Nuget sourceUrl comes from latest stable release even when unlisted

[yashpalk]

How are you running Renovate?

Self-hosted Renovate

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

GitLab

Please tell us more about your question or problem

Hi there, I'm trying to sort out how the package source link was resolved to https://github.com/deniszykov/commandline instead of https://github.com/dotnet/command-line-api for the System.CommandLine package.

Here is a reproduction repo: https://github.com/yashpalk/renovate-37168

Including the MR markdown below:

This MR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [System.CommandLine](https://github.com/deniszykov/commandline) | `2.0.0-beta4.22272.1` -> `2.0.0-beta6.25358.103` | [![age](https://developer.mend.io/api/mc/badges/age/nuget/System.CommandLine/2.0.0-beta6.25358.103?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![adoption](https://developer.mend.io/api/mc/badges/adoption/nuget/System.CommandLine/2.0.0-beta6.25358.103?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![passing](https://developer.mend.io/api/mc/badges/compatibility/nuget/System.CommandLine/2.0.0-beta4.22272.1/2.0.0-beta6.25358.103?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/nuget/System.CommandLine/2.0.0-beta4.22272.1/2.0.0-beta6.25358.103?slim=true)](https://docs.renovatebot.com/merge-confidence/) |

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever MR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this MR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this MR, check this box

---

Logs (if relevant)

Logs

Replace this text with your logs, between the starting and ending triple backticks

[github-actions[bot]]

Hi there,

Please help this Discussion progress by creating a minimal reproduction. This means a repository dedicated to reproducing this issue with the minimal dependencies and config possible.

Before we start working on your issue we need to know exactly what's causing the current behavior. A minimal reproduction helps us with this. Discussions without reproductions are less likely to be converted to Issues.

Please follow these steps:

1. Read our guide on creating a minimal reproduction.
2. Go to our minimal reproduction template repository.
3. Select the Use this template button to create a new repository based on the template.
4. Work on the minimal reproduction in your own repository.
5. Fill out the information in your repository's README.md.
6. Add the link to your reproduction to the first post of your Discussion. If you are not the original author, you can post a new comment with the link.

If you need help with running Renovate on your minimal reproduction repository, please refer to our Running Renovate guide.
Good luck,

The Renovate team

[yashpalk]

Updated the first post with a reproduction repo, adding a comment here too: https://github.com/yashpalk/renovate-37168

[bording]

@rarkins I'm also having the same problem, and here's an example PR that renovate opened that demonstrates the problem, if that's what you're looking for: Particular/NServiceBus.RabbitMQ#1633

[rarkins]

No, please see the instructions for reproductions above

[yashpalk]

Just installed the app, here’s the PR: yashpalk/renovate-37168#1

[rarkins]

The sourceUrl you're seeing is being pulled from https://api.nuget.org/v3-flatcontainer/system.commandline/1.0.0.4/system.commandline.nuspec

That's because 1.0.0.4 is the latest stable release and Renovate picks that release to determine the package's metadata.

The newer URL is present in https://api.nuget.org/v3-flatcontainer/system.commandline/2.0.0-beta7.25380.108/system.commandline.nuspec

[bording]

@rarkins If you look at https://www.nuget.org/packages/System.CommandLine/, you'll see that all of the earlier versions are unlisted. You shouldn't be looking at unlisted package versions to get data from.

[rarkins]

Converted to issue: #37577