NuGet "NU1100: Unable to resolve" from Package Source Mapping

By Daniel Zoghalchali·Latchkey

Package source mapping restricts which feed each package id may come from. If a package matches no <packageSourceMapping> pattern, NuGet allows it from no source and restore fails to resolve it - even though the feed has it.

What this error means

Restore fails to resolve a package (often NU1100) that you know exists on a configured feed. The cause is that source mapping does not route that id to any source, so NuGet never searches the feed that has it.

dotnet restore output

error NU1100: Unable to resolve 'Contoso.Internal.Auth (>= 2.0.0)' for 'net8.0'.
PackageSourceMapping is enabled, the following source(s) were not considered:
 nuget.org, internal

Diagnose it: SDK version and restore

Terminal

dotnet --info
cat global.json 2>/dev/null
dotnet restore --verbosity normal
dotnet build --no-restore

Common causes

No source-mapping pattern matches the package id

With source mapping enabled, a package must match a <package pattern="..."> under some source. An id outside every pattern is routed to no source and cannot be resolved.

A pattern routes the id to the wrong feed

A broad pattern (e.g. * under nuget.org) can capture an internal id and send it to a public feed that does not have it, so it never reaches the private feed.

How to fix it

Add a mapping pattern for the package

Route the package id (or its prefix) to the source that actually hosts it.

NuGet.config

<packageSourceMapping>
  <packageSource key="nuget.org">
    <package pattern="*" />
  </packageSource>
  <packageSource key="internal">
    <package pattern="Contoso.*" />
  </packageSource>
</packageSourceMapping>

Verify which source a package maps to

Restore with --verbosity detailed to see which sources were considered for each id.
Make internal prefixes map to the private feed and only public ids map to nuget.org.
Re-run restore and confirm the package now resolves from the intended feed.

How to prevent it

Define explicit mapping patterns for internal package prefixes.
Keep * mapped to the public feed and specific prefixes to private feeds.
Treat source mapping as a security control against dependency confusion, not just routing.

Frequently asked questions

What causes NuGet "NU1100: unable to resolve" from package source mapping?

There are 2 common causes: no source-mapping pattern matches the package id and a pattern routes the id to the wrong feed. With source mapping enabled, a package must match a <package pattern="..."> under some source.

How do I fix NuGet "NU1100: unable to resolve" from package source mapping?

There are 2 fixes depending on which cause you have: add a mapping pattern for the package and verify which source a package maps to. Work through them in order, since the first is the most common.

What does NuGet "NU1100: unable to resolve" from package source mapping actually mean?

Restore fails to resolve a package (often NU1100) that you know exists on a configured feed.

How do I stop NuGet "NU1100: unable to resolve" from package source mapping happening again?

Define explicit mapping patterns for internal package prefixes. The prevention section lists 3 changes that keep it from recurring.