Managing NuGet Packages in Visual Studio 2026 in 10 Minutes or Less

Keeping track of the Nougat packages in Keeping track of the Nougat packages in all of your projects in a solution can all of your projects in a solution can all of your projects in a solution can be much easier if you're using Visual be much easier if you're using Visual be much easier if you're using Visual Studio. Let's look at how in 10 minutes Studio. Let's look at how in 10 minutes Studio. Let's look at how in 10 minutes or less. Now, for most of my training, I or less. Now, for most of my training, I or less. Now, for most of my training, I work to give you an indepth look at work to give you an indepth look at work to give you an indepth look at technology so you understand the when technology so you understand the when technology so you understand the when and the why to use something, not just and the why to use something, not just and the why to use something, not just how to use it. But sometimes you just how to use it. But sometimes you just how to use it. But sometimes you just need a quick answer to the question, how need a quick answer to the question, how need a quick answer to the question, how do I do this? That's why I created this do I do this? That's why I created this do I do this? That's why I created this 10-minute training series. So here in 10-minute training series. So here in 10-minute training series. So here in Visual Studio, I've created three Visual Studio, I've created three Visual Studio, I've created three projects. Now these three projects don't projects. Now these three projects don't projects. Now these three projects don't do anything. We have just a console app do anything. We have just a console app do anything. We have just a console app that's program CS that has hello world. that's program CS that has hello world. that's program CS that has hello world. We have a couple of class ones that are We have a couple of class ones that are We have a couple of class ones that are empty for two different libraries. And empty for two different libraries. And empty for two different libraries. And I've put some random um semi-random I've put some random um semi-random I've put some random um semi-random Nougat packages in all three. I want to Nougat packages in all three. I want to Nougat packages in all three. I want to demonstrate kind of what you would go demonstrate kind of what you would go demonstrate kind of what you would go through and how to make it easier for through and how to make it easier for through and how to make it easier for working with Nougat packages. Now, first working with Nougat packages. Now, first working with Nougat packages. Now, first off, you may have seen this dialogue at off, you may have seen this dialogue at off, you may have seen this dialogue at the top. The this solution contains the top. The this solution contains the top. The this solution contains packages with vulnerabilities. And if packages with vulnerabilities. And if packages with vulnerabilities. And if you scroll down, my font is zoomed in.

you scroll down, my font is zoomed in. you scroll down, my font is zoomed in. That's why I have to scroll. Uh it says That's why I have to scroll. Uh it says That's why I have to scroll. Uh it says manage nougat packages or fix with manage nougat packages or fix with manage nougat packages or fix with GitHub copilot. I would recommend not GitHub copilot. I would recommend not GitHub copilot. I would recommend not fixing with GitHub copilot. fixing with GitHub copilot. fixing with GitHub copilot. You want to make sure you are the one in You want to make sure you are the one in You want to make sure you are the one in control of your your packages and your control of your your packages and your control of your your packages and your dependencies and you will make sure you dependencies and you will make sure you dependencies and you will make sure you have a good insight into how it's being have a good insight into how it's being have a good insight into how it's being changed and affected. Now, if you say changed and affected. Now, if you say changed and affected. Now, if you say manage new get packages, it will take manage new get packages, it will take manage new get packages, it will take you to one of these package projects. you to one of these package projects. you to one of these package projects. And you can notice as well that if we And you can notice as well that if we And you can notice as well that if we zoom in here, we'll see that we have zoom in here, we'll see that we have zoom in here, we'll see that we have these yellow exclamation points these yellow exclamation points these yellow exclamation points on all three of our our projects. And on all three of our our projects. And on all three of our our projects. And what that means is in here is a what that means is in here is a what that means is in here is a vulnerable package and you should be vulnerable package and you should be vulnerable package and you should be aware of this and you should hopefully aware of this and you should hopefully aware of this and you should hopefully address it as soon as possible. What address it as soon as possible. What address it as soon as possible. What they found is that there's some kind of they found is that there's some kind of they found is that there's some kind of vulnerability in one of your vulnerability in one of your vulnerability in one of your dependencies and hopefully there's a new dependencies and hopefully there's a new dependencies and hopefully there's a new version out so you can switch off of version out so you can switch off of version out so you can switch off of that dependency to a later version. And that dependency to a later version. And that dependency to a later version. And let's just right click on one of these let's just right click on one of these let's just right click on one of these and say manage nougat packages. If we go and say manage nougat packages. If we go and say manage nougat packages. If we go to installed, we'll see there's three to installed, we'll see there's three to installed, we'll see there's three packages and there's that exclamation packages and there's that exclamation packages and there's that exclamation point on two of them. So Newtonoft.json point on two of them. So Newtonoft.json point on two of them. So Newtonoft.json currently installed is 12.0.3 currently installed is 12.0.3 currently installed is 12.0.3 and that is vulnerable. The latest is and that is vulnerable. The latest is and that is vulnerable. The latest is 13.0.4.

