microsoft / microsoft/aspire

`aspire update` doesn't find updates for Aspire.* packages already on a prerelease version

Open
#19,791 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
6.3k
Forks
991
Avg merge
2d 15h
Merged PRs (30d)
196

Description

## Summary

`aspire update` does not find newer prerelease versions of an `Aspire.*` package that is already referenced at a prerelease version. The package that exposed this is internal-only and is available from the Aspire1P Azure Artifacts feed configured for the project; it is not part of an Aspire stable/daily/staging package channel.

`dotnet outdated -include aspire` finds the update. `dotnet package list --outdated` does not find it unless `--include-prerelease` is supplied.

## Expected behavior

If a project already references an `Aspire.*` package at a prerelease version, `aspire update` should consider newer prerelease versions for that package by default, using the NuGet sources configured for the project.

## Actual implementation

`aspire update` does **not** call `dotnet package list --outdated`. It:

1. Evaluates the project and follows project references.
2. Selects package references whose IDs start with `Aspire.`.
3. For each package ID, calls `PackageChannel.GetPackagesAsync`.
4. That eventually invokes:

```text
dotnet package search --format json [--configfile ] [--prerelease]
```

5. `ProjectUpdater` independently selects the highest semantic version returned and compares it with the current project version.

Whether `--prerelease` is supplied is based only on the selected channel's `PackageChannelQuality`, not on whether the project's current package version is a prerelease:

- `Both`: runs searches without and with `--prerelease`.
- `Prerelease`: runs a search with `--prerelease`.
- `Stable`: first searches without `--prerelease`; it retries with `--prerelease` only if the stable search returns no packages at all.

## Likely contributing source-selection bug

The package in this report is on the project's Aspire1P artifacts feed, not an Aspire package channel.

For an explicit package channel, `PackageChannel` creates a temporary NuGet config and passes it through `--configfile`. That generated config contains ``, so it replaces the project's ambient NuGet sources with only the channel mappings. The built-in `stable` channel maps all packages only to NuGet.org.

For a normal package-based AppHost with no explicit/configured channel, `UpdateCommand` prefers the running CLI's identity channel. A stable-installed CLI therefore normally selects the explicit `stable` channel rather than the implicit `default` channel. Consequently, an internal-only package on the project's configured Aspire1P feed is likely not searched at all. The implicit `default` channel would use the ambient NuGet configuration and has quality `Both`, but it is not normally selected in this case.

So there are two related gaps:

1. The current package version does not influence prerelease inclusion.
2. Channel selection can replace the project's configured package sources, making packages outside an Aspire channel undiscoverable.

## Relevant code

- `src/Aspire.Cli/Commands/UpdateCommand.cs` — channel selection, including CLI identity-channel preference.
- `src/Aspire.Cli/Projects/ProjectUpdater.cs` — project/package analysis and latest-version comparison.
- `src/Aspire.Cli/Packaging/PackageChannel.cs` — quality-based stable/prerelease searches and temporary config use.
- `src/Aspire.Cli/NuGet/NuGetPackageCache.cs` — delegates package discovery to `SearchPackagesAsync`.
- `src/Aspire.Cli/DotNet/DotNetCliRunner.cs` — constructs `dotnet package search` and adds `--prerelease`.
- `src/Aspire.Cli/Packaging/TemporaryNuGetConfig.cs` — emits `` and only the channel's mapped sources.

_Created from a [Microsoft Teams conversation](https://teams.microsoft.com/l/message/19%3AuuDJgMCR7JeFSM-0RK2xRW5mAq2WFNfUK0TLmYDvAU01%40thread.tacv2/1787954479516?tenantId=72f988bf-86f1-41af-91ab-2d7cd011db47&groupId=f2e0b0b6-f130-46fa-8ec6-2ef4a7168ed2&parentMessageId=1787954479516)._

Contributor guide

Open the contributing guide

Research direction

Trace update behavior through src/Aspire.Cli/Commands/UpdateCommand.cs, Projects/ProjectUpdater.cs, Packaging/PackageChannel.cs, NuGet/NuGetPackageCache.cs, DotNet/DotNetCliRunner.cs, and Packaging/TemporaryNuGetConfig.cs. Start by following channel selection and package-search argument construction, then reproduce the prerelease package case with the project's configured source. Done means newer prerelease Aspire.* packages are discoverable and compared correctly without breaking channel-specific sources.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
cli, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.