Configure Renovate to update preview versions of NuGet packages
Tags: dotnet, renovate, security, csharp
Published: 2024-05-04 20:32:25

By default, Renovate ignores preview versions of dependencies. For NuGet, a preview version is a package whose version contains a semantic suffix such as `-alpha`, `-beta`, `-rc`. There are some well-known NuGet packages that are only available in preview versions. For example, [Aspire.Hosting](https://www.nuget.org/packages/Aspire.Hosting/) will likely remain in preview until the release of .NET 9, [StyleCop.Analyzers](https://www.nuget.org/packages/StyleCop.Analyzers/) has been in beta for already 5 years, while [OpenTelemetry.Instrumentation.GrpcNetClient](https://www.nuget.org/packages/OpenTelemetry.Instrumentation.GrpcNetClient/) and [Azure.AI.OpenAI](https://www.nuget.org/packages/Azure.AI.OpenAI/) have never had a stable version.

Yet, these packages might be used today in production in your applications and services, and it is just as important to keep them updated as the other stable packages. To allow Renovate to update these packages, you must use the configuration property `ignoreUnstable`:

```json
{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:best-practices"
  ],
  "enabledManagers": [
    "nuget"
  ],
  "packageRules": [
    {
      "matchManagers": ["nuget"],
      "matchPackageNames": ["Aspire.Hosting"],
      "description": ".NET Aspire is currently only available in preview",
      "ignoreUnstable": true // HERE
    }
  ]
}
```

In this example, we have a .NET Aspire host project for which we wish to keep the `Aspire.Hosting` dependency up to date. Here is the content of the csproj file:

```xml
<Project Sdk="Microsoft.NET.Sdk">
  <PropertyGroup>
    <OutputType>Exe</OutputType>
    <TargetFramework>net8.0</TargetFramework>
    <ImplicitUsings>enable</ImplicitUsings>
    <Nullable>enable</Nullable>
    <IsAspireHost>true</IsAspireHost>
    <InvariantGlobalization>true</InvariantGlobalization>
  </PropertyGroup>

  <ItemGroup>
    <PackageReference Include="Aspire.Hosting" Version="8.0.0-preview.2.23619.3" />
  </ItemGroup>
</Project>
```

When [running Renovate locally](https://anthonysimmon.com/locally-test-validate-renovate-config-files/), it is capable of finding a newer version of `Aspire.Hosting`, `8.0.0-preview.5.24201.12`, which was released on the day I write these lines:

```
DEBUG: packageFiles with updates (repository=local)
       "config": {
         "nuget": [
           {
             "deps": [
               {
                 "datasource": "nuget",
                 "depType": "nuget",
                 "depName": "Aspire.Hosting",
                 "currentValue": "8.0.0-preview.2.23619.3",
                 "updates": [
                   {
                     "bucket": "non-major",
                     "newVersion": "8.0.0-preview.5.24201.12",
                     "newValue": "8.0.0-preview.5.24201.12",
                     "releaseTimestamp": "2024-04-09T14:50:53.883Z",
                     "newMajor": 8,
                     "newMinor": 0,
                     "updateType": "patch",
                     "branchName": "renovate/aspire.hosting-8.x"
                   }
                 ],
                 "packageName": "Aspire.Hosting",
                 "versioning": "nuget",
                 "warnings": [],
                 "sourceUrl": "https://github.com/dotnet/aspire",
                 "registryUrl": "https://api.nuget.org/v3/index.json",
                 "currentVersion": "8.0.0-preview.2.23619.3",
                 "isSingleVersion": true,
                 "fixedVersion": "8.0.0-preview.2.23619.3"
               }
             ],
             "packageFile": "MyProject.csproj"
           }
         ]
       }
```

## References

- [Renovate's `ignoreUnstable` documentation](https://docs.renovatebot.com/configuration-options/#ignoreunstable)
- [Pre-release versions in NuGet packages](https://learn.microsoft.com/en-us/nuget/create-packages/prerelease-packages)