[michaelnebel]

This PR is mostly generated by CoPilot. We could consider using it instead of completely disabling the use of the NuGet CLI, when private registries are configured (see the referenced PR further down).

However, we still get a lot of error messages in the log, if private registries (and a proxy) are set and if they are a pre-requisite for restoring "anything". @mbg : What is your impression? Should we just exclude private registries from the restore process when using the NuGet CLI or should we completely disable the step?

CoPilots auto generated summary can be seen below.

Summary

Inspired by #22911, keep using the NuGet CLI for packages.config restores instead of disabling it when private registries are configured.

• Retain applicable non-private feeds while excluding organization-configured private registries, including base-feed replacements, from NuGet CLI sources.
• Pass an explicit empty source when no eligible feeds remain, preventing implicit fallback to private sources.
• Leave private registry support in dotnet restore unchanged.
• Add regression coverage and a C# analysis change note.

[Copilot]

🟡 Changes recommended

Private-feed filtering can let equivalent registry URLs bypass the proxy and incorrectly suppress the NuGet.org fallback, causing otherwise valid package restores to fail.

2 open issues

• Exclude private feeds when selecting the NuGet.org fallback · New
• Compare registry URLs by URI identity · New

What changed in this PR

This PR keeps NuGet CLI restores available for C# packages.config files while excluding organization-configured private registries, rather than disabling the restore step. Private registry support in dotnet restore remains unchanged.

Changes:

• Adds NuGet CLI source filtering and an empty local source when no eligible feeds remain.
• Routes packages.config restores through the new source-selection method.
• Adds regression coverage and a C# analysis change note.

File	Description
csharp/​ql/​lib/​change-notes/​2026-10-30-nuget-cli-private-registries.md	Documents the NuGet CLI restore behavior.
csharp/​extractor/​Semmle.Extraction.Tests/​FeedManager.cs	Tests private-feed exclusion, defaults, and empty-source behavior.
csharp/​extractor/​Semmle.Extraction.CSharp.DependencyFetching/​PackagesConfigRestorer.cs	Uses the NuGet CLI-specific source selection.
csharp/​extractor/​Semmle.Extraction.CSharp.DependencyFetching/​FeedManager.cs	Implements private-registry filtering for NuGet CLI restores.

_{Review effort: Max (auto)}