You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/concepts/Auditing-Packages.md
+33-1Lines changed: 33 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -115,7 +115,39 @@ Alternatively, if you want to keep low and moderate vulnerabilities as warnings,
115
115
> [!NOTE]
116
116
> MSBuild properties for message severity such as `NoWarn` and `TreatWarningsAsErrors` are not supported for packages.config projects.
117
117
118
-
## Ensure restore audited projects
118
+
## Running NuGet Audit in CI
119
+
120
+
### Separating Errors from Warnings with a Dedicated Auditing Pipeline
121
+
122
+
You can use MSBuild's conditional statements to configure a dedicated CI pipeline for running audits, without audit warnings being treated as errors in other pipelines or on local builds.
123
+
Depending on your CI system and team processes, you can have failed runs of the audit pipeline email the team, or you may have a dashboard where you can show a badge of the most recent run of the pipeline.
124
+
125
+
Like many things in programming, there are multiple ways to achieve the outcome.
126
+
One option is to treat NuGet Audit warnings as errors only in an audit pipeline.
Then in your pipeline, you run restore specifying the property used by the condition.
137
+
For example, using GitHub Actions syntax:
138
+
139
+
```yml
140
+
- name: Restore with NuGet Auditing
141
+
run: dotnet restore -p:AuditPipeline=true
142
+
```
143
+
144
+
The property name `AuditPipeline` is only an example, and you can customize it as you wish, as long as the name is the same in both the MSBuild condition and the command line.
145
+
MSBuild also uses environment variables when reading a property that has not yet been defined, so an environment variable is an alternative to the command line parameter.
146
+
147
+
By using conditions to selectively cause NuGet Audit warnings to fail a restore, you can have a dedicated pipeline to check packages for known vulnerabilities, while preventing new security advisories from blocking your bug fixes at inconvenient times.
148
+
Keeping NuGet Audit warnings enabled for local builds allows developers to get a non-blocking notification about new security advisories and can encourage upgrading package versions to fix the vulnerabilities more quickly than waiting for someone to check the audit pipeline status.
149
+
150
+
### Ensure restore audited projects
119
151
120
152
NuGet in MSBuild 17.13 and .NET 9.0.200 added output properties `RestoreProjectCount`, `RestoreSkippedCount` and `RestoreProjectsAuditedCount` on the restore task.
121
153
This can be used to enforce that audit ran during a restore.
Copy file name to clipboardExpand all lines: docs/consume-packages/managing-the-global-packages-and-cache-folders.md
+53-5Lines changed: 53 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,12 +11,12 @@ ms.topic: conceptual
11
11
12
12
Whenever you install, update, or restore a package, NuGet manages packages and package information in several folders outside of your project structure:
13
13
14
-
| Name |Description and Location (per user)|
14
+
| Name | Location |
15
15
| --- | --- |
16
-
| global-packages| The *global-packages* folder is where NuGet installs any downloaded package. Each package is fully expanded into a subfolder that matches the package identifier and version number. Projects using the [PackageReference](package-references-in-project-files.md) format always use packages directly from this folder. When using the [packages.config](../reference/packages-config.md), packages are installed to the *global-packages* folder, then copied into the project's `packages` folder.<br/><ul><li>Windows: `%userprofile%\.nuget\packages`</li><li>Mac/Linux: `~/.nuget/packages`</li><li>Override using the NUGET_PACKAGES environment variable, the `globalPackagesFolder` or `repositoryPath`[configuration settings](../reference/nuget-config-file.md#config-section) (when using PackageReference and `packages.config`, respectively), or the `RestorePackagesPath` MSBuild property (MSBuild only). The environment variable takes precedence over the configuration setting.</li></ul> |
