Repository navigation
aspire update shoudl never override existing wildcard package source mapping #19192
Description
Is there an existing issue for this?
- I have searched the existing issues
Describe the bug
When trying to update aspire with aspire update, the update process tries to add nuget.org back
- I have explicitly controlled my nuget.config file to not include
nuget.org. Aspire shouldn't be adding it back for no good reason. - Adding a second wildcard mapping is a bit nonsensical.
If there are specific packages that need to come from nuget.org, then those specific packages should be added to the package source mapping. But even then, that smells like a smell - if a user has chosen (or more likely been forced by company policy) to use an itnernal proxy, then aspire should not bypass that for things on nuget.org.
Perform updates? [Y/n]: y
Which directory for NuGet.config file? (REDACTED): REDACTED
Added: https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet9/nuget/v3/index.json
Mapping: Aspire* (added)
Added: https://api.nuget.org/v3/index.json
Mapping: * (added)
Retained: REDACTED
Mapping: *
Apply these changes to NuGet.config? [Y/n]: n
Expected Behavior
- I have very explicitly removed nuget.org from my nuget packages source.
aspire updateshould not add it back. - Adding the aspire internal feed is reasonable as the package source mapping is narrowly scoped to
Aspire.*.
Steps To Reproduce
- Have a
nuget.configlike the following, in a project with an old version of aspire - Run
aspire update --channel daily
<?xml version="1.0" encoding="utf-8"?>
<configuration>
<packageSources>
<clear />
<add key="REDACTED" value="REDACTED" />
</packageSources>
<packageSourceMapping>
<clear />
<packageSource key="REDACTED">
<package pattern="*" />
</packageSource>
</packageSourceMapping>
</configuration>Exceptions (if any)
No response
Aspire doctor output
No response
Anything else?
13.6.0-preview.1.26410.1+9b79ab510c9f171c48e3af1d69ff6a941127f9a5
Activity
MihuBot commentedon Aug 10, 2026
I'm a bot. Here are possible related and/or duplicate issues (I may be wrong):
aspire updateon stable branch is trying to modifyNuget.config#17899joperezr commentedon Aug 10, 2026
🤖 Aspire triage pass — 2026-08-10 18:13 UTC
Area:
area-cliKind: bug
Repro: yes-minimal — see lines 42–58 of the issue body (nuget.config +
aspire update --channel daily)Affected version(s): 13.6.0-preview.1.26410.1 (daily); not cited as a regression from a specific prior version
Severity: S3 —
aspire updatere-adds nuget.org with a wildcard*mapping over a user's explicit internal-proxy config; workaround: decline the change and edit NuGet.config manually. Policy-bypass concern noted but not a security vulnerability.Urgency: ⚪ backlog — no milestone
Reason: bug with a workaround, not identified as a regression; does not meet the raised 13.5 bar while it stabilizes
Suggested owner(s): James Newton-King (@JamesNK) (score 11), backup Mitch Denny (@mitchdenny) (score 5)
Evidence:
area-clicontributor (e.g. Show status while preparing dashboard bundle #18985, Make CLI package metadata prefetching opt-in #18968, Fix flaky AppHost launcher cancellation test #18856, Fix duplicate dashboard stopping message #18827, Revert ProjectLocator walk-stop behavior from #18683 #18700) and CODEOWNER forsrc/Aspire.Cliarea-cli(last 90d) and is CODEOWNER forsrc/Aspire.CliConfidence: high
Needs human?: no
adamint commentedon Aug 10, 2026
I can reproduce this on current
main(8c3d8e7c) on macOS 26.6 arm64 with .NET SDK 10.0.201. I started with anuget.configcontaining only aninternalsource and* -> internal, then passed an explicit daily channel withAspire* -> dailyand* -> nuget.orgtoNuGetConfigMerger.CreateOrUpdateAsync. The generated file adds nuget.org as a source and contains both* -> nuget.organd* -> internal. A focused offline test fails on the unexpected nuget.org source and prints both wildcard mappings, so this is still reproducible. No network access or package restore was involved.danegsta commentedon Oct 16, 2026
This should be fixed by #19763