Issue

Discussion issue: NuGet/NuGetGallery#4805

Important:

Starting November 10th 2017, NuGet.org will only accept push requests that implement X-NuGet-Protocol-Version: 4.1.0 and identifies so to NuGet.org through the corresponding header (as explained below).

Problem

NuGet service has been growing exponentially over the last few months: NuGet.org is closing in on 5 billion packages served (up from a billion packages just a year ago). With this enhanced usage and scope, we would like to ensure that the end users get the desired behavior across clients. As explained in the Roadmap blog post, we will also be introducing several security features to NuGet eco-system. This will come with various NuGet service protocol improvements.

In order to ensure that the end consumers use the right protocol to interact with NuGet.org, we would like the NuGet clients to identify the protocol version they use when they call NuGet.org APIs. This will allow NuGet.org to introduce changes in a non-breaking way for the old clients.

Who is the customer?

• All NuGet.org users who push packages using command-line.
• All NuGet clients (including 3rd party clients) that push packages to NuGet.org.

Solution

All NuGet clients should implement NuGet.org protocol 4.1.0 and state the protocol version in the header of API requests to push packages to NuGet.org:

X-NuGet-Protocol-Version: 4.1.0

Important: Starting November 10th 2017, NuGet.org will only accept push requests that implement X-NuGet-Protocol-Version: 4.1.0 and identifies so to NuGet.org through the corresponding header (as mentioned above).

What is NuGet protocol 4.1.0?

The details of this protocol and usage can be found in the documentation: NuGet Protocol versions

If you have any questions on the requirement or would like to test your implementation, you can discuss it to the linked discussion issue or reach out to [email protected].