dotnet-package-list(1)

💖 dotnet-package-list(1) 💖

okay bestie, this is a page from the .NET Documentation manual set, and it's literally all about dotnet-package-list. yeah. that's the girl. let's get into it 🫶

This article applies to: ✔️ .NET 6 SDK and later versions

---

✨ NAME ✨

dotnet-package-list — lists the package references for a project or solution.

okay so real talk: if you're on .NET 9 SDK or earlier, use the "verb first" form (dotnet-list-package) instead. the "noun first" form only showed up in .NET 10. more deets in More consistent command order. iykyk 💅

---

🌸 SYNOPSIS 🌸

dotnet package list [--config <SOURCE>]
    [--deprecated] [--project [<PROJECT>|<SOLUTION>]]
    [-f|--framework <FRAMEWORK>] [--highest-minor] [--highest-patch]
    [--include-prerelease] [--include-transitive] [--interactive]
    [--no-restore] [--outdated] [--source <SOURCE>] [-v|--verbosity <LEVEL>]
    [--vulnerable]
    [--format <console|json>]
    [--output-version <VERSION>]

dotnet package list -h|--help

---

🦋 DESCRIPTION 🦋

so the dotnet package list command is the ✨convenient option✨ for listing every single NuGet package reference for a specific project or a solution. no cap.

starting with .NET 10, the command is a whole main character and automatically performs restore if it needs to before generating results. in earlier versions tho? you gotta build/restore the project yourself first so the assets are there for this command to process. not me having to do extra steps 😭

here's what the output of dotnet package list looks like for the SentimentAnalysis (https://github.com/dotnet/samples/tree/main/machine-learning/tutorials/SentimentAnalysis) project:

Restore complete (5.9s)

Build succeeded in 6.0s
Project 'SentimentAnalysis' has the following package references
   [netcoreapp2.1]:
   Top-level Package               Requested   Resolved
   > Microsoft.ML                  1.4.0       1.4.0
   > Microsoft.NETCore.App   (A)   [2.1.0, )   2.1.0

(A) : Auto-referenced package.

the Requested column is the package version you wrote in the project file, and it can totally be a range. the Resolved column lists the version the project is currently using and it's always a single value, periodt. and the packages showing an (A) right next to their names? those are implicit package references inferred from your project settings (the Sdk type, or the <TargetFramework> or <TargetFrameworks> property). iconic behaviour tbh.

if you wanna skip the automatic restore, just use the --no-restore option. example dotnet package list --no-restore:

Project 'SentimentAnalysis' has the following package references
   [netcoreapp2.1]:
   Top-level Package               Requested   Resolved
   > Microsoft.ML                  1.4.0       1.4.0
   > Microsoft.NETCore.App   (A)   [2.1.0, )   2.1.0

(A) : Auto-referenced package.

use the --outdated option to find out if there are newer versions of the packages you're using in your projects. by default, --outdated lists the latest stable packages — unless the resolved version is also a prerelease version. to include prerelease versions when listing newer versions, also specify the --include-prerelease option. and to actually update a package to the latest version? use dotnet package add. 💅

here's the output of dotnet package list --outdated --include-prerelease for the same project as the previous example:

Restore complete (0.6s)

Build succeeded in 0.7s

The following sources were used:
   https://api.nuget.org/v3/index.json
   C:\Program Files (x86)\Microsoft SDKs\NuGetPackages\

Project `SentimentAnalysis` has the following updates to its packages
   [netcoreapp2.1]:
   Top-level Package      Requested   Resolved   Latest
   > Microsoft.ML         1.4.0       1.4.0      1.5.0-preview

if you need to find out whether your project has transitive dependencies, use the --include-transitive option. transitive dependencies happen when you add a package to your project that in turn relies on another package. the following example shows the output from running dotnet package list --include-transitive for the HelloPlugin (https://github.com/dotnet/samples/tree/main/core/extensions/AppWithPlugin/HelloPlugin) project, which displays top-level packages and the packages they depend on:

