How to update dependencies not referenced directly as PackageReference via NuGet?

Question

This question is similar to one described here.

When using "legacy"-style .csproj project files we have a separate packages.config file where all dependencies are listed, including transitive ones. This enables a use case when one installs a package with dependencies and then decides which transitive dependencies can be manually updated. So, the benefits are:

• Dependencies are easily identifiable due to presence of a flat list
• Fine-grain control over all dependency versions

E.g., after installing Autofac.WebApi2.Owin from NuGet, we have a picture like this:

Transitive dependencies which are clearly viewable can be manually updated very easily.

When using the new Sdk-style .csproj projects NuGet references are added as <PackageReference/> to the project file itself and transitive dependencies are referenced by MSBuild silently:

<Project Sdk="Microsoft.NET.Sdk">
  <PropertyGroup>
    <OutputType>Exe</OutputType>
    <TargetFramework>net462</TargetFramework>
  </PropertyGroup>
  <ItemGroup>
    <PackageReference Include="Autofac.WebApi2.Owin" Version="4.0.0" />
  </ItemGroup>
</Project>

So, to update transitive dependencies, one would have to

1. Identify them (e.g. via obj/project.assets.json)
2. Add all of them explicitly to the project
3. Perform updates

And this has to be done after each update and for every (!) transitive dependency in the project which is clearly almost impossible.

Possible resolutions:

• Adding transitive dependencies to the project automatically
• Show transitive dependency updates in NuGet GUI

Unfortunately, no such feature was found in the documentation.

So, is there an easy way to get the best from two worlds?

Answer 1

VS Nuget Package Manager now shows transitive dependencies, see this post.

I can use this feature in VS v17.7.5

Answer 2

The ability to control transitive package reference updates is now being tracked in https://github.com/NuGet/Home/issues/5553

Answer 3

Not possible at the moment but a discussion is open on Github.

Answer 4

So, is there an easy way to get the best from two worlds?

I think NuGet already have an easy way to get the best from two worlds.

When using the new Sdk-style .csproj projects, you will notice that there is a tree structure of transitive dependencies in the Reference:

With this structure, we can not only get presence of a flat list can also clearly know the specific dependencies between packages. In the "legacy"-style .csproj, we could to know the flat list, but we could not know the specific dependencies between each package. We need select each package, then check it`s Dependencies. This is very inconvenient.

Besides, we generally do not go over the package itself and update its dependencies directly, this will bring a lot of conflict between dependencies. When you using the new Sdk-style, NuGet hides all dependencies of each package, so that the NuGet Package Manager UI and project file .csproj looks very simple.

If you still want to update one of dependence individually, you can install it, nuget will prompt you, you are update package from version 1 to version 2:like, Autofac:

In this case, you can update dependencies not referenced directly as PackageReference via NuGet.

For more detail info, you can refer to below blog:

https://blog.nuget.org/20170316/NuGet-now-fully-integrated-into-MSBuild.html