ASP.NET Core Best Practices

Chapter 1 · Practice 3 of 3

Manage NuGet versions centrally and lock them

From Versions and project setup

Why it matters

In a solution with several projects, the same package drifts to different versions in each .csproj. Central Package Management puts every version in one Directory.Packages.props file, and projects reference packages without versions.

Add a lock file for repeatable restores:

  1. Set <RestorePackagesWithLockFile>true</RestorePackagesWithLockFile>.
  2. Commit the generated packages.lock.json files.
  3. Restore with dotnet restore --locked-mode in CI, which fails if the lock file is out of date.

Run dotnet list package --vulnerable --include-transitive in CI to catch known vulnerable dependencies.

Example

XML
<!-- Directory.Packages.props -->
<Project>
  <PropertyGroup>
    <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
  </PropertyGroup>
  <ItemGroup>
    <PackageVersion Include="Microsoft.EntityFrameworkCore" Version="10.0.0" />
  </ItemGroup>
</Project>