We have a nuget proxy repo that connects to jfrog artifactory. When a package of specific version is being removed from jfrog artifactory our nexus repo does not show that package version in Browse index(html view) but when I simply use search bar and search for the package the deleted version appears in the result and the last update date is set 1/1/1970 with the file size mentioned as 0 bytes.
this cause issue in our builds that nuget cli resolves the dependencies to one of these deleted assets and our dotnet nuget restore and build fails with a message package with the version not found in feed. So we had to use the search option and delete the asset and then it resolves to the correct version.
the same happens with the chocolatey repo as well, we have proxy repo remotes to https://chocolatey.org so the same behavior is seen here as well
Hi, by chance are you using an older version of Nexus? I recall some caching behaviour related to NuGet CLI search in older versions which I believe has been removed.
@mpiggott hi, I tried the 2 versions of Nexus i.e. 3.69.0-02 and 3.72.0-04 and the search displaying deleted packages with last updated date on 1/1/1970 behavior is seen in both. Moreover using Cleanup policy also does not remove these packages from search.
one interesting observation is that when using latest nuget.exe client 6.12.1 this issue is seen and when downgrading the nuget client to 6.11 or 6.10 this issue of picking the deleted versions of packages for resolution does not happen.
Temporarily to make our build/restore work with latest nuget client (6.12.1) we had to recursively delete (manually) the faulty assets with date (1/1/1970) and size 0 bytes from the search in nexus.
In this proxy repo we have set Maximum Component age and maximum metadata age to just 5 minutes. Nuget protocol is set to Nuget v2
Is this a bug in Nexus ? or a config change is needed on our nexus instance ?
Given this appears to be a new release of NuGet and isn’t repeatable with the older versions there may be a behaviour change perhaps report it as a bug: Issues · sonatype/nexus-public · GitHub
Issue created in GitHub - Nexus search displays deleted package version with last updated date as 1/1/970 and file sizes as 0 bytes · Issue #529 · sonatype/nexus-public · GitHub
found this related issue - New 6.12 Nuget algorithm leads to extra packages being downloaded. · Issue #13930 · NuGet/Home · GitHub