The deprecation/vulnerability label on the installed tab does not indicate *which* packages are deprecated/vulnerable

[vsfeedback]

This issue has been moved from a ticket on Developer Community.

---

[severity:It bothers me. A fix would be nice]

Microsoft Visual Studio Enterprise 2019 Preview
Version 16.9.0 Preview 2.0

Project: ASP.NET 5

Issue:
Visual Studio permanently shows in the NuGet visualization that a package would ism deprecated - but all packages are up-to-date.
If the error were true, it would also be good to know which package (we are close to 2021, please show the package instead to a plain number please!).

---

Original Comments

Feedback Bot on 12/27/2020, 06:20 PM:

We have directed your feedback to the appropriate engineering team for further evaluation. The team will review the feedback and notify you about the next steps.

eryondon [MSFT] on 12/28/2020, 02:06 PM:

Here “deprecated” and “not up to date” are 2 different concept.
You can have the last and most to date version of package installed, but it still can be “deprecated” because owner of package stopped taking care of it some time ago or some other reason like security etc.
Can you share the name of “package” in question?
You can find more info about deprecation from below link.

• https://docs.microsoft.com/en-us/nuget/nuget-org/deprecate-packages

Please let me know.

Why do we ask for more info?
We try to reproduce all issues reported with the information provided in the description and comments. When we can’t reproduce the issue, we ask you for more information so we can resolve the issue as quickly and efficiently as possible.
In our guidelines, you can get tips on how to provide clear and simple reproducible steps.

Feedback Bot on 1/5/2021, 07:26 PM:

We will close this report in 14 days because we don’t have enough information to investigate further. To keep the problem open, please provide the requested details.

Benjamin Abt on 1/14/2021, 01:34 PM:

Hi roger

i didn’t even see that i received any replies here; didn’t vote for anything either. must have overlooked the mails while on vacation.

it is true that i could not give more info, because i complain that this info is missing.

---

Original Solutions

Roger Stein Grading solved on 1/14/2021, 09:53 AM, 0 votes:

Hey @Benjamin Abt!

Even though apparently you were misunderstood by both @eryondon [MSFT] and @Feedback Bot since you were asked what package was in question (which was kinda what you wondered about, which you suggested would be better feedback in Visual Studio than simply stating how many packages were found deprecated - LOL xD), still an answer to your question is found at the link you got (https://docs.microsoft.com/en-us/nuget/nuget-org/deprecate-packages).

Here's a screenshot from it (answer/solution) :

Repro Steps

1. Create a VB.net console app targeting net6.0 (PackageReference project).
2. Add newtonsoft.json 13.0.1 (package not vulnerable/deprecated).
3. Add a new ASP.NET WebForms project targeting net framework 4.8 (packages.config project); this will add newtonsoft.json 12 to this project; which is a vulnerable package.
4. Save all.
5. Open Solution PM UI

[nkolev92]

I have retitled the issue to the clearly call out the root cause. Note that the developer community issue has another report.

[nkolev92]

fyi @chgill-MSFT @donnie-msft - no action required, just wanted you to be aware of this request.

[BenjaminAbt]

Thanks @nkolev92

[dominoFire]

Instance of this bug: https://devdiv.visualstudio.com/DevDiv/_workitems/edit/1578195

[silkfire]

Any update on this bug? It still is present in Visual Studio 2022.