nuget-manager

NuGet Manager

Overview

This skill ensures consistent and safe management of NuGet packages across .NET projects. It prioritizes using the dotnet CLI to maintain project integrity and enforces a strict verification and restoration workflow for version updates.

Security Considerations

WARNING: Command Injection and XML Injection Risk

This skill constructs shell commands and edits XML project files using package names and versions supplied by the user. To prevent command injection and MSBuild/XML injection, you MUST validate any user-provided value for <PACKAGE_NAME>, <VERSION>, and <PROJECT> before using it in a command or writing it to a file.

• Validation Rule: The value MUST match the regular expression ^[A-Za-z0-9._\-]+$.
• Action: If the value does not match, reject it and do not proceed. Do not interpolate unvalidated input into shell commands or XML attributes.

This validation blocks shell metacharacters and XML-significant characters (such as " and >), mitigating both command injection in shell pipelines and MSBuild injection when editing .csproj or Directory.Packages.props files.

Prerequisites

• .NET SDK installed (typically .NET 8.0 SDK or later, or a version compatible with the target solution).
• dotnet CLI available on your PATH.
• jq (JSON processor) for version verification using dotnet package search.

Core Rules

1. NEVER directly edit .csproj, .props, or Directory.Packages.props files to add or remove packages. Always use dotnet add package and dotnet remove package commands.
2. DIRECT EDITING is ONLY permitted for changing versions of existing packages.
3. VERSION UPDATES must follow the mandatory workflow:
   • Verify the target version exists on NuGet.
   • Determine if versions are managed per-project (.csproj) or centrally (Directory.Packages.props).
   • Update the version string in the appropriate file.
   • Immediately run dotnet restore to verify compatibility.
4. INPUT VALIDATION: Before interpolating any user-supplied value (package name, version string, project path) into a shell command or file edit, validate that the value matches the pattern ^[A-Za-z0-9._\-]+$. Reject and abort if the value contains characters outside this set. This applies to <PACKAGE_NAME>, <VERSION>, and <PROJECT> placeholders in all commands below.

Workflows

Adding a Package

Use dotnet add [<PROJECT>] package <PACKAGE_NAME> [--version <VERSION>]. Example: dotnet add src/MyProject/MyProject.csproj package Newtonsoft.Json

Removing a Package

Use dotnet remove [<PROJECT>] package <PACKAGE_NAME>. Example: dotnet remove src/MyProject/MyProject.csproj package Newtonsoft.Json

Updating Package Versions

When updating a version, follow these steps:

1. Verify Version Existence: Check if the version exists using the dotnet package search command with exact match and JSON formatting.

   ⚠️ Validate <PACKAGE_NAME> and <VERSION> against ^[A-Za-z0-9._\-]+$ before executing the commands below. Do not interpolate unvalidated input.

   Using jq: dotnet package search <PACKAGE_NAME> --exact-match --format json | jq -e '.searchResult[].packages[] | select(.version == "<VERSION>")'

2. Determine Version Management:

   • Search for Directory.Packages.props in the solution root. If present, versions should be managed there via <PackageVersion Include="Package.Name" Version="1.2.3" />.
   • If absent, check individual .csproj files for <PackageReference Include="Package.Name" Version="1.2.3" />.

3. Apply Changes: After validating the new version string against ^[A-Za-z0-9._\-]+$ (per Core Rule 4), modify the identified file with the new version string. Do not construct XML attribute values from unvalidated input; the version string must be a plain Major.Minor.Patch[-prerelease] token with no embedded XML characters.

4. Verify Stability: Run dotnet restore on the project or solution. If errors occur, revert the change and investigate.

Examples

User: "Add Serilog to the WebApi project"

Action: Execute dotnet add src/WebApi/WebApi.csproj package Serilog.

User: "Update Newtonsoft.Json to 13.0.3 in the whole solution"

Action:

1. Verify 13.0.3 exists: dotnet package search Newtonsoft.Json --exact-match --format json | jq -e '.searchResult[].packages[] | select(.version == "13.0.3")' (confirm "13.0.3" is present in output).
2. Find where it's defined (e.g., Directory.Packages.props).
3. Edit the file to update the version string (validated: 13.0.3 matches ^[A-Za-z0-9._\-]+$).
4. Run dotnet restore.