Lesson 9 / 26

NuGet Packages

Add, restore and update third-party packages with NuGet.

What NuGet does

NuGet is .NET's package manager. dotnet add package writes a PackageReference into the .csproj, and dotnet restore downloads it. The same restore runs automatically on build and run.

Add a package

Add Serilog to the current project. The version is written into the project file so everyone on the team gets the same one.

dotnet add package Serilog.AspNetCore
dotnet list package

Check what you install

Packages run with your app's permissions. Prefer well-known publishers, check download counts and run dotnet list package --vulnerable to find known security issues.

Quick check: Which command lists packages with known vulnerabilities?

  • dotnet run --safe
  • dotnet new package
  • dotnet clean
  • dotnet list package --vulnerable
Answer

dotnet list package --vulnerable — `dotnet list package --vulnerable` checks your references against published advisories.