Skip to main content
N
All NuGet guides

Practical workflow

Audit NuGet dependencies in a .NET project

Use this workflow before a release, during dependency upgrades or when taking ownership of an existing .NET service. It starts from the versions your project declares and separates direct from resolved transitive dependencies.

Open Dependency Audit

Workflow

  1. 1

    Start with the version source of truth

    Drop a .csproj file when versions are declared in the project, or use Directory.Packages.props for Central Package Management.

  2. 2

    Review direct dependencies first

    Check the resolved version, published advisories, deprecation notices, update availability and license label for every direct reference.

  3. 3

    Trace transitive risk back to its parent

    Use the dependency path and depth to decide whether the issue is best fixed by an update, a direct override or a package replacement.

  4. 4

    Record the decision in your release process

    Export the report, confirm remediation in the target framework and keep any accepted risk alongside the project change.

What this workflow gives you

  • A direct-versus-transitive inventory tied to the versions currently declared by the project.
  • A focused queue for updates, advisories, deprecations and licenses that need review.
  • An exportable snapshot to attach to a pull request or release record.

Choose packages with context

JSON libraries for .NETLogging packages for .NETTesting frameworks for .NET

Data, method and limits

Sources: the project file you select and the public NuGet v3 registry. Refresh: registry metadata is queried while the tool runs; your file stays in the browser. Method: the workflow turns declared versions and published package metadata into a review queue. Limit: The audit resolves published NuGet metadata and dependency ranges in the browser. It does not replace a restore, build, runtime test, proprietary advisory feed or legal review.