❗Announcement❗ MDS v6.1.0 has been delisted from NuGet.org

[cheenamalhotra]

Important

Due to recently identified issues affecting stability and reliability of data read operations, MDS v6.1.0 has been delisted from NuGet.org.

This is done to prevent customer applications from being exposed to risks while we address concerns and prioritize a Hotfix.

Please follow Milestone 6.1.1 to find the list of issues our team is actively engaged in.

We apologize for the delays in shipping MDS v6.1 and request patience from you to allow us time to stabilize the driver and prepare for the Hotfix release. If you'd like to help us discover issues, the driver build is available in the release artifacts that can be used for testing.

[Frulfump]

This is done to prevent customer applications from being exposed to risks while we address concerns and prioritize a Hotfix.

Delisting(Unlisting in NuGet terms https://learn.microsoft.com/en-us/nuget/nuget-org/policies/deleting-packages#unlisting-a-package would be good to use the exact term used with nuget.org) isn't very visible to users since you can restore the version without getting any info at all it has been delisted. I follow releases for this repo with GitHubs built in notification system but since the title of the release was just changed I got no new notification and just found this issue by chance while looking at issues in the repo so I started following all issues as well but that's very noisy could you create an announcements repo instead like dotnet https://github.com/dotnet/announcements (and NuGet) has?

And in the NuGet gallery itself (nuget.org) you don't get any indication any version has been unlisted, I opened an issue for this as well NuGet/NuGetGallery#10521 which includes adding a command dotnet list package --unlisted that you could run in your scheduled CI runs to be informed.

Fortunately Dependabot added support for a cooldown period before PRs are opened https://github.blog/changelog/2025-07-29-dependabot-expanded-cooldown-and-package-manager-support/ 15 days ago but I doubt many people know of this or set it to more than 7 days (the version was unlisted after 11 days)

Unfortunately Dependabot doesn't inform you if a version has been delisted and will happily open a PR with an update to a delisted version. I created an issue to track this here dependabot/dependabot-core#12447

Renovate however supports something similar since 5 years back renovatebot/renovate#7304 where it will tell you it's deprecated (for some reason).

So with all that said many affected will be clueless of the unlisting. I do notice there wasn't a specific issue linked to on GitHub that reports the issue is there one or could more information be given as to how this issue would manifest? It would help for the potential mass of people running in to the issue.

[perlun]

Agree with the sentient shared by @Frulfump. Properly yanking the package (which is perhaps not possible with NuGet, and yanking has its own share of downsides - leftpad, I'm looking at you) would have been very helpful to us, since it would have caused CI builds to fail => would have pointed us in the right direction, investigating why version 6.1.0 was no longer available. Now we ended up spending a few days debugging why our software would suddenly "hang" without any exception message (likely because of #3536).

[roji]

Not sure, but nuget package deprecation may be the right thing here - you can flag a specific version as having critical bugs. I'm not sure whether that would cause CI/buildd failures though.

[Frulfump]

Not sure, but nuget package deprecation may be the right thing here - you can flag a specific version as having critical bugs. I'm not sure whether that would cause CI/buildd failures though.

I think that would be good or at least something, a package can be both unlisted and deprecated (example here https://www.nuget.org/packages/Azure.Core/1.46.0) and we could check for deprecated in nightly CI https://learn.microsoft.com/en-us/dotnet/core/tools/dotnet-package-list#options with dotnet list package --deprecated

It doesn't cause CI/build failures by default (unless you specifically run the command above and fail the build when anything is found to be deprecated) so it's generally considered safe.

https://learn.microsoft.com/en-us/nuget/nuget-org/deprecate-packages

Package deprecation is different than unlisting your package as explained below:

• Unlisting a package prevents its discovery because it is hidden in search results.
• Deprecating a package lets your package's existing consumers find out if they have it installed or used in their projects. It also >lets them know the reason for deprecation and an alternate recommended package as specified by you (the package publisher). >Deprecating a package does not unlist the package.

So is much more in line with what's the intention here.

If the package is no longer maintained, choose the Legacy option. If the specific version has a critical bug, choose the has critical bugs option. For any other reason, select Other. You can always specify an alternate recommended package (and version) and a custom message to the owners.

So the critical bug option seems reasonable and a custom message linking to this issue.

Custom message is only shown on nuget.org but not from the clients. Currently, clients such as dotnet.exe and the NuGet Package Manager do not show the custom message.

[David-Engel]

The package was also marked as deprecated with critical bugs at the same time we delisted it:

https://www.nuget.org/packages/Microsoft.Data.SqlClient/6.1.0

[Frulfump]

The package was also marked as deprecated with critical bugs at the same time we delisted it:

https://www.nuget.org/packages/Microsoft.Data.SqlClient/6.1.0

Oh the title of this issue is misleading then. Should also be mentioned in the issue description.

[cheenamalhotra]

MDS v6.1.1 is now released and available on NuGet.org.