NuGet/Home

[Feature]: Make dotnet list package work without restore when using lock files

Open

#11,770 opened on Apr 22, 2022

View on GitHub
 (9 comments) (1 reaction) (0 assignees)HTML (1,459 stars) (292 forks)batch import
Area:RestoreRepeatableBuildFunctionality:ListPackagePriority:3Product:dotnet.exeType:Featurehelp wanted

Description

NuGet Product(s) Involved

dotnet.exe

The Elevator Pitch

(Was asked to post this here instead of https://github.com/dotnet/sdk/issues/24194)

We are running dotnet list package (with --vulnerable, --outdated, and --deprecated) in a CI pipeline. This seems to require restoring the projects first. This adds overhead in the pipeline, which seems unnecessary since we use lock files (packages.lock.json) which AFAIK contains all necessary information. I propose allowing dotnet list package to work with the information in lock files, without needing a restore.

Additional Context and Details

No response

Contributor guide

Tech stack
csharp
Domain
cli
Issue type
feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
4
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
over 1 week
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
C# developmentNuGet client internalsUnderstanding of lock files
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
35
Research direction
Investigate the dotnet list package command implementation in the dotnet/sdk repository. Understand how the command currently triggers a restore and where to intercept to use lock file data. Look at the NuGet lock file format (packages.lock.json) to determine if it contains all needed information. Review the linked issue dotnet/sdk#24194 for context. Consider creating a prototype that bypasses restore when lock files are present.