dotnet-dependency_skill

Overview

This skill helps inspect and manage .NET project dependencies using the dotnet CLI and common third-party tools. It focuses on finding why packages are included, listing direct and transitive references, and identifying outdated or vulnerable packages. Use it to audit dependency graphs, update packages, and manage dotnet tools efficiently.

How this skill works

The skill runs and interprets standard dotnet CLI commands (dotnet list package, dotnet nuget why, dotnet add/remove package, dotnet package search) and optionally integrates third-party tooling like dotnet-outdated. It inspects project files and package metadata to show direct and transitive dependency chains, version histories, and security/vulnerability flags. JSON output options are included for scripting and automation.

When to use it

• You need to list all NuGet and project references for a project.
• You want to know why a specific package is present (dependency chain).
• You are auditing for outdated or vulnerable packages before a release.
• You want to add, update, or remove package references from a project file.
• You need to find or pin specific package versions or search NuGet from the CLI.

Best practices

• Run dotnet list package --include-transitive to capture indirect dependencies before making changes.
• Use dotnet nuget why <package> to trace the exact reference path and avoid removing required transitive packages.
• Prefer dotnet add package to update versions so project files stay consistent and lockfiles update appropriately.
• Export JSON (--format json) for machine-readable reports and automated audits.
• Use dotnet-outdated only when you understand its update strategy; review changes before committing.

Example use cases

• Audit a project before upgrading target framework: list packages, check outdated and vulnerable flags.
• Investigate a failing build caused by a transitive package: run dotnet nuget why to find the root reference.
• Automate dependency checks in CI: dotnet list package --outdated --format json and fail the job on critical findings.
• Migrate a package to a specific version across a solution: script dotnet add package <id> -v <version> for each project.
• Manage local/global dotnet tools: search, update, or update all tools from the manifest.