17
-
| http-cache| The Visual Studio Package Manager (NuGet 3.x+) and the `dotnet` tool store copies of downloaded packages in this cache (saved as `.dat` files), organized into subfolders for each package source. Packages are not expanded, and the cache has an expiration time of 30 minutes.<br/><ul><li>Windows: `%localappdata%\NuGet\v3-cache`</li><li>Mac/Linux: `~/.local/share/NuGet/v3-cache`</li><li>Override using the NUGET_HTTP_CACHE_PATH environment variable.</li></ul> |
18
-
| temp |A folder where NuGet stores temporary files during its various operations.<br/><li>Windows: `%temp%\NuGetScratch`</li><li>Mac: `/tmp/NuGetScratch`</li><li>Linux: `/tmp/NuGetScratch<username>`</li><li>Override using the NUGET_SCRATCH environment variable.</li></ul> |
19
-
| plugins-cache **4.8+**|A folder where NuGet stores the results from the operation claims request.<br/><ul><li>Windows: `%localappdata%\NuGet\plugins-cache`</li><li>Mac/Linux: `~/.local/share/NuGet/plugins-cache`</li><li>Override using the NUGET_PLUGINS_CACHE_PATH environment variable.</li></ul> |
16
+
|[global-packages](#global-packages)|<ul><li>Windows: `%userprofile%\.nuget\packages`</li><li>Mac/Linux: `~/.nuget/packages`</li><li>Override using the NUGET_PACKAGES environment variable, the `globalPackagesFolder` or `repositoryPath`[configuration settings](../reference/nuget-config-file.md#config-section) (when using PackageReference and `packages.config`, respectively), or the `RestorePackagesPath` MSBuild property (MSBuild only). The environment variable takes precedence over the configuration setting.</li></ul> |
17
+
|[http-cache](#http-cache)|<ul><li>Windows: `%localappdata%\NuGet\v3-cache`</li><li>Mac/Linux: `~/.local/share/NuGet/v3-cache`</li><li>Override using the NUGET_HTTP_CACHE_PATH environment variable.</li></ul> |
18
+
|[temp](#temp)| <li>Windows: `%temp%\NuGetScratch`</li><li>Mac: `/tmp/NuGetScratch`</li><li>Linux: `/tmp/NuGetScratch<username>`</li><li>Override using the NUGET_SCRATCH environment variable.</li></ul> |
19
+
|[plugins-cache](#plugin-cache)**4.8+**| <ul><li>Windows: `%localappdata%\NuGet\plugins-cache`</li><li>Mac/Linux: `~/.local/share/NuGet/plugins-cache`</li><li>Override using the NUGET_PLUGINS_CACHE_PATH environment variable.</li></ul> |
20
20
21
21
> [!Note]
22
22
> NuGet 3.5 and earlier uses *packages-cache* instead of the *http-cache*, which is located in `%localappdata%\NuGet\Cache`.
@@ -27,6 +27,54 @@ When asked to retrieve a package, NuGet first looks in the *global-packages* fol
27
27
28
28
For more information, see [What happens when a package is installed?](../concepts/package-installation-process.md).
29
29
30
+
## global-packages
31
+
32
+
The *global-packages* folder is where NuGet installs any downloaded package.
33
+
Each package is fully expanded into a subfolder that matches the package identifier and version number.
34
+
Projects using the [PackageReference](package-references-in-project-files.md) format always use packages directly from this folder.
35
+
When using the [packages.config](../reference/packages-config.md), packages are installed to the *global-packages* folder, then copied into the project's `packages` folder.
36
+
37
+
### Cleaning the global-packages directory
38
+
39
+
The global-packages directory needs to be manually cleaned to remove packages that are no longer used.
40
+
You can do this with the `dotnet nuget locals global-packages --clean` command, or the "clear NuGet local resources" button in Visual Studio's options (equivalent to `dotnet nuget locals all --clear`).
41
+
After clearing the global-packages directory, you will need to restore your projects again to redownload all required packages.
42
+
In Visual Studio, you may need to reload your solution to clear NuGet's "up to date restores" cache, or alternatively do a command line restore (for example, within Visual Studio's terminal window) with `msbuild -t:restore your.sln`.
