`aspire update` doesn't find updates for Aspire.* packages already on a prerelease version
- Dominant language
- C#
- Stars
- 6.3k
- Forks
- 991
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 196
Description
## Summary
`aspire update` does not find newer prerelease versions of an `Aspire.*` package that is already referenced at a prerelease version. The package that exposed this is internal-only and is available from the Aspire1P Azure Artifacts feed configured for the project; it is not part of an Aspire stable/daily/staging package channel.
`dotnet outdated -include aspire` finds the update. `dotnet package list --outdated` does not find it unless `--include-prerelease` is supplied.
## Expected behavior
If a project already references an `Aspire.*` package at a prerelease version, `aspire update` should consider newer prerelease versions for that package by default, using the NuGet sources configured for the project.
## Actual implementation
`aspire update` does **not** call `dotnet package list --outdated`. It:
1. Evaluates the project and follows project references.
2. Selects package references whose IDs start with `Aspire.`.
3. For each package ID, calls `PackageChannel.GetPackagesAsync`.
4. That eventually invokes:
```text
dotnet package search --format json [--configfile ] [--prerelease]
```
5. `ProjectUpdater` independently selects the highest semantic version returned and compares it with the current project version.
Whether `--prerelease` is supplied is based only on the selected channel's `PackageChannelQuality`, not on whether the project's current package version is a prerelease:
- `Both`: runs searches without and with `--prerelease`.
- `Prerelease`: runs a search with `--prerelease`.
- `Stable`: first searches without `--prerelease`; it retries with `--prerelease` only if the stable search returns no packages at all.
## Likely contributing source-selection bug
The package in this report is on the project's Aspire1P artifacts feed, not an Aspire package channel.
For an explicit package channel, `PackageChannel` creates a temporary NuGet config and passes it through `--configfile`. That generated config contains ``, so it replaces the project's ambient NuGet sources with only the channel mappings. The built-in `stable` channel maps all packages only to NuGet.org.
For a normal package-based AppHost with no explicit/configured channel, `UpdateCommand` prefers the running CLI's identity channel. A stable-installed CLI therefore normally selects the explicit `stable` channel rather than the implicit `default` channel. Consequently, an internal-only package on the project's configured Aspire1P feed is likely not searched at all. The implicit `default` channel would use the ambient NuGet configuration and has quality `Both`, but it is not normally selected in this case.
So there are two related gaps:
1. The current package version does not influence prerelease inclusion.
2. Channel selection can replace the project's configured package sources, making packages outside an Aspire channel undiscoverable.
## Relevant code
- `src/Aspire.Cli/Commands/UpdateCommand.cs` — channel selection, including CLI identity-channel preference.
- `src/Aspire.Cli/Projects/ProjectUpdater.cs` — project/package analysis and latest-version comparison.
- `src/Aspire.Cli/Packaging/PackageChannel.cs` — quality-based stable/prerelease searches and temporary config use.
- `src/Aspire.Cli/NuGet/NuGetPackageCache.cs` — delegates package discovery to `SearchPackagesAsync`.
- `src/Aspire.Cli/DotNet/DotNetCliRunner.cs` — constructs `dotnet package search` and adds `--prerelease`.
- `src/Aspire.Cli/Packaging/TemporaryNuGetConfig.cs` — emits `` and only the channel's mapped sources.
_Created from a [Microsoft Teams conversation](https://teams.microsoft.com/l/message/19%3AuuDJgMCR7JeFSM-0RK2xRW5mAq2WFNfUK0TLmYDvAU01%40thread.tacv2/1787954479516?tenantId=72f988bf-86f1-41af-91ab-2d7cd011db47&groupId=f2e0b0b6-f130-46fa-8ec6-2ef4a7168ed2&parentMessageId=1787954479516)._
Contributor guide
Research direction
Trace update behavior through src/Aspire.Cli/Commands/UpdateCommand.cs, Projects/ProjectUpdater.cs, Packaging/PackageChannel.cs, NuGet/NuGetPackageCache.cs, DotNet/DotNetCliRunner.cs, and Packaging/TemporaryNuGetConfig.cs. Start by following channel selection and package-search argument construction, then reproduce the prerelease package case with the project's configured source. Done means newer prerelease Aspire.* packages are discoverable and compared correctly without breaking channel-specific sources.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- cli, tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100