Sunsetting the NuGet v2 Server

The Telerik NuGet v2 server will be decommissioned in November 2024. This post explains the reasons and how to prepare.

The modern world of .NET relies heavily on NuGet package dependencies.  For over 15 years we have hosted a v2 NuGet server (nuget.telerik.com/nuget). When v3 became available in 2015, we evolved to also meet this need and hosted a v3 service (nuget.telerik.com/v3/index.json).

We understand the importance of having a reliable and dependable NuGet service available for our customers; therefore, we consistently evaluate the effectiveness and performance of our services. After careful consideration of the benefits and risks of hosting a v2 server, we have concluded it is time to sunset that service in 2024.

Some of the top reasons for this decision are:

• Performance: The v3 protocol uses JSON and is much faster than v2. Switching to the v3 server comes with significant gains for package searches and restore operations.
• Security: Transitioning to v3, built on more modern foundations, will offer enhanced security and integrity for your packages.
• Reliability: We can simplify the networking complexity and spread the load across more v3 nodes, instead of using this capacity for v2 nodes. This helps increase the reliability of the service.

Updating v2 to v3

When you hear the term “upgrade,” it can sometimes come with hesitation. However, it is really a 1-step change. To upgrade to the v3 server, you only need to change the package source’s URL!

• Change https://nuget.telerik.com/nuget to https://nuget.telerik.com/v3/index.json

Authentication is the same, package names are the same; the only difference is the package source’s URL.

Timeline

The proposed timeline for this is as follows:

• June 2024 – Public Notification
• November 2024 – Final Shutdown

You can check out the FAQ section below for answers to common questions. If you have any questions or trouble, please reach out to your Technical Support team at https://prgress.co/DevToolsSupport.

FAQ

Q) I am not using the .NET SDK and use nuget.exe instead. Is there anything I need to consider?

A) Yes, make sure you’re using a nuget.exe version published after 2015

Very old versions of nuget.exe do not know how to communicate with the JSON protocol. The earliest v3 version of nuget.exe was published in 2015. You can download the latest version from Microsoft here => https://dist.nuget.org/win-x86-commandline/latest/nuget.exe.

Q) I am using Telerik NuGet server in CI-CD pipelines. Will this affect me?

A) This will only affect you if the nuget.config uses the old v2 URL.

Here is an example to compare the difference:

<packageSources>
    ...

    <!-- Possibility 1. THIS URL NEEDS TO BE CHANGED-->
    <add key="Telerik" value="https://nuget.telerik.com/nuget" />

    <!-- Possibility 2. CORRECT -->
    <add key="Telerik" value="https://nuget.telerik.com/v3/index.json" protocolVersion="3"/>
</packageSources>

Q) Do I need to update my Azure DevOps Service Connection?

A) Only if the v2 server is used for the Service Connection’s Feed URL.

Some pipelines use a “Service connection” to set the credentials of package sources in a nuget.config. You can go to Azure DevOps project’s Project Settings > Service Connections page.

Click the Edit button to see the Feed URL, here is an example of the edit UI:

Q) I am using PowerShell to add/update the Telerik NuGet. Do I need to make changes?

A) Only if the source is still using the v2 server’s URL.

Check the feed’s URL in the NuGet command’s --source parameter and make sure it is using the v3 URL.  For example:

dotnet nuget update source "Telerik" --source "https://nuget.telerik.com/v3/index.json" …

Q) I am restoring packages in a Dockerfile, does this affect me?

Although Docker uses the .NET SDK rather than nuget.exe to restore packages, it is the same as the rest of the guidance above. Check the package source URL to make sure it is using the v3 server.