Restore complete (0.6s)

Build succeeded in 0.7s
Project 'HelloPlugin' has the following package references
   [netcoreapp3.0]:
   Transitive Package      Resolved
   > PluginBase            1.0.0

---

🎀 ARGUMENTS 🎀

• PROJECT | SOLUTION — the project or solution file to operate on. if you don't specify one, the command searches the current directory for one. and if it finds more than one solution or project? it throws an error. no indecision allowed 🙈

---

👑 OPTIONS 👑

• --config <SOURCE> — the NuGet sources to use when searching for newer packages. requires the --outdated option.
• --deprecated — displays packages that have been deprecated.
• -f|--framework <FRAMEWORK> — displays only the packages applicable for the specified target framework. to specify multiple frameworks, repeat the option multiple times. for example: --framework net6.0 --framework netstandard2.0. the short form of the option (-f) is available starting in .NET 9 SDK.
• -?|-h|--help — prints out a description of how to use the command.
• --highest-minor — considers only the packages with a matching major version number when searching for newer packages. requires the --outdated or --deprecated option.
• --highest-patch — considers only the packages with a matching major and minor version numbers when searching for newer packages. requires the --outdated or --deprecated option.
• --include-prerelease — considers packages with prerelease versions when searching for newer packages. requires the --outdated or --deprecated option.
• --include-transitive — lists transitive packages, in addition to the top-level packages. when you specify this option, you get a list of packages that the top-level packages depend on.
• --interactive — allows the command to stop and wait for user input or action. for example, to complete authentication. available since .NET Core 3.0 SDK.
• --no-restore — don't restore before running the command.
• --outdated — lists packages that have newer versions available.
• -s|--source <SOURCE> — the NuGet sources to use when searching for newer packages. requires the --outdated or --deprecated option.
• -v|--verbosity <LEVEL> — sets the verbosity level of the command. allowed values are q[uiet], m[inimal], n[ormal], d[etailed], and diag[nostic]. the default is minimal. for more info, see <xref:Microsoft.Build.Framework.LoggerVerbosity>.
• --vulnerable — lists packages that have known vulnerabilities. cannot be combined with --deprecated or --outdated options. available starting in .NET SDK 9.0.300, this option uses the <AuditSources> property in your configuration file to specify your source of vulnerability data, which is acquired from the VulnerabilityInfo resource. if <AuditSources> is not specified, the specified <PackageSources> are used to load vulnerability data. for more information, see Audit sources and How to scan NuGet packages for security vulnerabilities (https://devblogs.microsoft.com/nuget/how-to-scan-nuget-packages-for-security-vulnerabilities/).
• --format <console|json> — sets the report output format. allowed values are console, json. defaults to console. available starting in .NET SDK 7.0.200.
• --output-version <VERSION> — sets the report output version. allowed value is 1. defaults to 1. requires the --format json option. when a new JSON version is available, the command will produce the new format by default. this option lets you specify that the command should produce an earlier format. available starting in .NET SDK 7.0.200.

---

🌈 EXAMPLES 🌈

1. list package references of a specific project:

dotnet package list --project SentimentAnalysis.csproj

2. list package references that have newer versions available, including prerelease versions:

dotnet package list --outdated --include-prerelease

3. list package references for a specific target framework:

dotnet package list --framework netcoreapp3.0

4. list package references in machine readable json output format:

dotnet package list --format json

5. list package references for a specific target framework in machine readable json output format:

dotnet package list --framework netcoreapp3.0 --format json

6. save machine readable json output of package references, including transitive dependency and vulnerability details into a file:

dotnet package list --include-transitive --vulnerable --format json >> dependencyReport.json

7. list package references in machine readable json output format with output version 1:

dotnet package list --format json --output-version 1

---

and that's the whole page bestie, you ate that 🍓✨ this cutie dropped as part of .NET Documentation, dated 2025-10-30, and it lives at dotnet-package-list(1) — go forth and list those packages, you absolute icon 💜🦋