support for bulk-updating references into csproj from commandline(s) - dotnet update package

[rrelyea]

splitting off from #3751 - which now just covers the add side of this work

Spec draft: https://github.com/NuGet/Home/wiki/Support-dotnet-ref-add%7Cupdate%7Cdelete-packageref

nuget.exe update for package reference

[rrelyea]

since add will support "update", we'll prioritize this task as the lowest of the 4:

1. add 2) remove 3) list 4) update

[dasMulli]

Would it make sense to allow updating all package references? For a lot of dependencies, it is very quick to do sth like dotnet update pkg --all to begin with when updating a project.

[kjbetz]

I would highly suggest checking out how yarn has taken care of this with yarn upgrade and yarn upgrade-interactive

https://yarnpkg.com/lang/en/docs/cli/upgrade/

https://yarnpkg.com/lang/en/docs/cli/upgrade-interactive/

I would just use the same names as well... dotnet upgrade dotnet upgrade-interactive or possibly dotnet package upgrade dotnet package upgrade-interactive

[rrelyea]

Notice that #6193 added the additional requests to support cross-project updates, etc...

[mudrz]

Since this issue is 2 years old - are there any plans to create any basic cli commands for managing package versions?
Currently it is very inconvenient to manage packages outside of Visual Studio on Windows.

[letmaik]

As part of continuous integration I'd like to auto-update dependencies to check that nothing breaks with newer versions. However, this seems impossible without this feature if you manage your dependencies in .csproj files. Any ETA for this? It seems like a basic feature to have.

[mishra14]

@letmaik you can always run dotnet add package <package_name>. This command will find the latest version of the package and update it in your csproj.

[RivenSkaye]

I'm not sure if this is the right place for this, but on a system with grep, you can implement this with:

dotnet list package --outdated | grep -o '> \S*' | grep '[^> ]*' -o | xargs -L 1 dotnet add package

This uses dotnet list package --outdated to get a list of packages to update, some grep commands that I should be embarassed about writing to extract the package names, and then dotnet add package to do the actual update.

@brendanlong @AlirezaHaghshenas you can even chop out a grep call if you have GNU Grep (or another grep that provides PCRE expressions) using dotnet list packages --outdated | grep -oP "\>\s+\K\S+" | xargs -L 1 dotnet add package
grep -o: only keep matching components
grep -P: PCRE to allow for special options
\>\s+: match the starting segment
\K: keep matches after this point, which prevents the second grep from being required to chop off the > prefix
\S+: all uninterrupted non-whitespace characters, prevents empty lines and should be a tad more robust against formatting differences

Might just toss a utility script somewhere on my path to combine this with @divinebovine's outer loop logic

[MMeshkiny]

dotnet list package --outdated | grep -o '> \S.' | grep '[^> ].' -o | awk '{system("dotnet add package "$1 " -v " $4)}'

[marshallr12]

So about 8 years later, there's still no dotnet update command?

[NCLnclNCL]

hahâ

[reinux]

dotnet list package --outdated | grep -o '> \S.' | grep '[^> ].' -o | awk '{system("dotnet add package "$1 " -v " $4)}'

@MMeshkiny Just for the benefit of anyone else looking for solutions, could you specify which environment/shell this is for? @RivenSkaye 's command worked in fish shell, but this one didn't.

[RivenSkaye]

Both should work in any env providing the GNU utilities (there is also a GNU awk), though both just use pretty standard POSIX-y tooling. Try and see if your package manager provides an awk package

[spaasis]

While we wait for official support there's a pretty functional dotnet tool https://github.com/dotnet-outdated/dotnet-outdated

[smoothdeveloper]

I'm a bit partial to the famed dotnet paket install, but I would really do with a bulk update of packages that works on a .sln in projects that haven't adopted paket.

Edit: it should work on all *proj files, not only .csproj, unless https://twitter.com/DotNetIsCSharp has taken over.

[AndriyKalashnykov]

I'm not sure if this is the right place for this, but on a system with grep, you can implement this with:

dotnet list package --outdated | grep -o '> \S*' | grep '[^> ]*' -o | xargs -L 1 dotnet add package

This uses dotnet list package --outdated to get a list of packages to update, some grep commands that I should be embarassed about writing to extract the package names, and then dotnet add package to do the actual update.

