From 8669f35cce1c2860aa47a7bfe6260c4179d650ab Mon Sep 17 00:00:00 2001 From: Michael Nebel Date: Wed, 28 Oct 2026 09:37:19 +0100 Subject: [PATCH 1/3] C#: Don't use the NuGet CLI when private registries are configured. --- .../PackagesConfigRestorer.cs | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/PackagesConfigRestorer.cs b/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/PackagesConfigRestorer.cs index 2348eb809f8c..294349e66f92 100644 --- a/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/PackagesConfigRestorer.cs +++ b/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/PackagesConfigRestorer.cs @@ -35,7 +35,7 @@ internal class PackagesConfigRestoreFactory { public static IPackagesConfigRestore Create(IFileProvider fileProvider, DependencyDirectory packageDirectory, Semmle.Util.Logging.ILogger logger, FeedManager feedManager) { - if (SystemBuildActions.Instance.IsWindows() || SystemBuildActions.Instance.IsMonoInstalled()) + if ((SystemBuildActions.Instance.IsWindows() || SystemBuildActions.Instance.IsMonoInstalled()) && !feedManager.HasPrivateRegistryFeeds) { return new NugetExeWrapper(fileProvider, packageDirectory, logger, feedManager); } @@ -252,7 +252,7 @@ public int InstallPackages() { if (PackageCount > 0) { - logger.LogInfo("Found packages.config files, but nuget.exe cannot be used to restore packages on this platform. Skipping restore of packages.config files."); + logger.LogInfo("Found packages.config files, but nuget.exe cannot be used to restore packages on this platform or if private registry feeds are configured. Skipping restore of packages.config files."); } return 0; } From 3cd2e19fa955f30377243e4d662bd1d4330bf60e Mon Sep 17 00:00:00 2001 From: Michael Nebel Date: Wed, 28 Oct 2026 11:06:16 +0100 Subject: [PATCH 2/3] C#: Add change note. --- .../ql/lib/change-notes/2026-10-28-nugetcli-proxy-config.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 csharp/ql/lib/change-notes/2026-10-28-nugetcli-proxy-config.md diff --git a/csharp/ql/lib/change-notes/2026-10-28-nugetcli-proxy-config.md b/csharp/ql/lib/change-notes/2026-10-28-nugetcli-proxy-config.md new file mode 100644 index 000000000000..b23147588306 --- /dev/null +++ b/csharp/ql/lib/change-notes/2026-10-28-nugetcli-proxy-config.md @@ -0,0 +1,5 @@ +--- +category: minorAnalysis +--- + +- When private NuGet registries are configured, the extractor now attempts to restore dependencies listed in `packages.config` files using `dotnet restore` instead of the NuGet CLI so that the private registry configuration is respected. From 7ca621b43274befa6962c27e836b80c7af94f797 Mon Sep 17 00:00:00 2001 From: Michael Nebel Date: Fri, 30 Oct 2026 07:44:59 +0100 Subject: [PATCH 3/3] C#: Adjust change note Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- csharp/ql/lib/change-notes/2026-10-28-nugetcli-proxy-config.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/csharp/ql/lib/change-notes/2026-10-28-nugetcli-proxy-config.md b/csharp/ql/lib/change-notes/2026-10-28-nugetcli-proxy-config.md index b23147588306..916d4fee9628 100644 --- a/csharp/ql/lib/change-notes/2026-10-28-nugetcli-proxy-config.md +++ b/csharp/ql/lib/change-notes/2026-10-28-nugetcli-proxy-config.md @@ -2,4 +2,4 @@ category: minorAnalysis --- -- When private NuGet registries are configured, the extractor now attempts to restore dependencies listed in `packages.config` files using `dotnet restore` instead of the NuGet CLI so that the private registry configuration is respected. +- When private NuGet registries are configured, the extractor only attempts to restore dependencies listed in `packages.config` files using `dotnet restore` instead of the NuGet CLI so that the private registry configuration is respected.