13.0.4. 13.0.4. Now Now Now unless you are doing a brand new project unless you are doing a brand new project unless you are doing a brand new project or it's a a demo project, you can't just or it's a a demo project, you can't just or it's a a demo project, you can't just change Nougat packages without going change Nougat packages without going change Nougat packages without going through and doing a lot of testing. But through and doing a lot of testing. But through and doing a lot of testing. But we're going to demonstrate some of that we're going to demonstrate some of that we're going to demonstrate some of that in this video. So just hang with me. in this video. So just hang with me. in this video. So just hang with me. Yes, you need to make sure you validate Yes, you need to make sure you validate Yes, you need to make sure you validate everything you do, but I want to point everything you do, but I want to point everything you do, but I want to point out a few features in here that will out a few features in here that will out a few features in here that will make your life easier. make your life easier. make your life easier. First off, just this yellow exclamation First off, just this yellow exclamation First off, just this yellow exclamation point is really helpful. You can see, point is really helpful. You can see, point is really helpful. You can see, hey, there's something I need need to hey, there's something I need need to hey, there's something I need need to address here. The uh updates tab will address here. The uh updates tab will address here. The uh updates tab will show you all the packages that have show you all the packages that have show you all the packages that have updates, whether or not they're updates, whether or not they're updates, whether or not they're vulnerable. Now it does then drop off vulnerable. Now it does then drop off vulnerable. Now it does then drop off the exclamation point which I would the exclamation point which I would the exclamation point which I would prefer it kept the ex exclamation point prefer it kept the ex exclamation point prefer it kept the ex exclamation point there let us know that this is an there let us know that this is an there let us know that this is an important one to update. However the important one to update. However the important one to update. However the other thing you can do is in this other thing you can do is in this other thing you can do is in this installed tab you can check the box that installed tab you can check the box that installed tab you can check the box that says show only vulnerable. The reason says show only vulnerable. The reason says show only vulnerable. The reason why this is so valuable is because when why this is so valuable is because when why this is so valuable is because when you have a project, let's say you have a you have a project, let's say you have a you have a project, let's say you have a uh a web API project or you have a uh a web API project or you have a uh a web API project or you have a Blazer project, you might have a few Blazer project, you might have a few Blazer project, you might have a few Nougat packages installed in a bunch of Nougat packages installed in a bunch of Nougat packages installed in a bunch of transient packages. Those transient transient packages. Those transient transient packages. Those transient packages are packages that support the packages are packages that support the packages are packages that support the installed package.

