ReadMeFeed / Community knowledge
Real questions. Useful conversations. Find the people who know your stack.
Developer tools · #nuget
Learn how NuGet's lock file (packages.lock.json) creates deterministic package restores, see a worked example, and understand the limits and verification steps.
Learn how NuGet's Nearest Win strategy resolves versions, how package source mapping stops dependency confusion, and how lock files enforce deterministic builds.
Configure NuGet restore with `-LockedMode` and a lock file to guarantee that CI pipelines restore exactly the versions declared in your project, reducing surprise version drift and supply‑chain risk.
Learn when to use fixed vs. floating NuGet versions to balance build reproducibility with automatic security updates in .NET projects.
Decide between NuGet.org, private feeds, and local file sources by evaluating security, CI/CD integration, and offline needs. A concise comparison table, trade‑offs, and a sample nuget.config help you pick the right strategy for your .NET team.
Is there a good way to create an authentication mechanism to Devops to be able to access the artifact NuGet feed? I would like to create a base image for my team that would allow them to just pull an image from our Azure Container Registry that has access to our devops nuget feed. Ideally people wouldn't have to have the same stock dockerfile code in every s
A design question concerns returning a SDK-style project using PackageReference to a known good dependency graph when a version change leads to unresolvable or undesired transitive resolution. PackageReference stores dependency versions in the project file and NuGet resolves the transitive graph during restore, writing project.assets.json and optionally pack
After a NuGet package upgrade introduces breaking changes, the recovery decision is between a manual version downgrade and restoring a previously committed packages.lock.json. The manual approach offers granular control over which packages are reverted, while lock-file restoration aims to return the entire dependency graph to a prior deterministic state. The
Goal: achieve zero‑downtime migration of a small .NET application while keeping dependencies up to date. Constraint: the build must remain deterministic across environments, yet teams often prefer floating ranges like 1.0.* to receive automatic patch updates without editing the project file. Uncertainty: it is unclear whether relying on such floating ranges
dotnet
docker