Warn when using deprecated Nuget packages

[kevinoid]

NuGet Product(s) Involved

dotnet.exe

The Elevator Pitch

NuGet could warn .NET SDK users when they use (e.g. install or restore) a deprecated package, as Visual Studio does, so that they can consider taking appropriate action

Additional Context and Details

@zijchen reported this issue a year ago in dotnet/sdk#22635 and was instructed to report it here. I was unable to find a corresponding issue, and am also interested in this feature, so I'm opening this issue to suggest it.

A concrete example, from the original issue, using the deprecated WindowsAzure.Storage package does not produce any warnings or indications to the user that the package is deprecated:

dotnet new console
dotnet add package WindowsAzure.Storage
dotnet restore
dotnet build

It would be nice if a numbered NuGet Warning were produced to inform users and allow monitoring (e.g. failing CI with warn-as-error builds).

Thanks for considering,
Kevin

[erdembayar]

@kevinoid
Thank you for reporting this issue. I believe this is something already on our radar, please upvote if you want us to prioritize this issue. Meantime you can use dotnet list package --deprecated command to detect deprecated/vulnerable/outdated packages. Soon you can get json format output too.

> dotnet list package --deprecated --include-transitive

The following sources were used:
   https://api.nuget.org/v3/index.json
   https://apidev.nugettest.org/v3-index/index.json
   https://pkgs.dev.azure.com/azure-public/vside/_packaging/vs-impl/nuget/v3/index.json
   C:\IssueRepro\11711\

Project `12244` has the following deprecated packages
   [net7.0]:
   Top-level Package           Requested   Resolved   Reason(s)   Alternative
   > WindowsAzure.Storage      9.3.3       9.3.3      Other       Azure.Storage.Blobs >= 0.0.0

@nkolev92
Do we have any restore security issue we can dedup?

[nkolev92]

There's no dups. This is the first ask I'm aware of. Removing the irrelevant labels as this is not a security thing.

[cremor]

I think this should also warn when using an unlisted package version. Use case: #11883 (comment)