Updating packages using NuGet Package Manager

Joe Green 146 Reputation points
2022-03-24T12:14:26.737+00:00

In a .net MVC project NuGet Package Manager has identified two updates with vulnerabilities and other 20 other updates to various packages. I have two questions
(1) I have noticed that some of these updates break the application. Is there a way to find which updates won't break the application or the only way to do this is by updating one package at a time.
(2) When a package is updated and the time comes to publish the application on the server, which files (.css, .js, dll, etc.) do I need to post on the server to reflect the update? Do I need to update the runtime assemblyBinding section of the web.config file?
Thanks
Joe

.NET
.NET
Microsoft Technologies based on the .NET software framework.
3,374 questions
ASP.NET
ASP.NET
A set of technologies in the .NET Framework for building web applications and XML web services.
3,254 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Bruce (SqlWork.com) 56,021 Reputation points
    2022-03-24T15:33:47.27+00:00

    1) while must NuGet Package bump the major version number with breaking changes, this is just a convention, and up to the package developer. Often the project website will have release notes you can read.

    2) depends on what the Package includes. it could be code, or static files. You may need to override binding if components (or other packages) are built with different versions then the build version.

    0 comments
  2. Zhi Lv - MSFT 32,011 Reputation points Microsoft Vendor
    2022-03-25T01:54:49.83+00:00

    Hi @Joe Green ,

    (1) I have noticed that some of these updates break the application. Is there a way to find which updates won't break the application or the only way to do this is by updating one package at a time.

    What do you mean the package break the application? Do you mean the package is not compatible?

    NuGet installs a package into a project only if that package's supported frameworks include the project's target framework. If the package is not compatible, NuGet issues an error. So, if you mean the incompatible issue, you can check if there has any error when update the package, or check whether the package is installed success.

    If you mean the package support the target framework, but it will cause some issue in your project, in this scenario, might be you have to update the package one by one. Or you can check the package's release notes.

    (2) When a package is updated and the time comes to publish the application on the server, which files (.css, .js, dll, etc.) do I need to post on the server to reflect the update? Do I need to update the runtime assemblyBinding section of the web.config file?

    You can check the published application's web.config file, whether it contains the package version?

    Not sure which kind of you project is, Asp.net core(.NET Core 1.0 - 3.1, .NET 5 , and later versions of .NET) or .Net framework (.NET Framework 1.0 - 4.8) application, but on my side, after publishing the asp.net core application, it seems that the web.config file doesn't contain the installed package. I can find the installed package reference from the {the project name}.deps.json.

    So to this question, I suggest you re-publish the application.

    If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    Best regards,
    Dillion

    0 comments