installed package. installed package. And that may mean dozens to scroll And that may mean dozens to scroll And that may mean dozens to scroll through and one of those transients may through and one of those transients may through and one of those transients may be vulnerable, but trying to find which be vulnerable, but trying to find which be vulnerable, but trying to find which one is difficult. Checking this box one is difficult. Checking this box one is difficult. Checking this box right here will show you just the right here will show you just the right here will show you just the packages that need to be addressed even packages that need to be addressed even packages that need to be addressed even if it's a transient package. Okay, so if it's a transient package. Okay, so if it's a transient package. Okay, so you could manage this, but then you've you could manage this, but then you've you could manage this, but then you've got to go over to the console UI and go got to go over to the console UI and go got to go over to the console UI and go to dependencies and manage nougat to dependencies and manage nougat to dependencies and manage nougat packages. And they're different packages packages. And they're different packages packages. And they're different packages that have been installed in different that have been installed in different that have been installed in different versions even. And then down here you go versions even. And then down here you go versions even. And then down here you go again and you manage the third one. And again and you manage the third one. And again and you manage the third one. And that's a lot of work. And you have this that's a lot of work. And you have this that's a lot of work. And you have this issue where well we have Newtonoft JSON issue where well we have Newtonoft JSON issue where well we have Newtonoft JSON installed here at version 9 and then installed here at version 9 and then installed here at version 9 and then here we have it installed version 11 and here we have it installed version 11 and here we have it installed version 11 and here we have it installed version 12. So here we have it installed version 12. So here we have it installed version 12. So you're trying to figure out okay how do you're trying to figure out okay how do you're trying to figure out okay how do I coordinate all these things? Now there I coordinate all these things? Now there I coordinate all these things? Now there is a separate concept I'm not covering is a separate concept I'm not covering is a separate concept I'm not covering in this video called central package in this video called central package in this video called central package management. So that is something you management. So that is something you management. So that is something you might want to look into to go even might want to look into to go even might want to look into to go even further than this video. But this is further than this video. But this is further than this video. But this is more about how to work in Visual Studio more about how to work in Visual Studio more about how to work in Visual Studio to make life easier. So let's close all to make life easier. So let's close all to make life easier. So let's close all of these and instead of trying to go to of these and instead of trying to go to of these and instead of trying to go to every single project and manage them every single project and manage them every single project and manage them separately and try and coordinate all separately and try and coordinate all separately and try and coordinate all the rest, right click on your solution, the rest, right click on your solution, the rest, right click on your solution, say manage Nougat packages for solution.

say manage Nougat packages for solution. say manage Nougat packages for solution. I'm going to unpin this because of the I'm going to unpin this because of the I'm going to unpin this because of the size here and shrink this down. Now size here and shrink this down. Now size here and shrink this down. Now installed. Notice that we have four installed. Notice that we have four installed. Notice that we have four packages installed for the solution. packages installed for the solution. packages installed for the solution. Why? Because this lists all the packages Why? Because this lists all the packages Why? Because this lists all the packages in all of our projects. So for example, in all of our projects. So for example, in all of our projects. So for example, if we select Newtonoft right here, and if we select Newtonoft right here, and if we select Newtonoft right here, and let's make this bigger, we can see that let's make this bigger, we can see that let's make this bigger, we can see that there's three projects and three there's three projects and three there's three projects and three versions. So the business logic library versions. So the business logic library versions. So the business logic library has version uh number 12.03 has version uh number 12.03 has version uh number 12.03 and that's what's installed. Then the and that's what's installed. Then the and that's what's installed. Then the core UI has 11.0.2 core UI has 11.0.2 core UI has 11.0.2 and the data access library has 9.0.1. and the data access library has 9.0.1. and the data access library has 9.0.1. And this one in particular is And this one in particular is And this one in particular is vulnerable. So what we can do here is we vulnerable. So what we can do here is we vulnerable. So what we can do here is we can manage this from manage all of these can manage this from manage all of these can manage this from manage all of these if we want from here. So I selected all if we want from here. So I selected all if we want from here. So I selected all of them and I can say let's go ahead and of them and I can say let's go ahead and of them and I can say let's go ahead and install 13.0.4 install 13.0.4 install 13.0.4 which is the latest for all of them. If which is the latest for all of them. If which is the latest for all of them. If I hit install now, if I go back to I hit install now, if I go back to I hit install now, if I go back to Newtonoft, now all of them are on the Newtonoft, now all of them are on the Newtonoft, now all of them are on the same version and it's a no longer same version and it's a no longer same version and it's a no longer vulnerable version. So I've done that vulnerable version. So I've done that vulnerable version. So I've done that all from one spot. Now I don't have to all from one spot. Now I don't have to all from one spot. Now I don't have to install for all of them. And again, you install for all of them. And again, you install for all of them. And again, you should know what you can and cannot should know what you can and cannot should know what you can and cannot install for your project. But open install for your project. But open install for your project. But open telemetry is only installed for one telemetry is only installed for one telemetry is only installed for one project and it's vulnerable. So, I could project and it's vulnerable. So, I could project and it's vulnerable. So, I could say, you know what, let's select just say, you know what, let's select just say, you know what, let's select just open just the library that has it and

