet CLI reads the credentials from your NuGet.config (or from dotnet nuget add source). For an authenticated private feed, make sure it is also configured on the dotnet side, otherwise dotnet add package will fail to fetch the package.

Network shares (UNC) on Windows

VS Code blocks by default extension access to UNC network shares (\\server\...), even when Windows Explorer can reach them (ERR_UNC_HOST_NOT_ALLOWED).

When the extension hits this case, it automatically works around the restriction; in most cases it just works. If the workaround fails, it offers an "Allow this host" button, and each network-share source has an "Allow insecure connections" checkbox in the sources dialog (like the per-source checkbox in Visual Studio) that adds the host to security.allowedUNCHosts.

Important: that setting is only read at VS Code startup: after changing it, close VS Code completely and reopen it (a "Reload Window" is not enough).

Known limitations

• Versions driven by Directory.Packages.props (Central Package Management) are not resolved yet.
• v2 (OData) feeds are not supported by the search UI.

License

MIT