The dotnet package list command provides a convenient option to list all NuGet package references for a specific project or a solution. Including identifying known vulnerabilities (--vulnerable) in package dependencies.
# To list all NuGet packages installed in the current project or solution:
dotnet package list
# To list only the packages that have newer versions available on NuGet:
dotnet package list --outdated
# To list packages including their transitive (indirect) dependencies:
dotnet package list --include-transitive
# To list packages that have newer versions, including prerelease (beta) versions:
dotnet package list --outdated --include-prerelease
# To list packages with vulnerabilities, checking against the GitHub Advisory Database:
dotnet package list --vulnerable
# To list packages with vulnerabilities including all of their sub-dependencies:
dotnet package list --vulnerable --include-transitive
# To list packages and check for updates against a specific custom NuGet source URL:
dotnet package list --outdated --source "https://api.nuget.org/v3/index.json"
# To list outdated packages for a specific project file instead of the whole solution:
dotnet package list --project MyProject.csproj --outdated
# To list packages and output the results in a machine-readable JSON format:
dotnet package list --format json
# To list outdated packages and allow minor/patch upgrades while ignoring major versions:
dotnet package list --outdated --highest-minor