Renovate: Renovate creates PRs for unlisted NuGet package versions

[fgreinacher]

What Renovate type, platform and version are you using?

GitHub (happens everywhere, we discovered it on self-hosted GitLab)

Describe the bug

Renovate tries to update to unlisted Nuget package version, probably since https://github.com/renovatebot/renovate/pull/6943 was merged (/cc @zharinov @viceice)

To Reproduce

• Add a reference to a NuGet package that has a higher version that was unlisted (e.g. https://www.nuget.org/packages/System.ComponentModel.Composition where https://www.nuget.org/packages/System.ComponentModel.Composition/2010.2.11.0 is unlisted). See https://github.com/fgreinacher/renovate-include-consumer/blob/master/test.csproj
• Wait for Renovate to create a PR for new unlisted version. See
  https://github.com/fgreinacher/renovate-include-consumer/pull/6/files

Additional hints

• Renvoate should probably filter listed: false entries from https://api.nuget.org/v3/registration5-semver1/system.componentmodel.composition/index.json

[viceice]

I think we should mark them as deprecated like we do on mom packages. So we can suggest downgrades.

[rarkins]

@fgreinacher no need to reproduce it separately if you plan to fix it, but otherwise we would need something to test/verify against

[fgreinacher]

@fgreinacher no need to reproduce it separately if you plan to fix it, but otherwise we would need something to test/verify against

The PR mentioned above (https://github.com/fgreinacher/renovate-include-consumer/pull/6) is the repro. But nevertheless, I'm working on a fix right now.

[rarkins]

Sorry! I'm used to people basing the reproduction steps on the assumption that whoever fixes it has a working knowledge of whatever package manager is being used, instead of just creating a small repo to be tested against. I stopped reading!

[renovate-release]

:tada: This issue has been resolved in version 23.30.3 :tada:

The release is available on:

• GitHub release
• 23.30.3

Your semantic-release bot :package::rocket: