PackageReference enhancements

[anangaur]

PackageReference requirements, at a glance:

#	Requirement	Issue #	Status
R1	Developers would like to have repeatable builds (restores) across time and space	#5602	Done
R2	Developers would like to control the packages and their versions that are allowed to be used across the team/product	6464	Done
R3	Developers would like to control dependency resolution behaviors	#5553 #912	#912 done, #5553 TBD

Summary of all the above requirements

[jemiller0]

When will PackageReference with ASP.NET/.NET Framework projects be supported?

[hrumhurum]

@jemiller0 PackageReference already works with ASP.NET/.NET Framework projects. We use it on daily basis and cannot be thankful enough to NuGet team for delivering such an excellent feature.

Do you have any specific issues with PackageReference in ASP.NET/.NET Framework projects?

[jemiller0]

According to https://docs.microsoft.com/en-us/nuget/reference/migrate-packages-config-to-package-reference, migration is not supported for ASP.NET projects. I guess this is a limitation of Visual Studio. Did you have to convert your projects manually? If so, are there instructions somewhere on how to do so?

[hrumhurum]

@jemiller0 The absence of PackageReference migration for ASP.NET projects looks like omission. Meanwhile you are welcome to use NuGet PackageReference Upgrader which delivers pretty solid results.

[bludev]

There seem to be some problems to resolve before enabling PackageReference in ASP.NET projects. See also here.

[jemiller0]

It would be nice if Microsoft would state what their plans are with regard to this. I see them adding all kinds of other enhancements to Visual Studio while not giving something like this priority. IMHO, this should be a top priority because it is a source of a lot of frustration and is more fundamental than a lot of the other stuff they are working on.

[merravid]

In packages.config we used to be able to restrict updates of a specific package using allowedVersions, for example:

<package id="RestSharp" version="105.2.3" allowedVersions="[105.2.3]" targetFramework="net472" />

This is very useful when there are compatibility issues.

Is this possible with PackageReference?

[MagicAndre1981]

In packages.config we used to be able to restrict updates of a specific package using allowedVersions, for example:
Is this possible with PackageReference?

this is indeed a great feature missing and tracked here

[sekadiv]

I am still facing issues with package reference in .net framework the dependencies of the package are not loaded properly which is causing lot of issues .

[sebandraos]

@merravid PackageReference versions accept Version Ranges. You can use this to lock to a single version by putting square brackets ([ ]) around your version and NuGet will never suggest an update for that package. e.g.
<PackageReference Include="RestSharp" Version="[105.2.3]" />
As you may already know, the TargetFramework moniker will be automatically resolved based on your current build TargetFramework(s) e.g.

  <PropertyGroup>
    <TargetFrameworks>netstandard2.0;net472</TargetFrameworks>
    <Version>1.2-beta</Version>
  </PropertyGroup>

[jemiller0]

The bottom line is Microsoft doesn't care about .NET Framework. They are doing their best to kill it off. They said they were going to add package reference support for ASP.NET Web Forms projects (in Visual Studio, like they did for the other types of projects). It's years later and they never did it.

[MagicAndre1981]

@merravid PackageReference versions accept Version Ranges. You can use this to lock to a single version by putting square brackets ([ ]) around your version and NuGet will never suggest an update for that package. e.g.
<PackageReference Include="RestSharp" Version="[105.2.3]" />

this doesn't work, I've added it

<PackageReference Include="Microsoft.Extensions.Logging.EventSource">
      <Version>[2.2.0,3)</Version>
</PackageReference>

but VS still shows updates

but in project.assets.json it shows it correct >= 2.2.0 and smaller 3.0:

"projectFileDependencyGroups": {
    ".NETFramework,Version=v4.8": [
      "Microsoft.Extensions.Caching.Memory >= 2.2.0 < 3.0.0",
      "Microsoft.Extensions.Configuration >= 2.2.0 < 3.0.0",
      "Microsoft.Extensions.DependencyInjection >= 2.2.0 < 3.0.0",
      "Microsoft.Extensions.Logging.Debug >= 2.2.0 < 3.0.0",
      "Microsoft.Extensions.Logging.EventSource >= 2.2.0 < 3.0.0",
    ]

The Android app with packages.config doesn't show it:

<package id="Microsoft.Extensions.Logging.EventSource" version="2.2.0" allowedVersions="[2,3)" targetFramework="monoandroid90" />

I did the .net 3.x migration in a different branch and want to ignore the updates for this .net core 2.x brunch.

[sebandraos]

@MagicAndre1981 The code you have shown there will automatically resolve a version between 2.2.0 and 3.0.0. If you want to lock the version to 2.2.0 your code should be:

<PackageReference Include="Microsoft.Extensions.Logging.EventSource">
      <Version>[2.2.0]</Version>
</PackageReference>

As I mentioned in my original response, this works to lock a single version, otherwise you're asking it to resolve a version within that range which, I agree, is not the same mechanism as allowedVersions which hides updates outside the range. That said, with version ranges and floating versions in place one could argue that there is a lesser need to go looking for updates. I'm not saying it's a drop in solution but short of the NuGet team implementing a complete replacement it's something to work with.

[MagicAndre1981]

I agree, is not the same mechanism as allowedVersions which hides updates outside the range.

But that is the main point, this part is missing and I want to have the same control like with packages.config.

This is why the I would like to have something like this:

<PackageReference Include="Microsoft.Extensions.Logging.EventSource">
      <Version>3.1.4</Version>
      <allowedVersions>"[3.1,5)</allowedVersions>
</PackageReference>

I use 16.4 servicing baseline of VS2019 which only supports up to .net core 3.1 and when .net 5 is released and don't want that updates shown for that branch as the VS is incompatible.

[jemiller0]

I'm going to need the same thing for restricting the version of EF Core that I'm using, since Microsoft is now requiring .NET Standard 2.1 for it. Only 3.1.x will work with .NET Framework. Once .NET 5 comes out, it will be DLL hell.

[kumarz]

is package reference is fully supported for .Net framework especially for v4.6.2 ?

[nkolev92]

Hey all,

Summarizing the status of the listed issues:

• Enable repeatable package restores using a lock file #5602 - Done
• [PackageReference] Centrally manage NuGet package versions for a solution or a repo #6764 - Done
• Support pre-release packages with floating versions. Version="*-*" and similar. #912 - Done
• Allow users to determine package resolution strategy during package restore - direct or transitive #5553 - Not yet worked on.

At this point, given that we only have 1 issue left, we'll continue tracking that work in that issue to avoid duplication.