43
+
44
+
To clean only unused packages, it's a two step process.
45
+
First, there is a [nuget.config setting `updatePackageLastAccessTime`](../reference/nuget-config-file.md) that should be enabled.
46
+
This setting will cause NuGet to update each package's `.nupkg.metadata` file when it is used in a restore.
47
+
When restore runs, but a project is considered already up to date, the package timestamps are *not* updated.
48
+
The `.nupkg.metadata` file is the last file that NuGet will create when downloading and extracting packages during a restore or install, and is the file that restore uses to check if a package has been extracted successfully.
49
+
50
+
Second, run a tool to perform the cleanup.
51
+
After the `updatePackageLastAccessTime` setting is enabled, we recommend waiting a few days to make sure that all the packages you use regularly have had their timestamps updated.
52
+
53
+
At this time, NuGet does not provide a tool or command to do this.
54
+
You can [add a 👍 reaction to this GitHub issue](https://github.com/NuGet/Home/issues/4980) to signal your interest.
55
+
Some community members have created their own open source NuGet cleaner tools that you can search for.
56
+
57
+
If you are going to write your own cleanup tool, it is important that the `.nupkg.metadata` file is deleted if any of the other package files are deleted, so we recommend that this file is deleted first.
58
+
Otherwise projects referencing the package may have unexpected behavior.
59
+
If writing a cleanup tool in .NET, consider using `ConcurrencyUtilities.ExecuteWithFileLocked[Async](..)` from the [NuGet.Common package](https://www.nuget.org/packages/NuGet.Common), passing the full nupkg path of the package directory you're going to delete as the key, to avoid deleting a package that restore is trying to extract at the same time.
60
+
The global packages directory can be programatically found with the [NuGet.Configuration package](https://www.nuget.org/packages/NuGet.Configuration).
61
+
Use `Settings.LoadDefaultSettings(path)` to get an `ISettings` instance (you can pass `null` as the path, or pass a directory if you want to handle solutions with a nuget.config that redirects the global-packages directory), and then use `SettingsUtility.GetGlobalPackagesFolder(settings)`.
62
+
Alternatively, you can run `dotnet nuget locals global-packages --list` as a child process and parse the output.
63
+
64
+
## http-cache
65
+
66
+
NuGet will cache copies of most NuGet feed communications (excluding search), organized into subfolders for each package source.
67
+
Packages are not expanded, and files with a last modified date older than 30 minutes are typically considered expired.
68
+
69
+
## temp
70
+
71
+
A folder where NuGet may store temporary files during its various operations.
72
+
73
+
## plugin-cache
74
+
75
+
A folder where NuGet stores the results from the operation claims request.
76
+
See the [cross platform plugins reference](../reference/extensibility/NuGet-Cross-Platform-Plugins.md) for more information.
77
+
30
78
## Viewing folder locations
31
79
32
80
You can view locations using the [nuget locals command](../reference/cli-reference/cli-ref-locals.md):
description: Learn how to add sponsorship links to your NuGet packages and support package maintainers through NuGet.org's sponsorship feature.
4
+
author: pranathibora14
5
+
ms.author: prabora
6
+
ms.date: 10/15/2025
7
+
ms.topic: conceptual
8
+
ai-usage: ai-generated
9
+
---
10
+
11
+
# Package sponsorship on NuGet.org
12
+
13
+
The NuGet.org sponsorship feature makes it easier for package consumers to recognize and support the authors behind their favorite packages.
14
+
15
+
NuGet.org enables package authors to add sponsorship URLs to their packages. These links appear when the "Sponsor" button on the package details page is selected.
