diff --git a/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/PackagesConfigRestorer.cs b/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/PackagesConfigRestorer.cs index 2348eb809f8c..294349e66f92 100644 --- a/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/PackagesConfigRestorer.cs +++ b/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/PackagesConfigRestorer.cs @@ -35,7 +35,7 @@ internal class PackagesConfigRestoreFactory { public static IPackagesConfigRestore Create(IFileProvider fileProvider, DependencyDirectory packageDirectory, Semmle.Util.Logging.ILogger logger, FeedManager feedManager) { - if (SystemBuildActions.Instance.IsWindows() || SystemBuildActions.Instance.IsMonoInstalled()) + if ((SystemBuildActions.Instance.IsWindows() || SystemBuildActions.Instance.IsMonoInstalled()) && !feedManager.HasPrivateRegistryFeeds) { return new NugetExeWrapper(fileProvider, packageDirectory, logger, feedManager); } @@ -252,7 +252,7 @@ public int InstallPackages() { if (PackageCount > 0) { - logger.LogInfo("Found packages.config files, but nuget.exe cannot be used to restore packages on this platform. Skipping restore of packages.config files."); + logger.LogInfo("Found packages.config files, but nuget.exe cannot be used to restore packages on this platform or if private registry feeds are configured. Skipping restore of packages.config files."); } return 0; } diff --git a/csharp/ql/lib/change-notes/2026-10-28-nugetcli-proxy-config.md b/csharp/ql/lib/change-notes/2026-10-28-nugetcli-proxy-config.md new file mode 100644 index 000000000000..b23147588306 --- /dev/null +++ b/csharp/ql/lib/change-notes/2026-10-28-nugetcli-proxy-config.md @@ -0,0 +1,5 @@ +--- +category: minorAnalysis +--- + +- When private NuGet registries are configured, the extractor now attempts to restore dependencies listed in `packages.config` files using `dotnet restore` instead of the NuGet CLI so that the private registry configuration is respected.