Security

Requiring two-factor authentication on NuGet.org

February 22, 2022 Feb 22, 2022 02/22/22

Claire N

NuGet.org will begin requiring two-factor authentication for accounts starting March 8th.

Introducing Package Source Mapping

September 15, 2021 Sep 15, 2021 09/15/21

Nikolche K

We're happy to announce the first preview release of Package Source Mapping with Visual Studio 2022 preview 4! Package Source Mapping gives you fine-grained control of where your packages come from by mapping every package in your solution to a target package source.

.NET 5 NuGet Restore Failures on Linux distributions using NSS or ca-certificates

April 6, 2021 Apr 6, 2021 04/6/21

Jon D

We will be releasing updated builds of NuGet this week to accommodate NuGet restore failures on Linux distributions. The failures are observed when updated versions of the NSS or ca-certificates packages are installed.

How to Scan NuGet Packages for Security Vulnerabilities

March 2, 2021 Mar 2, 2021 03/2/21

Drew G

Today, we are announcing the public availability of NuGet’s vulnerability features that you can use to ensure your projects are vulnerability free and if not, to take action to securing your software supply chain.

The NuGet.org repository signing certificate will be updated as soon as March 15th, 2021

February 25, 2021 Feb 25, 2021 02/25/21

Christopher G

The current NuGet.org repository signing certificate will be updated as soon as March 15th, 2021. If you validate that packages are repository signed by NuGet.org, you will need to take steps to avoid disruptions when installing packages from NuGet.org.

The Microsoft author signing certificate will be updated as soon as November 1st, 2020

October 22, 2020 Oct 22, 2020 10/22/20

Christopher G

The current Microsoft author signing certificate will be updated as soon as November 1st, 2020. If you validate that packages are author signed by Microsoft, you will need to take steps to avoid disruptions when installing Microsoft packages.

NuGet.org will permanently remove support for TLS 1.0 and 1.1 on June 15th

May 25, 2020 May 25, 2020 05/25/20

Christopher G

Last November, we shared our two-stage plan for deprecating TLS 1.0/1.1 on NuGet.org in which we stated that the permanent removal of TLS 1.0/1.1 support would occur in April 2020. However, in April, to avoid disrupting customers in the midst of the COVID-19 pandemic, we announced that we would continue to support TLS 1.0/1.1 until further ...

NuGet.org will continue to support TLS 1.0 and 1.1 until further notice

April 22, 2020 Apr 22, 2020 04/22/20

Christopher G

Last November, we shared our two-stage plan for deprecating TLS 1.0/1.1 on NuGet.org and actions you can take today to ensure your systems use TLS 1.2. In that post, we announced that NuGet.org would remove support for TLS 1.0/1.1 in April 2020. However, since then, our customers have faced a variety of challenges in the wake of the COVID-19 ...

Deprecating TLS 1.0 and 1.1 on NuGet.org – Stage 1

February 12, 2020 Feb 12, 2020 02/12/20

The NuGet Team

In this post, we will go into more details and a specific timeline for Stage 1 i.e. temporarily removing support for TLS 1.0/1.1 on NuGet.org. The goal is to help you identify systems that may be affected and will give you an opportunity to take action before we permanently remove support for TLS 1.0/1.1 in April 2020.

Deprecating TLS 1.0 and 1.1 on NuGet.org

November 15, 2019 Nov 15, 2019 11/15/19

Karan N

co-authored by Scott Bommarito At Microsoft, using the latest and secure encryption techniques is very important to us to ensure the security and privacy of our customers. TLS 1.0 and TLS 1.1, released in 1999 and 2006 respectively, are known to be vulnerable to a number of attacks including POODLE and BEAST. In the past, we removed ...

The NuGet Blog

Security - The NuGet Blog

Requiring two-factor authentication on NuGet.org

Introducing Package Source Mapping

.NET 5 NuGet Restore Failures on Linux distributions using NSS or ca-certificates

How to Scan NuGet Packages for Security Vulnerabilities

The NuGet.org repository signing certificate will be updated as soon as March 15th, 2021

The Microsoft author signing certificate will be updated as soon as November 1st, 2020

NuGet.org will permanently remove support for TLS 1.0 and 1.1 on June 15th

NuGet.org will continue to support TLS 1.0 and 1.1 until further notice

Deprecating TLS 1.0 and 1.1 on NuGet.org – Stage 1

Deprecating TLS 1.0 and 1.1 on NuGet.org

Relevant Links

Topics

Archive