Prevent accidental version drift within a solution.

[isaacabraham]

I've been away from the NuGet/VS game for a while, and came back to use it a few days ago. One of the things that still exists is the ability to, very easily, change the version of a dependency in one project but have another version with another project within the same solution, without any warnings or notification that this is the case. This inevitably leads to all manner of problems that usually only rear their head at runtime.

The NuGet tooling should either: -

(a) make this extremely difficult to do e.g. make the "manage nuget packages" dialog always show the solution-wide view rather than the project-specific view that you can get, with warnings saying "this will cause you lots of problems, don't do this" if you explicitly change one project rather than all of them, or

(b) use something akin to the Groups feature in Paket (http://fsprojects.github.io/Paket/faq.html#NuGet-allows-to-use-multiple-versions-of-the-same-package-Can-I-do-that-with-Paket). Lift package versioning to the top level and only refer to dependencies within a packages.config, and override this with a group if required.

[yishaigalatzer]

@isaacabraham I agree with the general gist, and I believe we have a bug covering option (b) (that unfortunately I can't locate right this second).

For now in solution level package manager UI, we add a consolidate view just for this.

Keep in mind that in quite a few solutions it is desired and correct to vary package versions (e.g. shipping applications targeting different platforms, or having varying dependencies per target platform in the case of packages), so blocking the process explicitly/making it super hard - needs more finesse.

[isaacabraham]

Yeah, you will always need an escape hatch. It's just that currently the "pit of failure" is a little bit too big, the ease with which you can do the "wrong" thing at the moment just needs to be dialled down from 9 to maybe 2 or 3 :-)

Consolidate is a nice UI feature - but it would be better to bake this into Nuget at a deeper level IMHO. Also, prevention is way better than cure here - better to stop people needing to consolidate stuff in the first place.

[csharpfritz]

One idea might be to allow some sort of "policy" for automatic package updates, and we've already heard some requests around blocking major-version updates. There's some design and discussion needed here, but I think this fits into a similar function.

[emgarten]

Related: #5602