> Another charitable explanation for the version selection rule is to allow specifying more than one mirror of the registry. Thus if the closer mirror has the l

> Another charitable explanation for the version selection rule is to allow specifying more than one mirror of the registry. Thus if the closer mirror has the latest version it will be used, This is correct, but in light of this being now vulnerable to abuse, this will have to be controlled in mixed use scenarios, which are common, e.g. as I wrote here https://news.ycombinator.com/item?id=26089387 https://news.ycombinator.com/item?id=26089387 > if I run an internal feed that transparently proxies and caches the public one, as well as hosting my company's internal artefacts, the rules now might need to be different between packages? > for e.g. between Newtonsoft.Json (new versions always originate on the public feed, never locally) and "SDCo.GeneralUtils" (new versions always originate on the local feed, never upstream)