`dotnet list package` does not work if project is using central package management system, after upgrading to `.NET 8.0` about home

[jgonz120]

Hello! There is a current issue with CPM, NuGet/NuGet.Client#5866, which we're working on fixing. In your setup are you enabling CPM on individual projects or within the Directory.Package.props file?

[parase03]

Hello @jgonz120! In my setup, the CPM is enabled for the entire solution in a central Directory.Package.props file, located in the root of the solution (where the .sln file lies).

[jgonz120]

I haven't been able to reproduce this using https://github.com/nkolev92/CentralPackageManagementDemo as an example repo.

After cloning I added a global.json file so I could specify the dotnet version and updated the projects to use net7.0 so I could test it in both versions.

Are there any differences with that example project and yours that you think could help us get a repro?

[parase03]

Hello again! I managed to find the culprit but don't know if this is an expected behavior or a bug.

Indeed with the project you mentioned I wasn't able to reproduce the issue, so I compared with my local repository. I found out that the only difference in terms of structure and files, was the existence of Directory.Build.props, in addition to the CPM. Apologies for not mentioning this initially, I thought it was irrelevant.

In this file, there were also global package references mentioned. So I copied the same file in the the example repo and was able to reproduce this using .NET 8.0 SDK. When I moved these references to the Directory.Packages.props (while leaving the file with the rest of its contents), the problem was resolved and dotnet list package --vulnerable was able to work again.

Interestingly enough, when I switched .NET SDK to version 7.0 using global.json, and restored Directory.Build.Props to its original contents, the command wasn't failing.

This begs the question: was this behavior with v7.0 a pre-existing bug that got fixed with v8.0, or is the current behavior a bug? It looks like .NET 7.0 is parsing both Directory.* files for package references when a list package command is issued, whereas .NET 8.0 looks only in the CPM-specfic one.

Can (or should) Directory.Build.props contain global package references?

---

To re-create this, I followed these steps:

1. Cloned https://github.com/nkolev92/CentralPackageManagementDemo project
2. Created a Directory.Build.Props using this sample.
3. I moved the below section:

<ItemGroup>
    <GlobalPackageReference Include="Microsoft.SourceLink.GitHub" Version="1.1.1" />
</ItemGroup>

from Directory.Package.Props into the Directory.Build.Props.
4. I opened a terminal and run dotnet restore, followed by dotnet list package --vulnerable.