NuGet
NuGet is the package manager for .NET, providing tools to create and consume packages and the NuGet Gallery as a central repository.
What NuGet is
NuGet is the package manager for .NET, providing tools to create and consume packages and the NuGet Gallery as a central repository. A package is a .nupkg ZIP file that can hold compiled code, related files, and a manifest. NuGet resolves dependency graphs and records package identifiers and versions so dependencies can be restored across machines and build servers. Packages can also be hosted in private cloud locations, private networks, or local file systems, with access limited to people who can reach the host. Users can search, install, uninstall, and update packages through Visual Studio’s package manager; package workflows are also available through the dotnet CLI and nuget.exe. NuGet supports PackageReference and packages.config, and restore can check dependencies against configured vulnerability sources and report warnings. The dotnet CLI works on Windows, macOS, and Linux. NuGet is free, and the Gallery code is open source under Apache 2.0. Packages can be digitally signed, and nuget.org repository-signs uploads.
Good
- Resolves dependencies and records package versions for restore.
- Supports private feeds on cloud, network, or local storage.
- Restore can report vulnerability warnings.
- Packages can be digitally signed.
Watch out
- nuget.exe is Windows-based, with Mono limitations on macOS and Linux.
- Published packages generally cannot be deleted.
- Package uploads are limited to 250 MB.
Who it suits
NuGet suits .NET library creators and consumers who need to package, publish, or manage dependencies. It also supports teams using private feeds or restoring packages in builds.
Verdict
NuGet provides .NET package creation, hosting, dependency management, and restore tools across common development workflows. Consider its deletion policy and nuget.exe platform limitations when choosing how to manage packages.
The facts
Each one read from NuGet's own pages, with the date it was checked.
What it does
- Audit data source
- NuGet.org’s vulnerability database uses the GitHub Advisory Database, and NuGet.org provides a vulnerability-data-only service index.checked 2 Oct 2026
- Build integrations
- Package restore can be run with NuGet, the dotnet CLI, MSBuild, Visual Studio, or Azure Pipelines and Azure DevOps Server.checked 3 Oct 2026
- CLI tools
- The dotnet CLI and nuget.exe support package creation and consumption; the dotnet CLI is available for .NET Core, .NET Standard, and SDK-style projects targeting .NET Framework.checked 2 Oct 2026
- Deletion policy
- NuGet.org generally does not support deleting published packages.checked 3 Oct 2026
- Dependency management
- NuGet resolves package dependency graphs and records package identifiers and versions so dependencies can be restored across machines and build servers.checked 2 Oct 2026
- Dependency resolution
- Yeschecked 22 Sep 2026
- Development tools
- NuGet capabilities are available through the dotnet CLI, nuget.exe, Visual Studio, and Visual Studio Code extensions.checked 3 Oct 2026
- Downloads
- The downloads page lists a Windows x86 nuget.exe command-line distribution and a Visual Studio 2015 VSIX; it says NuGet 4.x is included with Visual Studio 2017.checked 2 Oct 2026
- Gallery license
- The NuGet Gallery is open-source software licensed under Apache 2.0, and the project welcomes community contributions.checked 2 Oct 2026
- Intended users
- NuGet provides tools and package hosting for .NET library creators and consumers.checked 3 Oct 2026
- Lockfile support
- Yeschecked 22 Sep 2026
- Offline installation
- Yeschecked 22 Sep 2026
- Open source
- The NuGet Gallery code is licensed under Apache 2.0, and the project welcomes community contributions.checked 3 Oct 2026
- Package contents
- A NuGet package is a .nupkg ZIP file that can contain compiled code, related files, and a descriptive manifest.checked 2 Oct 2026
- Package formats
- .nupkg,.snupkgchecked 22 Sep 2026
- Package gallery
- The NuGet Gallery is the central package repository used by package authors and consumers.checked 3 Oct 2026
- Package management formats
- NuGet supports PackageReference and packages.config, and PackageReference is required for .NET SDK-style projects.checked 2 Oct 2026
- Package signatures
- NuGet packages can be digitally signed to help verify package integrity and origin, and nuget.org automatically repository-signs uploaded packages.checked 3 Oct 2026
- Package size limit
- NuGet.org allows package uploads up to 250 MB and recommends keeping packages under 1 MB when possible.checked 3 Oct 2026
- Package workflows
- NuGet supports package creation, publishing, installation, updating, and restoring dependencies.checked 3 Oct 2026
- Private feeds
- NuGet packages can be hosted privately in the cloud, on a private network, or on a local file system, with access limited to people who can reach the host.checked 2 Oct 2026
- Private registry auth
- Yeschecked 22 Sep 2026
- Purpose
- NuGet is the package manager for .NET, providing tools to create, share, and consume packages.checked 3 Oct 2026
- Security auditing
- NuGet restore can check project dependencies against known vulnerabilities from configured audit sources and report warnings.checked 2 Oct 2026