16
+
17
+
18
+
## Setting up sponsorship for package publishers
19
+
20
+
### Prerequisites
21
+
22
+
- You must be the owner or co-owner of a package on NuGet.org
23
+
- Your sponsorship link platform must be from the approved list:
24
+
- GitHub Sponsors
25
+
- Patreon
26
+
- Open Collective
27
+
- Ko-fi
28
+
- Tidelift
29
+
- Liberapay
30
+
31
+
### Navigate to your package management page
32
+
33
+
1. Go to [NuGet.org](https://nuget.org) and sign in to your account.
34
+
2. Select your username in the top right corner.
35
+
3. Select **Manage Packages** from the dropdown menu.
36
+
4. Find the package you want to add sponsorship information for and select the edit button.
37
+
38
+
### Access sponsorship settings
39
+
40
+
1. On your package management page, scroll down to find the **Sponsorship Links** section.
41
+
2. Select to expand the collapsible **Sponsorship Links** section.
42
+
3. You'll see a form where you can add sponsorship URLs.
43
+
44
+
53
+
54
+
2. Select the **Add** button.
55
+
3. The system automatically validates that your URL is from an approved platform.
56
+
4. If any URLs are invalid or from non-approved platforms, you'll see error messages to correct them. Otherwise, you'll see a confirmation message that your sponsorship link has been saved.
57
+
58
+
59
+
60
+
5. Each added sponsorship URL will have a **Remove** button next to it if you need to delete it.
61
+
6. You can add up to 10 different sponsorship URLs per package ID.
62
+
63
+
### Verify your sponsorship URLs display correctly
64
+
65
+
1. Navigate to your package's public page on NuGet.org.
66
+
2. Look for the **Sponsor** button in the package details **About** section.
67
+
3. Select the **Sponsor** button to test that your URLs appear correctly in the popup.
68
+
69
+
70
+
71
+
## Finding and supporting packages
72
+
73
+
### Identify packages that need sponsorship
74
+
75
+
1. Browse to any package page on NuGet.org.
76
+
2. Look for packages displaying a **Sponsor** button in the package details section.
77
+
3. The **Sponsor** button indicates that the package maintainer is seeking financial support.
78
+
79
+
80
+
81
+
### View available sponsorship options
82
+
83
+
1. Select the **Sponsor** button on the package page.
84
+
2. A popup window appears showing all available sponsorship links for that package.
85
+
86
+
87
+
88
+
### Choose your preferred sponsorship platform
89
+
90
+
1. Review the available sponsorship options in the popup.
91
+
2. Select your preferred platform to be redirected to the external sponsorship page.
92
+
3. The link opens in a new tab or window, keeping the NuGet package page open.
93
+
94
+
> [!IMPORTANT]
95
+
> These links take you to third-party platforms. Microsoft isn't affiliated with or responsible for the content or practices of third-party platforms, and we don't endorse them. Microsoft reserves the right to remove any allowed third-party platforms.
96
+
97
+
## Frequently asked questions
98
+
99
+
**Can I add sponsorship information to older versions of my package?**
100
+
101
+
Yes! Sponsorship information is managed at the package ID level, so it automatically applies to all versions of your package, including previously published versions.
102
+
103
+
**What happens if my sponsorship platform URL changes?**
104
+
105
+
You can update your sponsorship URLs anytime through the package management page. Changes take effect immediately across all versions.
106
+
107
+
**Can I see analytics on how many people selected my sponsorship links?**
108
+
109
+
No, NuGet.org doesn't track sponsorship link selections. You'll need to check analytics on your sponsorship platform directly.
110
+
111
+
**Can I add custom sponsorship platforms not on the approved list?**
112
+
113
+
Currently, only the approved list of platforms is supported. This helps ensure security and legitimacy of sponsorship links. If you'd like to request a new platform to be added to the approved list, you can open an issue on the [NuGet Gallery repository](https://github.com/NuGet/NuGetGallery/issues).
114
+
115
+
**Does NuGet.org store my financial information?**
116
+
117
+
No personal or financial data is stored by NuGet.org. All transactions occur on secure external platforms that a maintainer chooses for sponsoring their packages.
0 commit comments