dotnet list package --outdated: find outdated NuGet packages

dotnet list package --outdated restores nothing new and changes nothing: it compares each package reference of the project or solution with the newest version available on the configured sources and prints the ones that are behind, with the Requested, Resolved and Latest versions. Add --include-transitive for indirect dependencies, --include-prerelease to compare with prereleases, and --vulnerable to list packages with known security advisories instead. In the .NET 10 SDK the same command is also available as dotnet package list.

List outdated packages

dotnet new classlib -o Lib > /dev/null
cd Lib
dotnet add package Newtonsoft.Json --version 12.0.3 > /dev/null
dotnet list package --outdated | grep -E "Newtonsoft|Top-level|Requested" | sed -E 's/[0-9]+\.[0-9]+\.[0-9]+ *$/LATEST/'

/tmp/work/Lib/Lib.csproj : warning NU1903: Package 'Newtonsoft.Json' 12.0.3 has a known high severity vulnerability, https://github.com/advisories/GHSA-5crp-9r3c-p9vr
   Top-level Package      Requested   Resolved   Latest
   > Newtonsoft.Json      12.0.3      12.0.3     LATEST

The project asks for Newtonsoft.Json 12.0.3. The table shows it as a top-level package with the requested and resolved version 12.0.3 and the latest version on nuget.org; the example replaces that last number with LATEST because it changes whenever a new release appears. The NU1903 warning above the table comes from NuGet's package audit: 12.0.3 has a published high-severity advisory, which is one more reason to update it.

Options

Updating what the list shows

Run dotnet add package NAME without --version to move a package to the latest stable version, or with --version for a specific one; see dotnet add package --version. Update major versions one at a time and read their release notes, since breaking changes are expected there. With Central Package Management, change the version in Directory.Packages.props instead.

Pitfalls

• Restore first. The command reads the restored assets file; on a fresh clone run dotnet restore, otherwise it asks you to restore before listing.
• Unreachable sources. If a source in nuget.config is down or needs credentials, the check fails with NU1301 Unable to load the service index.
• Floating versions. A reference such as 13.* shows the resolved version, which can change on every restore; pin versions if you want the outdated check to be meaningful.
• Slow on large solutions. Every package is looked up on every source. Fewer sources and package source mapping make it faster.

How to confirm it worked

After updating, run dotnet list package --outdated again: a project with nothing to update prints that it has no updates for the given sources. In CI, --format json gives a stable output to fail a build when outdated or vulnerable packages appear.

FAQ