[Bug Bash] The vulnerability InfoBar does not display in the Solution Explorer window of “packages.config” project until restoring at the second time

[CiciLi1]

NuGet Product Used

Visual Studio Package Management UI

Product Version

NuGet Client Dev\6.10.0.75

Worked before?

No response

Impact

It bothers me. A fix would be nice

Repro Steps & Context

Repro Steps:   

1. Create a C# Class Library (.NET Framework 4.8.1) project.

2. Right-click the project in Solution Explorer and select "Manage NuGet Packages…" menu item to open PM UI.

3. Select the package source: “nuget.org” near the gear button.

4. Click the “settings” button (top-right of right panel), check "Allow format selection on first package install" in “General” tab and click OK button.

5. Go to the "Browse" tab and search for a vulnerable package (e.g. "Newtonsoft.Json").

6. Select a vulnerable package version (e.g. 12.0.1), install the package with “packages.config” format.

7. Right-click the solution node in Solution Explorer and click "Restore NuGet Packages".

Expected:   

A golden InfoBar and a link “Manage NuGet Packages” will show on the top of the Solution Explorer window.

Actual:

The vulnerability InfoBar does not display in the Solution Explorer window of “packages.config” project until restoring at the second time as the record below:

Notes:    

1.The repro rate is 100%.    
2.This is not a regression since it is a new feature.  

Verbose Logs

No response

[SueSu01]

It still reproes on VS Main\35222.175 + NuGet Client Dev\6.12.0.82.

[CiciLi1]

Hi @nkolev92, we have noticed that the vulnerability InfoBar does not display on Dev\6.14.0.23 even after multiple restore. However, it does not reproduce on Dev\6.14.0.20 (we did not verify on Dev\6.14.0.21 and Dev\6.14.0.22 because these builds failed and did not have the VS15 folder).