Editing NuGet dependencies

Pin a sealed version in the .csproj, including transitive overrides via explicit PackageReference.

Direct dependencies

NuGet's project file is the .csproj (or equivalent for the project type). Update the Version attribute on the <PackageReference>:

-<PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
+<PackageReference Include="Newtonsoft.Json" Version="13.0.3-sp1" />

Run dotnet restore followed by dotnet build; the resolved package is the sealed version pulled through nuget.sealsecurity.io.

Transitive dependencies (explicit <PackageReference>)

NuGet does not have a separate override syntax. To force a transitive to a sealed version, add an explicit <PackageReference> for the package to your .csproj with the sealed version. NuGet treats it as a direct requirement and resolves the rest of the graph against it.

 <ItemGroup>
   <PackageReference Include="SomeFramework" Version="2.0.0" />
+  <PackageReference Include="System.Text.RegularExpressions" Version="4.3.0-sp1" />
 </ItemGroup>

Include names the transitive package; Version is the sealed version you want resolved.

Related

• Configuring NuGet: the package-manager setup that points NuGet at the Seal Artifact Server.