open just the library that has it and open just the library that has it and let's change the version to um 1.17. And let's change the version to um 1.17. And let's change the version to um 1.17. And I hit install and I have to accept the I hit install and I have to accept the I hit install and I have to accept the terms and now it's 1.17. terms and now it's 1.17. terms and now it's 1.17. So, this allows me to go through all of So, this allows me to go through all of So, this allows me to go through all of my packages, see which ones need my packages, see which ones need my packages, see which ones need updates. Even I can say, okay, uh Dapper updates. Even I can say, okay, uh Dapper updates. Even I can say, okay, uh Dapper needs updates, but only on this version. needs updates, but only on this version. needs updates, but only on this version. Um, also notice that it says here top Um, also notice that it says here top Um, also notice that it says here top level. It also say transient. So top level. It also say transient. So top level. It also say transient. So top level means you've installed it for this level means you've installed it for this level means you've installed it for this project. And then transient means it's project. And then transient means it's project. And then transient means it's been installed a different package has been installed a different package has been installed a different package has been installed for this project but that been installed for this project but that been installed for this project but that package depends on this package. So that package depends on this package. So that package depends on this package. So that would be a transient uh update. And if would be a transient uh update. And if would be a transient uh update. And if it doesn't have a version number here it doesn't have a version number here it doesn't have a version number here that means that it depends on something that means that it depends on something that means that it depends on something else that has that version installed. So else that has that version installed. So else that has that version installed. So with this you can manage and say hey you with this you can manage and say hey you with this you can manage and say hey you know what we've got Sarah log there's no know what we've got Sarah log there's no know what we've got Sarah log there's no vulnerabilities here but at least not vulnerabilities here but at least not vulnerabilities here but at least not listed but we got 4.4.0 4.4.0 and 4.1.0.

listed but we got 4.4.0 4.4.0 and 4.1.0. listed but we got 4.4.0 4.4.0 and 4.1.0. So I could say you know what let's go So I could say you know what let's go So I could say you know what let's go ahead and update that middle one to the ahead and update that middle one to the ahead and update that middle one to the latest uh version. latest uh version. latest uh version. There we go. There we go. There we go. And now we no longer have a it's no And now we no longer have a it's no And now we no longer have a it's no longer in the updates list. I come back longer in the updates list. I come back longer in the updates list. I come back over here. Now they're all in the same over here. Now they're all in the same over here. Now they're all in the same version. So you can manage it this way. version. So you can manage it this way. version. So you can manage it this way. Also note, let's just say you want to Also note, let's just say you want to Also note, let's just say you want to find a package. Um, let's just pick one find a package. Um, let's just pick one find a package. Um, let's just pick one at random. Maybe poly. Cool. So you say, at random. Maybe poly. Cool. So you say, at random. Maybe poly. Cool. So you say, you know what? I think I want to install you know what? I think I want to install you know what? I think I want to install poly. I want to install it in one place poly. I want to install it in one place poly. I want to install it in one place or maybe two places. Maybe the or maybe two places. Maybe the or maybe two places. Maybe the libraries. Not a problem. You choose a libraries. Not a problem. You choose a libraries. Not a problem. You choose a place you want to install it and you say place you want to install it and you say place you want to install it and you say install. install. install. Now poly is installed but only in those Now poly is installed but only in those Now poly is installed but only in those two projects. So now version 8.7.0 know two projects. So now version 8.7.0 know two projects. So now version 8.7.0 know is installed at the top level in both of is installed at the top level in both of is installed at the top level in both of our libraries. So this shows us by the our libraries. So this shows us by the our libraries. So this shows us by the way there's the there's the core it's a way there's the there's the core it's a way there's the there's the core it's a transitive notice it doesn't have a transitive notice it doesn't have a transitive notice it doesn't have a version number here. So this is this version number here. So this is this version number here. So this is this poly.core poly.core poly.core is a dependency of poly. So you install is a dependency of poly. So you install is a dependency of poly. So you install poly get that transitive package. Now poly get that transitive package. Now poly get that transitive package. Now you can see it says transitive and the you can see it says transitive and the you can see it says transitive and the version number installed and you can see version number installed and you can see version number installed and you can see that the version itself is blank. That that the version itself is blank. That that the version itself is blank. That means it's not actually directly means it's not actually directly means it's not actually directly installed. It dep it's a dependency of installed. It dep it's a dependency of installed. It dep it's a dependency of something else that's installed.

