Deprecation and vulnerability filters on Installed tab

[anangaur]

From: https://developercommunity.visualstudio.com/comments/1068668/view.html

[anangaur]

Assigned to @drewgillies as we will have similar issues for vulnerability feature

[nkolev92]

fyi @donnie-msft @chgill-MSFT

[donnie-msft]

Filtering is pretty minimal... and we've recently discussed this with the nuget.org changes that are going on.

We also don't show deprecation in the details pane on solution package manager UI: #8568

[jzabroski]

Found this issue via https://developercommunity.visualstudio.com/t/nuget-package-manager-ui-reports-you-have-1-deprec/957820?viewtype=solutions and through https://developercommunity.visualstudio.com/t/nuget-package-manager-doesnt-indicate-that-a-packa/539006

I do not have any deprecated packages listed under the Installed tab, despite a yellow warning triangle saying so. Initially, I thought I had gone mad and/or hadn't dranken enough caffeine this morning to see the tiny yellow warning triangle in a list of ~100 packages. But then I meticulously scrolled through every package and saw nothing.

Even more frustrating is that the VS Output window for Package Manager does not mention this. Nor does running dotnet.exe restore --verbosity diagnostic > out.txt; cat out.txt | select-string deprecated warn me that I am restoring a solution with deprecated packages.

I also don't see anything in the VS Error List for NUXXXX for an warning code related to deprecated packages. When I search MS Docs for the specific error code so that I can flag the warning as an error, I can't seem to find such a warning code - so how does nuget know that its a warning icon to display?

[jzabroski]

I have a suspicion that this is flagging NU1605 as a "deprecated package" warning, based on reading the output of dotnet.exe restore --verbosity diagnostic.

I went through all the Nuget Errors and Warnings this morning, and deprecated package doesn't seem to be there.

[jzabroski]

Found it - the yellow warning icon is on the far right of the package, next to the version. It is not in the place I would have expected. I was looking at the status for the package, which is on the left.

@anangaur I think, when your team works on this issue, it would be great if they handle the scenario where the package is both the latest stable and also deprecated. See this scenario with package FluentValidation.Mvc5 as a test case:

  <ItemGroup>
    <PackageReference Include="FluentValidation.Mvc5" Version="8.6.1" />
  </ItemGroup>

[anangaur]

/cc: @chgill-MSFT