Current Behavior

Using Dependency Track 4.7.0, warnings similar to those below are regularly observed in the logs:

2023-01-13 19:12:06,807 INFO [RepositoryMetaAnalyzerTask] Performing component repository metadata analysis against 58 components in project: 9731f6d0-12f0-4625-a688-fd8d0be204ea
2023-01-13 19:12:09,046 WARN [NugetMetaAnalyzer] An error occurred while parsing upload time for a NuGet component - Repo returned: 1900-01-01T00:00:00+00:00
2023-01-13 19:12:09,046 WARN [NugetMetaAnalyzer] An error occurred while parsing upload time for a NuGet component - Repo returned: 1900-01-01T00:00:00+00:00
2023-01-13 19:12:10,152 WARN [NugetMetaAnalyzer] An error occurred while parsing upload time for a NuGet component - Repo returned: 1900-01-01T00:00:00+00:00

This was reported in #537 but closed as an assumed defect with NuGet metadata.

The official NuGet docs describe at least one valid use case for the 1900-01-01 timestamp: unlisted packages, which are de-facto deprecated and should no longer be used.

One concrete example to illustrate this: https://www.nuget.org/packages/Unity/5.7.4 -- note the warning:

The owner has unlisted this package. This could mean that the package is deprecated, has security vulnerabilities or shouldn't be used anymore.

Use the NuGet API to retrieve the package registration details (https://api.nuget.org/v3/registration5-semver1/unity/5.7.4.json) and note the listed: false and published: "1900-01-01T00:00:00+00:00" values in the response:

{
    "@id": "https://api.nuget.org/v3/registration5-semver1/unity/5.7.4.json",
    "@type": [
        "Package",
        "http://schema.nuget.org/catalog#Permalink"
    ],
    "catalogEntry": "https://api.nuget.org/v3/catalog0/data/2018.10.15.06.25.35/unity.5.7.4.json",
    "listed": false,
    "packageContent": "https://api.nuget.org/v3-flatcontainer/unity/5.7.4/unity.5.7.4.nupkg",
    "published": "1900-01-01T00:00:00+00:00",
    "registration": "https://api.nuget.org/v3/registration5-semver1/unity/index.json",
    "@context": { /* elided for brevity */ }
}

The NuGet docs at https://learn.microsoft.com/en-us/nuget/api/registration-base-url-resource include an explicit note for this behavior:

Note

On nuget.org, the published value is set to year 1900 when the package is unlisted.

However, Dependency Track does not currently recognize this value and logs a warning.

Proposed Behavior

Update NugetMetaAnalyzer to accept a NuGet API published value of 1900-01-01T00:00:00+00:00 as valid, and meant to represent unlisted packages whose use is discouraged.

Additionally, consider enhancing Dependency Track to flag use of unlisted NuGet packages with warnings, e.g. in its APIs or frontend UI.

It may be helpful to see in the UI, similar to the warning icons for packages which have a newer version available, that the package is unlisted / deprecated and should no longer be used.

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this enhancement was already requested