2019-04-14

use NuGet 5.0 for lock files

Visual Studio 2019 just launched and NuGet 5.0 was shipped as part the the new .NET SDK 2.1.6xx  & 2.2.2xx. It contains an important usability fix for NuGet lock files: "When restoring with lock file, NU1603 warning shouldn't be raised." It is important to know the NuGet version:

PS C:\Users\taggac\github\froto> dotnet new globaljson --sdk-version 2.2.203
The template "global.json file" was created successfully.
PS C:\Users\taggac\github\froto> dotnet --version
2.2.203
PS C:\Users\taggac\github\froto> dotnet nuget --version
NuGet Command Line
5.0.0.6

I recommend jumping up to NuGet 5.0 if you can, but it won't work with Visual Studio 2017. If you are stuck on VS 2017, it does work with NuGet 4.9 as I described in my last blog post. It requires .NET SDK 2.1.5xx or 2.2.1xx. Don't make the mistake of locking everything with .NET SDK 2.1.4xx which has NuGet 4.8. I made that mistake on a project last week and it cost me several hours. The checksums did not match any newer SDK version.

Delete the NuGet Fallback Folder

If you are going to be using lock files with a .NET SDK 2.x, I suggest deleting the NuGet fallback folder. On Linux & Mac, consult `dotnet --info` to find dotnet/sdk/NuGetFallbackFolder and delete it then add an environment variable of `export DOTNET_SKIP_FIRST_TIME_EXPERIENCE=1` in ~/.bash_profile or similar. On Windows, delete `C:\Program Files\dotnet\sdk\NuGetFallbackFolder` and add the environment variable. I did this in PowerShell: `[Environment]::SetEnvironmentVariable("DOTNET_SKIP_FIRST_TIME_EXPERIENCE", "1", "User")`. It prevents the NuGetFallbackFolder from getting restored from an archive in the SDK:


.NET SDK 3.x preview has removed that archive. I wish the new .NET SDK 2.x would as well. The checksums of the archives extracted end up not matching NuGet.org and checksum mismatches happen all over the place. After removing and disabling the fallback folder, clean out the cache and recreate the lock files:

dotnet nuget locals all --clear
dotnet restore --force-evaluate

If that doesn't clear them all out, I've also resorted to blowing away anything not committed:

git clean -xfd
dotnet new globaljson --sdk-version 2.2.203

I usually don't commit a global.json, which is why I'm recreating it here. See NuGet issue 7414 for additional info.