NuGet Package Manager & NuGet Gallery

NuGet Package Manager & NuGet Gallery: Manage NuGet Packages, Updates, Vulnerabilities, a VS Code extension by Zovo

Browse nuget.org, then install, update and remove NuGet packages in your .csproj, .fsproj and .vbproj files. Central package management (Directory.Packages.props), outdated and vulnerable packages across the whole solution, and private feeds from nuget.config. Free, no sign-in, no telemetry.

Free, MIT license. Needs VS Code 1.90.0 or newer. Extension ID zovo.zovo-nuget-package-manager, version 0.1.3.

Network: the extension talks only to nuget.org (api.nuget.org and its search servers) and to the feeds in your nuget.config files, and only after you open the manager. Opening a folder sends nothing.

Not made by or affiliated with Microsoft, the .NET Foundation or NuGet. NuGet is a trademark of its owner.

Questions people ask

What it does

• Projects: it finds every .csproj, .fsproj and .vbproj in all folders of the workspace, and the projects of each .sln and .slnx. It reads PackageReference, Directory.Packages.props, Directory.Build.props (and the props files they import), VersionOverride, GlobalPackageReference and versions set through a property such as $(EFCoreVersion).
• Browse: search nuget.org or any v3 feed, with a prerelease switch. Details show versions, downloads, licence, project URL, dependencies per target framework, and the package README.
• Install, update and remove: the extension edits the project XML in place. Formatting, comments, attribute order, the byte order mark and line endings stay as they were. With central package management the version goes to Directory.Packages.props. A version set through a property is changed where the property is defined.
• Restore: after each change it runs dotnet restore when the .NET SDK is installed, with the output in the NuGet output channel. Without the SDK the change is saved and the message says restore was skipped.
• Updates: the Updates tab lists every outdated package across the solution. Tick some or update all. Version ranges such as [8.0,9.0) stay inside the range, and prereleases appear only when you switch them on (or already use one).
• Vulnerable and deprecated: flags from the nuget.org vulnerability data (the same source dotnet list package --vulnerable uses) and from the deprecation data of each version, with severity and the advisory link.
• Consolidate: the tab shows packages that are used in more than one version across the projects.
• Private feeds: sources come from every nuget.config that applies (the folder, its parents and your user file), including <clear /> and disabled sources. Azure Artifacts, GitHub Packages and other v3 feeds work with a user name and a personal access token you paste once; it is kept in VS Code's secret storage. A ClearTextPassword in nuget.config (also %ENV_VAR%) is used as is. A 401 shows which feed needs a token.
• packages.config projects are listed with a clear message: they are not edited here. Migrate them to PackageReference first.

Open it from the NuGet icon in the activity bar, the Manage NuGet Packages button on a project file, or the Command Palette command NuGet: Open NuGet Package Manager.

Why this one

Measured against what users of the other NuGet extensions asked for (links go to the public issue or review):

It also works without the .NET SDK for browsing, editing and the outdated view. The same extension is published to Open VSX for Cursor, Windsurf and VSCodium.

Free and Zovo Pro

Everything above is free and stays free. Two tools for teams are Zovo Pro (USD 19 once, for every Zovo extension). Each can be used 3 times for free first:

• Licence report: the licence of every package of the solution, saved as CSV, for a licence review or a customer.
• Migrate to central package management: moves every version of the solution into one Directory.Packages.props in one step, with a diff of every file before anything is written.

Nothing about Pro shows when you open a project. Set zovoNuget.showProFeatures to false to hide the two tools.

Settings

Privacy

No account, no telemetry, no analytics. Requests go to nuget.org and to the feeds in your nuget.config, only after you open the manager. Tokens stay in VS Code's secret storage and are sent only to the feed they belong to. The vulnerability list from nuget.org is cached in the extension's storage folder.