something else that's installed. something else that's installed. Now if I wanted to I could say you know Now if I wanted to I could say you know Now if I wanted to I could say you know what I want to install poly.core itself what I want to install poly.core itself what I want to install poly.core itself into this data access library for some into this data access library for some into this data access library for some reason. So now if we come back over here reason. So now if we come back over here reason. So now if we come back over here we can see that in the data access we can see that in the data access we can see that in the data access library it's top level whereas it's library it's top level whereas it's library it's top level whereas it's transitive in the business logic transitive in the business logic transitive in the business logic library. So lots of cool stuff you can library. So lots of cool stuff you can library. So lots of cool stuff you can do in this central management place. do in this central management place. do in this central management place. This is the place to manage all your This is the place to manage all your This is the place to manage all your Nougat packages very easily for your Nougat packages very easily for your Nougat packages very easily for your entire solution. And yet the one thing entire solution. And yet the one thing entire solution. And yet the one thing it does that is different than central it does that is different than central it does that is different than central package management. Central package package management. Central package package management. Central package management we'll cover in a different management we'll cover in a different management we'll cover in a different video at some point. But when you go to video at some point. But when you go to video at some point. But when you go to your project, you won't see version your project, you won't see version your project, you won't see version numbers because there'll be a a central numbers because there'll be a a central numbers because there'll be a a central file um that will have all of your file um that will have all of your file um that will have all of your version numbers. [snorts] So that when version numbers. [snorts] So that when version numbers. [snorts] So that when you say, "Hey, I want poly," it's going you say, "Hey, I want poly," it's going you say, "Hey, I want poly," it's going to go to your central version and say, to go to your central version and say, to go to your central version and say, "Okay, we're going to get version 8.7." "Okay, we're going to get version 8.7." "Okay, we're going to get version 8.7." So it kind of centralizes all of that. So it kind of centralizes all of that. So it kind of centralizes all of that. Thus, central package management. But Thus, central package management. But Thus, central package management. But here, these are all just like regular here, these are all just like regular here, these are all just like regular just like normal. It's just we managed just like normal. It's just we managed just like normal. It's just we managed it at the solution level. This allows it at the solution level. This allows it at the solution level. This allows you to take your libraries and use them you to take your libraries and use them you to take your libraries and use them in multiple different pro or solutions in multiple different pro or solutions in multiple different pro or solutions and you're not losing anything. So and you're not losing anything. So and you're not losing anything. So that's how you can use the solution that's how you can use the solution that's how you can use the solution level manage nougat packages for level manage nougat packages for level manage nougat packages for solution to manage all the packages solution to manage all the packages solution to manage all the packages installed for your entire solution and installed for your entire solution and installed for your entire solution and make sure you keep an eye on where make sure you keep an eye on where make sure you keep an eye on where you're getting versions out of sync. All you're getting versions out of sync. All you're getting versions out of sync. All right, thanks for watching and as always right, thanks for watching and as always right, thanks for watching and as always I am Tim Corey.