Aspnetcore: NuGet "Microsoft.AspNetCore.App" upgrade "Blocked by project"

[Plasma]

Describe the bug

I'm not sure what .NET Core MVC version I am actually on.

In my project, NuGet shows this:

How do I make sure I am on the latest 2.2.3 version?

The csproj has this:

<Project Sdk="Microsoft.NET.Sdk.Web">

  <PropertyGroup>
    <TargetFramework>netcoreapp2.2</TargetFramework>
    <AspNetCoreHostingModel>InProcess</AspNetCoreHostingModel>
  </PropertyGroup>


  <ItemGroup>
    <PackageReference Include="Microsoft.AspNetCore.App" />
    <PackageReference Include="Microsoft.AspNetCore.Razor.Design" Version="2.2.0" PrivateAssets="All" />
  </ItemGroup>

</Project>

Thank you

[HashemGo]

<PackageReference Include="Microsoft.AspNetCore.App" Version="2.2.3" /> ;)

good luck

[cremor]

@Plasma Under the dropdown that is visible in your screenshot there is a "Learn more" link. You should read it, especially point number 4. Here is the link directly: https://docs.microsoft.com/en-us/nuget/tools/package-manager-ui#updating-a-package

I'm not sure what .NET Core MVC version I am actually on.

Run dotnet --info in a console or PowerShell window.

How do I make sure I am on the latest 2.2.3 version?

Install the latest SDK (or runtime for the server): https://dotnet.microsoft.com/download

@mishmish30 Don't do that. Read the documentation I linked above, there is a reason why the package doesn't specify a version.

[blowdart]

What @cremor said. For 2.x and above it doesn't matter. It will use the latest major/minor release. It rolls forward. Pinning stops the roll forward, so no security patches for you if you do this.

The way to ensure your machine is on 2.2.3 is to install it.

[Plasma]

Thank you guys. This is a bit confusing, I thought .NET Core was all about using the version installed with the app (so no need to ensure something is installed on the server); so am I right in thinking that my local machine only has 2.2.0 installed because its not just setting itself to 2.2.3?

Thank you

[cremor]

I wouldn't trust what the NuGet package manager shows. For example, although I have .NET Core 2.2.3 installed on my machine (confirmed by dotnet --info), the NuGet Package manager shows version 2.2.0 as installed/used for all packages that are included in the .NET Core runtime (I don't even see 2.2.3 in the part that you underlined in your screenshot).

If you don't want to depend on the installed runtime version you need to deploy your app self-contained. See here: https://docs.microsoft.com/en-us/dotnet/core/deploying/

[Eilon]

@natemcmaster - are there any additional docs you would point to regarding how this works?

[natemcmaster]

https://docs.microsoft.com/en-us/dotnet/core/packages
https://docs.microsoft.com/en-us/aspnet/core/fundamentals/metapackage
https://docs.microsoft.com/en-us/dotnet/core/versions/selection#framework-dependent-apps-roll-forward

[Leftyx]

Apparently, the only way to fix it is to update using "Manage Nuget Packages for Solutions..." instead of "Manage Nuget Packages..." on the project.

I have the latest sdk installed:

I have created a "ASP.NET Core Web Application" using the .Net Core 2.2 as target framework.
If I try to update Microsoft.AspNetCore.App to the latest installed version using "Manage Nuget Packages..." on the project this is what I see:

but if I try to update those packages using "Manage Nuget Packages for Solutions..." on the solutions, the magic happens:

As you can see there's just one project in the solution and I haven't changed anything in the csproj file:

<Project Sdk="Microsoft.NET.Sdk.Web">

  <PropertyGroup>
    <TargetFramework>netcoreapp2.2</TargetFramework>
    <AspNetCoreHostingModel>InProcess</AspNetCoreHostingModel>
  </PropertyGroup>


  <ItemGroup>
    <PackageReference Include="Microsoft.AspNetCore.App" />
    <PackageReference Include="Microsoft.AspNetCore.Razor.Design" Version="2.2.0" PrivateAssets="All" />
  </ItemGroup>

</Project>

[cremor]

@Leftyx I doubt that that will do anything. I assume this is just a display bug in "Manage Nuget Packages for Solutions". Please read my earlier comments in this issue to learn why there is nothing to update for ASP.NET Core.

[Leftyx]

@cremor , you are right.
I read the documentation provided here but I don't quite understand.
Maybe you can shed some light.
I don't need to install the runtime as it is already included in the sdk, right ?

[cremor]

Yes, the runtime gets automatically installed when you install the SDK.

Important parts of the documentation:

For some packages, the Update button is disabled and a message appears saying that it's "Implicitly referenced by an SDK" (or "AutoReferenced"). This message indicates that the package is part of a larger framework or SDK and should not be updated independently. For example, Microsoft.NETCore.App is part of the .NET Core SDK, and the package version is not the same as the version of the runtime framework used by the application. You need to update your .NET Core installation to get new versions of the ASP.NET Core and .NET Core runtime.

Source: https://docs.microsoft.com/en-us/nuget/consume-packages/install-use-packages-visual-studio#updating-a-package

The host chooses the latest patch version installed on the machine. For example, if you specified netcoreapp2.0 in your project file, and 2.0.4 is the latest .NET runtime installed, the 2.0.4 runtime is used.
If no acceptable 2.0.* version is found, a new 2.* version is used. For example, if you specified netcoreapp2.0 and only 2.1.0 is installed, the application runs using the 2.1.0 runtime. This behavior is referred to as "minor version roll-forward." Lower versions also won't be considered. When no acceptable runtime is installed, the application won't run.

Source: https://docs.microsoft.com/en-us/dotnet/core/versions/selection#framework-dependent-apps-roll-forward

[Leftyx]

@cremor , it makes sense. Thanks.

[msftbot[bot]]

Thank you for contacting us. Due to no activity on this issue we're closing it in an effort to keep our backlog clean. If you believe there is a concern related to the ASP.NET Core framework, which hasn't been addressed yet, please file a new issue.