When using GitHub Nuget feed, "restore" and "install" updates to latest version rather than the (older) version in packages.config

[AlessandroCorrad]

Hi,
so the issue is the following:
when I try to "install" or "restore" a NuGet package that is hosted on GitHub, it always installs the latest version of the package rather than the (older) version that I specified via packages.config or via the Editor Window.
The package is hosted on a company private GitHub repository and it requires authentication via GitHub token. The issue is not present if I execute the same commands via the official dotnet CLI in a .Net empty project so I'm pretty sure the package is available in the registry.

Operating system: Windows 10
NuGetForUnity: 4.3.0

[bigswede74]

I have the same issue see the below logs where the latest version is 0.1.143-prerelease but the version I am looking for is 0.1.47-prerelease.

Restoring NuGet Packages ...
Failed to get 'my.package' from the package source 'https://api.nuget.org/v3/index.json'. Error: System.Net.Http.HttpRequestException: The request to 'https://api.nuget.org/v3/registration5-gz-semver2/my.package/index.json' failed with status code 'NotFound' and message: <?xml version="1.0" encoding="utf-8"?><Error><Code>BlobNotFound</Code><Message>The specified blob does not exist.
RequestId:XXXXXXXXXXX
Time:2025-04-03T23:35:32.4027760Z</Message></Error>
   at NugetForUnity.PackageSource.NugetApiClientV3.EnsureResponseIsSuccessAsync(HttpResponseMessage response) in /_/src/NuGetForUnity/Editor/PackageSource/NugetApiClientV3.cs:line 458
   at NugetForUnity.PackageSource.NugetApiClientV3.GetStringFromServerAsync(NugetPackageSourceV3 packageSource, String url, CancellationToken cancellationToken) in /_/src/NuGetForUnity/Editor/PackageSource/NugetApiClientV3.cs:line 763
   at NugetForUnity.PackageSource.NugetApiClientV3.GetRegistrationPageItemsAsync(NugetPackageSourceV3 packageSource, INugetPackageIdentifier package, CancellationToken cancellationToken) in /_/src/NuGetForUnity/Editor/PackageSource/NugetApiClientV3.cs:line 545
Installing my.package 0.1.143-prerelease ...
my.package 0.1.47-prerelease is already listed in the packages.config file.  Updating to 0.1.143-prerelease

[pocketninja25]

It looks like this stems from the use of 'Find' when searching pageItem in NugetApiClientv3.GetPackageRegistrationLeafAsync. The items list in pageItems.Items looks to be unsorted, so it's going to find the first item that matches the 'InRange' constraint, which could be a higher version, even though the exact version also exists in the list. If there's a difference between nuget and github here I assume it's that nuget orders their versions correctly so the first item found is the exact version (if it exists).

I've tried two possible solutions, one probably better than the other.

1. Try find the exact match on version, before backing down to the 'Find.. InRange' check.
2. Sort the items by version, then perform the 'Find.. InRange' check.

Both of these seem to work for me (and the second is probably better, cos you probably wont fast forward as far if your version doesn't exactly exist, but i've not exactly performed exhaustive testing on side-effects.

[JoC0de]

Closed as it is fixed in v4.4.0