Update all projects in solution with dotnet package update#7014
Conversation
There was a problem hiding this comment.
Pull request overview
This PR implements support for updating packages across all projects in a solution using the dotnet package update command. Previously, the command only supported updating a single project at a time. The implementation introduces parallel processing to efficiently handle multiple projects.
Key changes:
- Refactored package selection logic to process multiple projects in parallel using
Parallel.ForEachAsync - Updated method signatures to return
HashSet<string>for scanned packages instead of integer counts - Modified the final summary to report unique package counts across all projects
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| PackageUpdateCommandRunner.cs | Core logic refactored to support multi-project updates with parallel processing; new ProcessProjectsInParallelAsync method coordinates concurrent package selection across projects |
| IPackageUpdateIO.cs | Interface updated: GetProjectAssetsFileAsync now requires explicit projectPath parameter to support multi-project scenarios |
| PackageUpdateIO.cs | Implementation updated to use the new projectPath parameter instead of assuming single project from dgSpec |
| SingleProjectTests.cs | Added test for vulnerable package updates with audit mode verification; imports added for Protocol namespace |
| MultiProjectTests.cs | Three new tests added: updating same package across projects, updating specific packages selectively, and vulnerable package handling in multi-project scenarios |
| GetPackageToUpdateTests.cs | Updated assertions to verify the new scannedPackages return value alongside existing package update results |
src/NuGet.Core/NuGet.CommandLine.XPlat/Commands/Package/Update/PackageUpdateCommandRunner.cs
Show resolved
Hide resolved
src/NuGet.Core/NuGet.CommandLine.XPlat/Commands/Package/Update/PackageUpdateCommandRunner.cs
Show resolved
Hide resolved
src/NuGet.Core/NuGet.CommandLine.XPlat/Commands/Package/Update/PackageUpdateCommandRunner.cs
Outdated
Show resolved
Hide resolved
src/NuGet.Core/NuGet.CommandLine.XPlat/Commands/Package/Update/PackageUpdateCommandRunner.cs
Outdated
Show resolved
Hide resolved
src/NuGet.Core/NuGet.CommandLine.XPlat/Commands/Package/Update/PackageUpdateCommandRunner.cs
Outdated
Show resolved
Hide resolved
src/NuGet.Core/NuGet.CommandLine.XPlat/Commands/Package/Update/PackageUpdateCommandRunner.cs
Show resolved
Hide resolved
| }; | ||
|
|
||
| var globalPackagesFolder = dgSpec.GetProjectSpec(dgSpec.Restore.Single()).RestoreMetadata.PackagesPath; | ||
| var globalPackagesFolder = dgSpec.GetProjectSpec(dgSpec.Restore.First()).RestoreMetadata.PackagesPath; |
There was a problem hiding this comment.
The GPF can be configured per project, so I think our code should probably account for that.
In fact, I think you probably do not need to set this here at all and let the rest of the restore mechanism figure out the gpf.
This ensures the one from the package spec is being used, which is what we're setting up here anyways.
Bug
Fixes: NuGet/Home#14309
Description
Makes
dotnet package updatesupport solutions with multiple projects.Key points:
dotnet package update Microsoft.Extensions.DependencyInjection), if no packages were updated, then don't return an error exit code. I remember being unsure about this when implementing the first versions of package update. But now I agree to make the command idempotent. On Linux and other UNIX's, it's typically not an error to delete a file or directory that doesn't exist, because the user was asking for an outcome, even if the outcome was true in the precondition. Similarly, asking to upgrade a package to the latest version when it's already the latest, the outcome is achieved. Asking to upgrade a package that isn't referenced by a project doesn't require the project to be modified. I think this makes it easier to script package update since you no longer need to worry about whether the package is referenced or if it's already up to date. Anyway, this could be considered a breaking change, but I feel like it's better ergonomics.PR Checklist
Link to an issue or pull request to update docs if this PR changes settings, environment variables, new feature, etc.