NuGet

Categories: dotnet

Renovate supports updating NuGet dependencies.

File Matching

By default, Renovate will check any files matching any of the following regular expressions:

/\.(?:cs|fs|vb)proj$/
/\.(?:props|targets)$/
/(^|/)dotnet-tools\.json$/
/(^|/)global\.json$/

For details on how to extend a manager's managerFilePatterns value, please follow this link.

Supported datasources

This manager supports extracting the following datasources: docker, dotnet-version, nuget.

Dependency types

This manager extracts the following depType values:

depType	Description
docker	Container base image from ContainerBaseImage
nuget	NuGet package reference from PackageReference, PackageVersion, or similar elements
msbuild-sdk	MSBuild SDK reference from Sdk elements, Import elements, or Project Sdk attribute
dotnet-sdk	.NET SDK version from global.json

Default config

{
  "managerFilePatterns": [
    "/\\.(?:cs|fs|vb)proj$/",
    "/\\.(?:props|targets)$/",
    "/(^|/)dotnet-tools\\.json$/",
    "/(^|/)global\\.json$/"
  ],
  "rangeStrategy": "bump"
}

Lock File Maintenance

This manager supports lockFileMaintenance for the following file(s):

• packages.lock.json

Additional Information

Use packageRules to control the behavior of the NuGet package manager.

The NuGet package manager supports these SDK-style files and formats:

• .csproj
• .fsproj
• .vbproj
• .props
• .targets
• global.json
• dotnet-tools.json

.NET Core projects are supported by default.

For Renovate to work with .NET Framework projects, you need to update these files so they match the new SDK-style format:

• .csproj
• .fsproj
• .vbproj
• .props
• .targets

You can also extract from the single code file projects (since .NET 10). But, you need to add those files manually to the managerFilePatterns as they are not supported by default.

Disabling updates for pinned versions

In NuGet, when you use versions like Version="1.2.3" then it means "1.2.3 or greater" (an open-ended minimum, with no upper bound). When you use versions like Version="[1.2.3]" then it means "exactly 1.2.3".

If you would like Renovate to disable updating of exact versions (warning: you might end up years out of date and not realize it) then here is an example configuration to achieve that:

{
  "packageRules": [
    {
      "description": "Skip pinned versions",
      "matchManagers": ["nuget"],
      "matchCurrentValue": "/^\\[[^,]+\\]$/",
      "enabled": false
    }
  ]
}

Getting updates for non-pinned (bare) versions

Per NuGet's versioning rules, a bare version such as Version="1.2.3" is an open-ended minimum (1.2.3 or greater) — so it is NuGet, not Renovate, that treats this as a range rather than a single version. The default rangeStrategy of auto resolves to replace for NuGet, and replace cannot produce an update for an open-ended minimum: every newer release already satisfies "1.2.3 or greater", so there is nothing to replace. The result is that Renovate detects no updates for these dependencies and closes any existing update PRs.

To keep receiving updates for bare versions, set rangeStrategy to bump. With bump, Renovate raises the minimum to the newest release (for example 1.2.3 to 1.5.0):

{
  "packageRules": [
    {
      "description": "Bump bare NuGet versions to the latest release",
      "matchManagers": ["nuget"],
      "rangeStrategy": "bump"
    }
  ]
}

Note

This is a change in behavior. Earlier versions of Renovate anchored the "current version" directly to the value in your project file, so bare versions received updates under any rangeStrategy. Since Renovate 43.208.2, Renovate no longer treats a range (including a bare NuGet version) as the current version, so the rangeStrategy now decides the outcome: use bump to restore the previous update behavior.

Workload restore

Sometimes you need to run dotnet workload restore to ensure that all required workloads are installed before restoring the project. You can enable this behavior by adding dotnetWorkloadRestore to the postUpdateOptions in your Renovate configuration.

{
  "postUpdateOptions": ["dotnetWorkloadRestore"]
}