@brendanlong @AlirezaHaghshenas you can even chop out a grep call if you have GNU Grep (or another grep that provides PCRE expressions) using dotnet list packages --outdated | grep -oP "\>\s+\K\S+" | xargs -L 1 dotnet add package grep -o: only keep matching components grep -P: PCRE to allow for special options \>\s+: match the starting segment \K: keep matches after this point, which prevents the second grep from being required to chop off the > prefix \S+: all uninterrupted non-whitespace characters, prevents empty lines and should be a tad more robust against formatting differences

Might just toss a utility script somewhere on my path to combine this with @divinebovine's outer loop logic

--no-run-if-empty - to avoid error for projects with no outdated packages

dotnet list package --outdated | grep -o '> \S*' | grep '[^> ]*' -o | xargs --no-run-if-empty -L 1 dotnet add package

[aradalvand]

Utterly embarrassing that we still have to beg for a simple update command in 2024.

[eng-marani]

Whenever i download a complex solution to a clean machine, my build script based on "msbuild" always fails because one or more nuget package are not updated automatically. So here i am.
I understood that this is NOT currently possible using msbuild, isn't it ?
My actual workaround is to open one by one each solution and update packages using visual studio !!!

Any viable commandline solution to do this automatically ?

[RivenSkaye]

If you don't have the typical utils from Git Bash/MinGW at your disposal in that env, you could try and find an incantation with findstr or a powershell alternative and then use a method like the one employed in this SO post (option 2) to call the update command with each individual package name. Pure CMD would be some loop incantation instead

[augustoproiete]

my build script based on "msbuild" always fails because one or more nuget package are not updated automatically

@eng-marani Why do you need to update NuGet packages for your build to succeed after downloading it? This goes completely against the principle of Reproducible builds. Downloading a solution from source control and building it with using the versions of the NuGet packages that were intended to be used by the developers of the project should just work... Seems like you might have other issues

The ask/tool being proposed here is to be explicit about updating packages, where you'd run a command line to update the packages to the new version, then commit these changes to source control, have your CI build pass, etc.

[OskarKlintrot]

Downloading a solution from source control and building it with using the versions of the NuGet packages that were intended to be used by the developers of the project should just work...

That was until nuget 6.12 :)

[OskarKlintrot]

@eng-marani I'm not sure I understand your use case but I made https://github.com/OskarKlintrot/UpdatR to update our solutions at work, maybe that can help you out?

[augustoproiete]

@OskarKlintrot Is there a big breaking change in NuGet 6.12? The Release Notes doesn't seem to call out anything major 🤔

[OskarKlintrot]

@augustoproiete We have Warnings As Errors turned on and 6.12 started to warn about vuln in transitive dependencies instead of only direct dependencies.

[SimonCropp]

the only change i am aware of was included in net9

https://learn.microsoft.com/en-us/dotnet/core/whats-new/dotnet-9/overview#net-sdk

NuGet security audits run on both direct and transitive package references, by default

[OskarKlintrot]

@SimonCropp We are just splitting hair now but nuget 6.12 is bundled with .NET 9.0.1 (or something like that) and both came with VS 2022 17.12. We (my org) got new computers so naturally we installed VS and cloned our repos and then nothing would build (iirc a transitive dep to EF Core 8). Check point 2 here: https://learn.microsoft.com/en-us/nuget/release-notes/nuget-6.12#summary-whats-new-in-612

Edit: Sorry for going completely ot, I'll stop now.

Edit2: I hope I don't come across as too but hurt, I do think the feature is brilliant!

[eng-marani]

"Reproducible Builds" sounds wonderful, if it would eventually work.
My experience is that without compiling at least once interactively, nuget packages are not properly installed on the first compilation run on a clean machine, or at least i don0t know any way to achieve this, despite the "reproducible build" proclama.

[SimonCropp]

@eng-marani so you need to interactively build the first time on your CI machines?

[eng-marani]

Yes, without doing this i get a lot of errors. Once nuget are updated inside visual studio at least one time, i can build again from a batch file using msbuild just fine. I wonder if something exists that make me able of avoiding this stage. This is particularly frustrating because, when i switch checkout branch, it may happens that nuget packages should have a different version, thus i need to manually build any time i checkout a different branch of the same product. Very annoying.