.NET Academy

NuGet packages

Reuse code written by others by adding NuGet packages to your project.

7 min read

You will learn

  • Explain what NuGet and nuget.org are
  • Add, update and remove packages with the CLI
  • Read version numbers and know what restore does
  • Choose packages carefully

Don't reinvent the wheel

The Base Class Library covers a lot, but not everything. Need to generate PDFs, talk to a specific database, or write tests with nicer assertions? Someone has probably already written and published a library for it — as a NuGet package.

  • NuGet is .NET's package manager (like npm for JavaScript or pip for Python).
  • nuget.org is the public gallery where packages are published.
  • A package is a zip file (.nupkg) containing compiled assemblies plus metadata, including the packages it depends on.

Adding a package

dotnet add package Humanizer

This does two things: it downloads the package, and records it in your .csproj:

<ItemGroup>
  <PackageReference Include="Humanizer" Version="2.14.1" />
</ItemGroup>

Now you can use it:

using Humanizer;
 
Console.WriteLine(TimeSpan.FromMinutes(90).Humanize());   // "1 hour, 30 minutes"
Console.WriteLine("some_variable_name".Humanize());       // "Some variable name"

Managing packages

dotnet add package Humanizer --version 2.14.1   # a specific version
dotnet list package                             # what this project uses
dotnet list package --outdated                  # which ones have updates
dotnet remove package Humanizer                 # remove it

Restore and the package cache

Packages aren't stored in your project folder. They're downloaded once into a global cache (~/.nuget/packages) and shared by all your projects. Restore is the step that makes sure every PackageReference is in the cache — dotnet build, run and test do it automatically.

That's why you commit the .csproj but never the packages themselves: anyone who clones the repository gets identical packages on their first build.

Reading version numbers

NuGet uses semantic versioning: MAJOR.MINOR.PATCH.

ChangeExampleMeaning
PATCH2.14.1 → 2.14.2Bug fixes only — safe to update
MINOR2.14.1 → 2.15.0New features, still compatible
MAJOR2.14.1 → 3.0.0Breaking changes — read the release notes

A version with a suffix, like 9.0.0-preview.3, is a prerelease.

Choosing packages wisely

Every package you add is code you're trusting and maintaining. Before adding one, check on nuget.org:

  • Downloads and maintenance — is it widely used and recently updated?
  • License — MIT and Apache-2.0 are common and permissive.
  • Do you need it? — if it saves you three lines, it's not worth a dependency.

Supply-chain safety

Packages run inside your app with full permissions. Prefer well-known publishers, watch for look-alike names (Newtonsoft.Json vs Newtonsoft-Json), and run dotnet list package --vulnerable to find packages with known security issues.

Packages you'll meet in this course

PackageUsed for
Microsoft.EntityFrameworkCoreDatabase access (Track 10)
xunit, MoqTesting (Track 9)
SerilogStructured logging
MediatRCQRS pattern (Track 12)

Key takeaways

  • NuGet is the .NET package manager; nuget.org is the public gallery.
  • dotnet add package downloads a package and adds a PackageReference to the .csproj.
  • Packages live in a shared cache and are restored automatically on build.
  • Versions follow MAJOR.MINOR.PATCH — be careful with major upgrades.

Quiz

4 questions · 3 correct to pass
  1. 1.What is NuGet?

  2. 2.After `dotnet add package Newtonsoft.Json`, where is the dependency recorded?

  3. 3.What does "restore" do?

  4. 4.In version 8.0.2, which number changes for a bug-fix-only release under semantic versioning?

To complete this lesson

  • ○ Pass the quiz (3/4 correct)