I'm a big fan of the Central Package Management feature of NuGet. This allows to manage your NuGet package versions centrally instead of at the project level. Why is this important? It helps to avoid that multiple versions of the same packages are used inside your solution. This could lead to strange behavior and unexpected bugs.
Central Package Management solves this problem by managing all package versions at the solution level in (one or more) Directory.Packages.props files:
Transitive dependencies
By default only direct/top level dependencies are managed through Central Package Management. But you also have transitive dependencies. Transitive dependencies refer to the indirect dependencies that a package brings into your project. When you install a NuGet package, it might depend on other packages, which in turn might have their own dependencies. These chains of dependencies create a dependency graph that can go several levels deep.
Here's a breakdown of how it works:
- Direct/Top level dependencies: These are the packages you explicitly install in your project.
- Transitive dependencies: These are the packages that your direct dependencies rely on.
For example, if you install Package A, which depends on Package B, and Package B depends on Package C, then Package B is a direct dependency of Package A, and Package C is a transitive dependency of Package A.
NuGet handles these dependencies automatically, ensuring that all necessary packages are installed and compatible with each other.
Transitive pinning
As NuGet handles the transitive dependencies automatically, you don’t have direct control over the package version that will be used. This can be a problem for example when a vulnerability is found in one of the transitive dependencies that you are using. One way to solve is to promote that package to a direct/top level dependency but a better solution is to use Transitive pinning.
This allows you to manage the package version using central package management without promoting it to a top level dependency. This feature is not enabled automatically but you can enable by setting the MSBuild property CentralPackageTransitivePinningEnabled to true in a project or in a Directory.Packages.props or Directory.Build.props import file:
More information
NuGet Central Package Management
Convert a project to use centralised package management
.NET Upgrade Assistant now supports upgrading to Centralized Package Management