Legacy OData query patterns used in NuGet V2 feeds

Description

I am on the nuget.org team. We announced the deprecation of OData queries (https://github.com/NuGet/Announcements/issues/37) last year and we will soon begin blocking some endpoints used by other clients. I am posting here because from our telemetry we've noticed several queries that will be blocked are sent by Paket. Our logs indicate that 0.56% of Paket queries against the V2 endpoints will be blocked. No Paket users leveraging our V3 APIs will be affected.

We introduced V3 APIs in early 2016 and have made continuous investments to make it more reliable, high-performing, and secure. We highly recommend that Paket users (as with all NuGet client software) use NuGet's V3 APIs, via the package source URL: https://api.nuget.org/v3/index.json.

For your reference, I have listed below several Paket query patterns that will be blocked under OData deprecation (bad).

https://www.nuget.org/api/v2/Packages?$filter=(tolower(Id) eq 'NuGet.Protocol') and (Version eq '4.1.0')
https://www.nuget.org/api/v2/Packages?$filter=(tolower(Id) eq 'NuGet.Protocol') and (NormalizedVersion eq '4.1.0')
https://www.nuget.org/api/v2/Packages()?semVerLevel=2.0.0&$filter=tolower(Id) eq 'NuGet.Protocol'

I poked around the Paket source code and it looks like the following supported endpoints seem to be already implemented (good):

https://www.nuget.org/api/v2/Packages(Id='NuGet.Protocol',Version='4.1.0')
  -> get metadata about a specific version

https://www.nuget.org/api/v2/FindPackagesById()?id='NuGet.Protocol'
  -> get metadata about all versions of a package

In fact, I wasn't able to get Paket to show these older patterns in the stdout logs so I'm not exactly sure of the impact on Paket when these older endpoints start returning an error (HTTP 400 in this case). I still see references to the unsupported patterns in the aforementioned code file so I'm not sure if I understand the full picture.

We wanted to post this issue as an FYI prior to the disabling of these endpoints. Perhaps there are some mitigations that could be done on the client side to reduce the impact on the 0.56%? Or maybe they are coming from older versions of Paket and nothing can be done? My hope is when these deprecated patterns return HTTP 400, the other acceptable patterns (that return HTTP 200) will be favored without any customer impact. From the code comments it seems like there unsupported queries may still be needed in the code for other package feed implementations?

We plan on making announcements about short test windows where we will disable the deprecated endpoints temporarily as well as the date of the final disabling in the future but we wanted to be proactive based on our current telemetry.

Thanks and I'm happy to answer any questions.

/cc @anangaur @jcjiang

Start in src/Paket.Core/Dependencies/NuGetV2.fs and review the referenced OData query patterns alongside the supported endpoint implementations. Determine whether the deprecated patterns are still reachable for NuGet feeds and how HTTP 400 responses are handled; done means the impact and any required client-side mitigation are established.