NuGet packages
Reuse code written by others by adding NuGet packages to your project.
7 min read
You will learn
- Explain what NuGet and nuget.org are
- Add, update and remove packages with the CLI
- Read version numbers and know what restore does
- Choose packages carefully
Don't reinvent the wheel
The Base Class Library covers a lot, but not everything. Need to generate PDFs, talk to a specific database, or write tests with nicer assertions? Someone has probably already written and published a library for it — as a NuGet package.
- NuGet is .NET's package manager (like npm for JavaScript or pip for Python).
- nuget.org is the public gallery where packages are published.
- A package is a zip file (
.nupkg) containing compiled assemblies plus metadata, including the packages it depends on.
Adding a package
dotnet add package HumanizerThis does two things: it downloads the package, and records it in your .csproj:
<ItemGroup>
<PackageReference Include="Humanizer" Version="2.14.1" />
</ItemGroup>Now you can use it:
using Humanizer;
Console.WriteLine(TimeSpan.FromMinutes(90).Humanize()); // "1 hour, 30 minutes"
Console.WriteLine("some_variable_name".Humanize()); // "Some variable name"Managing packages
dotnet add package Humanizer --version 2.14.1 # a specific version
dotnet list package # what this project uses
dotnet list package --outdated # which ones have updates
dotnet remove package Humanizer # remove itRestore and the package cache
Packages aren't stored in your project folder. They're downloaded once into a global cache (~/.nuget/packages) and shared by all your projects. Restore is the step that makes sure every PackageReference is in the cache — dotnet build, run and test do it automatically.
That's why you commit the .csproj but never the packages themselves: anyone who clones the repository gets identical packages on their first build.
Reading version numbers
NuGet uses semantic versioning: MAJOR.MINOR.PATCH.
| Change | Example | Meaning |
|---|---|---|
| PATCH | 2.14.1 → 2.14.2 | Bug fixes only — safe to update |
| MINOR | 2.14.1 → 2.15.0 | New features, still compatible |
| MAJOR | 2.14.1 → 3.0.0 | Breaking changes — read the release notes |
A version with a suffix, like 9.0.0-preview.3, is a prerelease.
Choosing packages wisely
Every package you add is code you're trusting and maintaining. Before adding one, check on nuget.org:
- Downloads and maintenance — is it widely used and recently updated?
- License — MIT and Apache-2.0 are common and permissive.
- Do you need it? — if it saves you three lines, it's not worth a dependency.
Supply-chain safety
Packages run inside your app with full permissions. Prefer well-known publishers, watch for look-alike names (Newtonsoft.Json vs Newtonsoft-Json), and run dotnet list package --vulnerable to find packages with known security issues.
Packages you'll meet in this course
| Package | Used for |
|---|---|
Microsoft.EntityFrameworkCore | Database access (Track 10) |
xunit, Moq | Testing (Track 9) |
Serilog | Structured logging |
MediatR | CQRS pattern (Track 12) |
Key takeaways
- NuGet is the .NET package manager; nuget.org is the public gallery.
dotnet add packagedownloads a package and adds aPackageReferenceto the.csproj.- Packages live in a shared cache and are restored automatically on build.
- Versions follow MAJOR.MINOR.PATCH — be careful with major upgrades.
Quiz
4 questions · 3 correct to pass1.What is NuGet?
2.After `dotnet add package Newtonsoft.Json`, where is the dependency recorded?
3.What does "restore" do?
4.In version 8.0.2, which number changes for a bug-fix-only release under semantic versioning?
To complete this lesson
- ○ Pass the quiz (3/4 correct)