[Breaking change]: NuGet pack warns (NU5052) when a package ID uses characters outside the restricted set

[nkolev92]

Description

NuGet's pack now emits warning NU5052 when a package ID doesn't conform to the restricted character set that nuget.org enforces. The warning is gated by SdkAnalysisLevel >= 11.0.100 and currently applies to SDK-style projects only.

• Tracking issue: Pack Warning when Package ID doesn't meet the standards NuGet/Home#14949
• Implemented in: Add NU5052 pack warning for non-restricted package IDs NuGet/NuGet.Client#7487
• Announcement: Strengthening NuGet Security with Package ID Standards NuGet/Announcements#75

Version

.NET 11 Preview 6

Previous behavior

dotnet pack produced a package for any package ID accepted by the legacy ID rules, including IDs containing characters outside ASCII letters, digits, dots, and dashes, or with consecutive ./- characters.

New behavior

When packing on the .NET 11 SDK (SdkAnalysisLevel >= 11.0.100, first introduced in .NET 11 Preview 6), packing a package whose ID doesn't meet the restricted rules emits warning NU5052. A valid ID:

• Must start with a letter, digit, or underscore (_)
• May contain only ASCII letters, digits, dots (.), dashes (-), and underscores (_)
• Cannot contain consecutive . or - characters
• Must be 100 characters or less

Type of breaking change

• Binary incompatible: Existing binaries might encounter a breaking change in behavior, such as failure to load or execute, and if so, require recompilation.
• Source incompatible: When recompiled using the new SDK or component or to target the new runtime, existing source code might require source changes to compile successfully.
• Behavioral change: Existing binaries might behave differently at run time.

Reason for change

Under the covers, NuGet derives strings such as URLs and file-system paths from a normalized version of the package ID. Normalization relies on built-in string libraries that are inconsistent across .NET Framework, modern .NET, Windows, and Linux, so two visibly different IDs can normalize to the same string. Restricting the allowed character set (as npm, PyPI, and other registries have done) closes this security and branding gap.

Recommended action

Rename the package to an ID within the restricted character set — transliterate to ASCII (for example, Müller.Logging becomes Mueller.Logging) — then deprecate the old ID and point it at the new one.

Because this is a warning, suppression is implied: add <NoWarn>NU5052</NoWarn>, or set SdkAnalysisLevel below 11.0.100.

Feature area

SDK

Affected APIs

N/A (build-time NuGet diagnostic).

---

Associated WorkItem - 599251