---
paths:
  - "3rdParty/**"
  - "**/*.csproj"
  - "**/nuget.config"
  - "**/NuGet.config"
---

# Vendoring a NuGet package

`Modules\NuGet.config` clears the machine's package sources and leaves only `vendored` (a local folder, mapped to `*`)
and `vs-offline` (the VS offline feed, mapped to a few named packages). To add a package neither covers:

1. Get the pristine `.nupkg`, from `https://api.nuget.org/v3-flatcontainer/<id>/<version>/<id>.<version>.nupkg` or
   from the local cache (`~/.nuget/packages/<id>/<version>/`).
2. Put it in a flat `3rdParty\<SomeName>\packages\` folder (`3rdParty\DotNetWasmTools\packages` is the precedent),
   with a short `Readme.txt` saying what it is and why it's vendored.
3. Point a `nuget.config` at that folder as a `packageSource`, and map each package to it by exact name in
   `packageSourceMapping`, never by wildcard, so an unvetted package can't start resolving from it.

To upgrade, replace the package in place. Keep no old versions and no version labels, and delete the stale copy under
`Junk\NuGet` afterwards.