dotnet package and nuget Commands

This section documents MSBuild 18.9, the .NET SDK 10.0.402 (with its dotnet CLI) and NuGet 7.9, as published in the MSBuild, .NET and NuGet documentation on learn.microsoft.com, which is the reference these pages are written and verified against. Material about .NET 11 / NuGet 8.0 is still in preview and is always flagged as such — never presented as baseline.

This content was generated with the assistance of AI and should be verified against the official documentation before being relied on in production.

The C# Reference bibliography lists the reference material consulted while preparing these pages.

The dotnet CLI exposes NuGet through two command families: dotnet package for a project’s package references and dotnet nuget for everything else — sources, caches, signatures, publishing. This page is the reference for both with .NET SDK 10.0.402 (NuGet 7.9.0); each command links to the page where it is used in context. push, delete and sign are covered in the publishing group (Publishing to nuget.org, Signing Packages).

dotnet package add

Option Effect

-v, --version <v>

The version (default: the latest stable). Note -v means version here, not verbosity.

--prerelease

Allow prerelease versions when no version is given.

-f, --framework <tfm>

Add the reference only for one target framework (a conditioned ItemGroup).

-n, --no-restore

Add without the restore preview and compatibility check.

-s, --source <source>

Source for the restore preview.

--package-directory <dir>

Global-packages folder for the restore preview.

--interactive

Allow credential prompts.

--project <path>, --file <app.cs>

The project, or a file-based app (writes a #:package directive).

Before writing the reference, add restores the project with the new package to check that it is compatible and resolvable; --no-restore skips that and writes blindly. In a Central Package Management repository it writes the version to Directory.Packages.props.

Source: dotnet package add.

dotnet package list

dotnet package list --outdated
dotnet package list --outdated --highest-minor
dotnet package list --deprecated --include-transitive
   [net10.0]:
   Top-level Package      Requested   Resolved   Latest
   > NuGet.Protocol       5.11.2      5.11.2     7.9.0

   [net10.0]:
   Top-level Package      Requested   Resolved   Latest
   > NuGet.Protocol       5.11.2      5.11.2     5.11.7

   [net10.0]:
   Transitive Package                       Resolved   Reason(s)      Alternative
   > System.Security.Cryptography.Pkcs      5.0.0      Other,Legacy

--highest-minor and --highest-patch cap "latest" at the current major or minor version — 5.11.7 is the newest 5.x. --outdated, --deprecated and --vulnerable (Auditing Packages for Vulnerabilities) exclude each other; --include-transitive adds transitive packages; --include-prerelease considers prereleases for "latest"; -f restricts to a framework (or framework/RID); -s/--configfile choose the sources queried. These queries go to every configured source — package source mapping does not filter them (Package Sources and Source Mapping).

For scripts, --format json:

dotnet package list --format json --output-version 1
{
  "version": 1,
  "parameters": "",
  "projects": [
    {
      "path": "~/audit/Audit.csproj",
      "frameworks": [
        {
          "framework": "net10.0",
          "topLevelPackages": [
            {
              "id": "NuGet.Protocol",
              "requestedVersion": "5.11.2",
              "resolvedVersion": "5.11.2"
            }
          ]
        }
      ]
    }
  ]
}

list restores first unless --no-restore is given.

Source: dotnet package list.

dotnet package remove, search, update and download

  • remove <id> — removes the PackageReference (--project, --file, --interactive).

  • search <term> (SDK 8.0.2xx) — searches sources: --source (repeatable), --take/--skip, --exact-match (all versions of one ID; ignores take and skip), --prerelease, --format table|json, --configfile, --verbosity normal|minimal|detailed.

  • update [<ids>] (.NET 10) — updates to the latest version, or with --vulnerable to the lowest version without known vulnerabilities. It restores to validate the result, so warnings-as-errors can block it (Solutions, References and Packages).

  • download <id>[@version] (SDK 10.0.2xx) — downloads into a folder without a project: -o, -s, --configfile, --prerelease, --allow-insecure-connections.

The NuGet 7.3 release notes call the last one dotnet nuget download ("Add dotnet nuget download command"); the shipped command is dotnet package download, and the dotnet-nuget-download documentation URL returns 404.

Source: dotnet package remove, dotnet package search, dotnet package update: Warnings as errors, dotnet package download, NuGet 7.3 release notes.

dotnet nuget commands

Command Purpose and page

nuget why <project> <id> (-f)

Paths that bring a package into the graph; also accepts a project.assets.json for projects the SDK cannot restore (.NET 9+). Printed nothing when redirected with 7.9.0 (Dependency Resolution).

nuget locals <all|http-cache|global-packages|temp|plugins-cache> (-l, -c)

List or clear the local folders (Global Packages and Cache Folders).

nuget add/remove/list/enable/disable/update source

Manage sources (Package Sources and Source Mapping).

nuget config get/set/unset/paths

Read and write nuget.config (nuget.config).

nuget verify (--all, --certificate-fingerprint)

Check package signatures (Signed Packages and Trust Policies).

nuget trust list/author/repository/source/certificate/sync/remove

Manage trusted signers (same page).

nuget push, nuget delete, nuget sign

Publishing; push reads NUGET_API_KEY when -k is not given.

Several dotnet nuget commands list a --force-english-output option in their help; passed to dotnet nuget why, it was rejected ("Unrecognized command or argument '--force-english-output'").

The dotnet nuget config pages say "applies to .NET 8.0.2xx SDK and later", while the NuGet 6.10 release notes — NuGet 6.10 shipped with SDK 8.0.3xx — list the command as new ("add dotnet nuget config command"). Treat 8.0.3xx as the safe minimum.

Source: dotnet nuget why: Older project format, dotnet nuget locals, dotnet nuget config paths, NuGet 6.10 release notes.

Verb-first equivalents

For SDK 9 and earlier scripts (they still work on SDK 10):

SDK 10 Older form

dotnet package add X --project P

dotnet add P package X

dotnet package remove X --project P

dotnet remove P package X

dotnet package list --project P

dotnet list P package

dotnet package search X

dotnet package search X (8.0.2xx; there was no verb-first form)

dotnet package update

(none)

SDK 9.0.319 already accepted the noun-first add, list, remove and search (Solutions, References and Packages).

Common mistakes

  • dotnet package add X -v detailed — -v is --version here.

  • --add-source-style options in scripts for repositories with source mapping — map the source.

  • Parsing the table output of list — use --format json --output-version 1.

  • Expecting --outdated to respect source mapping — it queries every source.

References