The NuGet Blog

The latest news, updates, and insights from the NuGet team

Other announcements - The NuGet Blog

HTTPS Everywhere Update

September 19, 2023 Sep 19, 2023 09/19/23
Jon Douglas
Mistakes were made When we first published the plan for the effort of HTTPS everywhere, we wanted to get developer community feedback on the various HTTP and HTTPS scenarios that we don't have much everyday visibility of. After we published that blog, we heard you loud and clear that there was a gap. This plan needed a clear way to suppress ...

The Microsoft author-signing certificate will be updated as soon as August 14th, 2023

August 3, 2023 Aug 3, 2023 08/3/23
The NuGet Team
Action required: If you validate that packages are author-signed by Microsoft using a NuGet client policy or the NuGet.exe verify command, please follow these steps by August 14th, 2023 to avoid potential disruptions when installing new Microsoft packages. If you are unsure, we have outlined steps to check if you will be impacted. Microsoft ...

HTTPS everywhere

August 9, 2022 Aug 9, 2022 08/9/22
Jon Douglas
Safety guaranteed As an ongoing effort to make HTTPS everywhere a reality for NuGet, we have taken a number of steps to help protect your everyday package management experiences. Earlier this year, a security fact sheet from The White House reinforced companies to take action to secure our software supply chains. HTTPS and SSL not only ...

NuGet.org will continue to support TLS 1.0 and 1.1 until further notice

April 22, 2020 Apr 22, 2020 04/22/20
Christopher Gill
Last November, we shared our two-stage plan for deprecating TLS 1.0/1.1 on NuGet.org and actions you can take today to ensure your systems use TLS 1.2. In that post, we announced that NuGet.org would remove support for TLS 1.0/1.1 in April 2020. However, since then, our customers have faced a variety of challenges in the wake of the COVID-19 ...

Deprecating TLS 1.0 and 1.1 on NuGet.org

November 15, 2019 Nov 15, 2019 11/15/19
Karan Nandwani
co-authored by Scott Bommarito At Microsoft, using the latest and secure encryption techniques is very important to us to ensure the security and privacy of our customers. TLS 1.0 and TLS 1.1, released in 1999 and 2006 respectively, are known to be vulnerable to a number of attacks including POODLE and BEAST. In the past, we removed ...