dotnet-outdated

When using --recursive --include-file-based-apps, dotnet-outdated can discover loose .cs file-based apps that start with a shebang (#!).

File-based apps can declare dependencies using:

• #:package for NuGet packages.
• #:sdk for MSBuild SDK packages (e.g., #:sdk Cake.Sdk@6.0.0).
• #:property for variable-backed versions.

The dotnet outdated command reports outdated NuGet packages in your .NET Core and .NET Standard projects. By default, it analyzes the current directory.

Command Syntax: dotnet outdated [options] <Path>

Path Argument Behavior:

• No path specified: Searches the current directory for a solution (.sln, .slnx) or a project (.csproj, .fsproj). If multiple are found, it returns an error.
• Directory path: Performs the same search logic within the specified directory.
• Specific file path: Analyzes the provided .sln, .slnx, .csproj, .fsproj, or .cs file-based app.

Usage: dotnet outdated [options] <Path>

If you already have the tool installed and want to update to the latest version, use the dotnet tool update command.

dotnet tool update --global dotnet-outdated-tool

You can use dotnet-outdated to not only report but also upgrade packages using the -u|--upgrade option.

• Auto mode (default): Automatically attempts to upgrade outdated packages to the latest version.
• Prompt mode: Prompts you for each outdated package before upgrading. Use -u:prompt.

To use dotnet-outdated, you must have a supported .NET SDK installed. You can install it as a global .NET tool using the dotnet tool install command.

If you are migrating from the original dotnet-outdated tool, you must first uninstall it to avoid conflicts:

dotnet tool uninstall --global dotnet-outdated

dotnet tool install --global dotnet-outdated-tool

To use secure feeds (like MyGet), it is recommended to add them via the NuGet CLI source command. dotnet-outdated supports:

• Pre-authenticated URLs.
• Username/Password via nuget sources.
• Credential providers (e.g., Azure Artifacts credential provider).

Important for Credential Providers: You may need to set the DOTNET_HOST_PATH environment variable to the path of your dotnet executable (e.g., /usr/local/share/dotnet/dotnet) if the SDK does not automatically provide it at runtime.

macOS/Linux Note: Pass -StorePasswordInClearText to the nuget sources command if you need to store passwords in clear text on these platforms.

The built-in MCP server allows AI agents (like Claude Desktop or GitHub Copilot) to discover, analyze, and update outdated NuGet packages in your .NET projects.

To start the server, run:

dotnet outdated mcp

To use dotnet-outdated with the VS Code MCP extension, add the following configuration to your .vscode/mcp.json file:

{
  "mcpServers": {
    "dotnet-outdated": {
      "command": "dotnet-outdated",
      "args": ["mcp"]
    }
  }
}

To use dotnet-outdated with Claude Desktop, add the following configuration to your claude_desktop_config.json file:

{
  "mcpServers": {
    "dotnet-outdated": {
      "command": "dotnet-outdated",
      "args": ["mcp"]
    }
  }
}

If you encounter an error stating that hostfxr.dll, libhostfxr.so, or libhostfxr.dylib was not found, it is likely because the .NET Core CLI was installed in a non-default location.

Solution: Set the DOTNET_ROOT environment variable to point to the location of your .NET Core CLI installation.

Use the -vl|--version-lock option to restrict updates to specific version ranges, preventing accidental major version upgrades.

Available values:

• None (Default): Returns the absolute latest package version.
• Major: Only reports packages within the current major version range (e.g., 4.x.x for version 4.1.0).
• Minor: Only reports packages within the current minor version range (e.g., 4.1.x for version 4.1.0).