microsoft / microsoft/aspire

aspire add --source excludes configured NuGet sources needed by transitive dependencies

Open
#19,207 2 comments 0 reactions 0 assignees View on GitHub
area-cli area-integrations triage:bot-seen
Dominant language
C#
Stars
6.3k
Forks
991
Avg merge
2d 15h
Merged PRs (30d)
196

Description

### Describe the bug

`aspire add --source ` uses the supplied source as the only source for the package restore. The integration package is found in that source, but its ordinary transitive dependencies cannot be restored from sources already configured in `NuGet.config`.

This makes `--source` unusable for a local or secured feed that contains the requested integration package but intentionally relies on another configured feed for its dependencies.

The command reference describes `--source` as **“The NuGet source to use for the integration”**, which implies that the source selects the integration package rather than replacing all configured restore sources:

https://aspire.dev/reference/cli/commands/aspire-add/

### Expected Behavior

`--source` should make the supplied source available for the requested integration while retaining configured NuGet sources for transitive dependency resolution.

Alternatively, if replacing all configured sources is intentional, the command reference should document that behavior explicitly.

### Steps To Reproduce

1. Create any C# Aspire AppHost.
2. Create a local NuGet folder containing only an integration package, for example `Aspire.Hosting.Azure.AppContainers.13.5.0.nupkg`. Do not copy its transitive dependencies into that folder.
3. Ensure the AppHost's normal `NuGet.config` contains a source that can restore the integration's transitive dependencies.
4. Run:

```bash
aspire add Aspire.Hosting.Azure.AppContainers \
--version 13.5.0 \
--source ./local-feed \
--non-interactive
```

The integration package is read from `./local-feed`, but restore fails for dependencies that are available from the configured source:

```text
error NU1100: Unable to resolve 'AspNetCore.HealthChecks.Uris (>= 9.0.0)' for 'net10.0'.
error NU1100: Unable to resolve 'Google.Protobuf (>= 3.34.1)' for 'net10.0'.
error NU1100: Unable to resolve 'Grpc.AspNetCore (>= 2.80.0)' for 'net10.0'.
...
The package installation failed with exit code 5.
```

Adding the local feed to `NuGet.config` alongside the normal source and running the command without `--source` restores successfully.

### Exceptions (if any)

None. The command exits with code 5 after NuGet reports unresolved transitive dependencies.

### Aspire doctor output

Reproduced with:

```text
Aspire CLI 13.5.0+0028557bee5d68bf5093b9a58501d714701c0da6
.NET SDK 10.0.302
```

### Anything else?

The documented option is here:

- [`aspire add` command reference](https://aspire.dev/reference/cli/commands/aspire-add/): `-s, --source` — “The NuGet source to use for the integration.”

A practical workaround is to add both the integration feed and the dependency feed to `NuGet.config`, then omit `--source`.

The command-reference wording above was also verified against the Aspire docs `release/13.5` source: [aspire-add.mdx](https://github.com/microsoft/aspire.dev/blob/75b6e80016007c6f286808dca390b0abd04f9b05/src/frontend/src/content/docs/reference/cli/commands/aspire-add.mdx).

Contributor guide

Open the contributing guide

Research direction

Start at the `aspire add` command entry point and trace how `--source` is passed into package restore, comparing it with the `NuGet.config` sources. Reproduce the command using `./local-feed` and a configured dependency source; done means the integration comes from the supplied source while its transitive dependencies restore from configured sources.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
cli
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.