Stable release · v0.6.1

Your NuGet graph, diagnosed.

PackageMedic scans SDK-style .NET projects for dependency drift, stale central versions, CPM bypasses, floating versions, vulnerabilities, deprecations, and PR graph changes—then traces every changed transitive to the direct package that caused it and can simulate one exact package candidate without editing your checkout. Opt-in immutable build/test evidence, CycloneDX 1.7, and unsigned in-toto analysis statements make the result CI-ready.

dotnet tool install --global PackageMedic.Tool --version 0.6.1
Read the docs See the scan flow Open in NuGet
  • Checkout-safe
  • No telemetry
  • Baseline-aware
PackageMedic logo
Graph scan complete
47 direct133 transitive · 1 warning
.NET 8–10SDK-style projects
Graph awareInventory · audit · Git diff
JSON · SARIF · SBOMHuman and CI evidence
Cross-platformWindows · Linux · macOS
Diagnostic matrix

Eight checks. One clearer graph.

Each finding includes evidence, project context, source location when available, and a suggested next action.

PM001

Unused central versions

Find PackageVersion entries that no affected project actually uses.

01
PM002

Version drift

Spot explicit package versions that silently diverge across projects.

02
PM003

CPM bypasses

Catch PackageReference versions that bypass central management.

03
PM004

Duplicate central entries

Expose conflicting PackageVersion items in the effective project scope.

04
PM005

Restore problems

Surface important NuGet codes such as NU1605, NU1107, and NU1109.

05
PM006

Floating versions

Flag floating PackageVersion, Version, and VersionOverride declarations before they make restores drift.

06
PM007

Known vulnerabilities

Turn official NuGet audit evidence into package, framework, advisory, and dependency-kind diagnostics.

07
PM008

Deprecated packages

Preserve NuGet deprecation reasons and replacement guidance with direct/transitive context.

08
One command, full context

From project files to an explainable diagnosis.

PackageMedic evaluates the same MSBuild model your project uses, reads NuGet's resolved assets graph, and runs conservative rules designed to avoid noisy false positives.

  1. 01
    DiscoverProject, solution, slnx, or directory.
  2. 02
    EvaluateImports, conditions, target frameworks, and CPM.
  3. 03
    ResolveDirect and transitive packages from project.assets.json.
  4. 04
    DiagnoseText, deterministic JSON, or SARIF with exit codes.
  5. 05
    ClassifyNew, existing, and resolved against a portable baseline.
  6. 06
    CompareAudit risks or classify PR graph changes automatically.
package-medic doctor

› package-medic doctor ./MySolution.sln

Running dotnet restore for MySolution.sln…

Evaluating 12 projects…

PackageMedic 0.6.1

Scanned: 1 solution · 12 projects · 180 packages

PM001 warning: Central package version is not used

  Package: Humanizer

  Version: 2.14.1

  File: Directory.Packages.props:18

0 errors · 1 warning · 0 informational

Dependency Impact Gate

See what an update brings with it.

Replace a flat package diff with causal paths, dependency growth, source trust, and one reviewable gate for the pull request.

package-medic diff origin/main .

PMI004 Added transitive budget exceeded

Contoso.Web 4.0.0 → Contoso.Transport 3.2.0 → Contoso.Json 2.1.0

Added direct: 1 · Added transitive: 7

Blast radius: 7 · Source/content changes: 0/0

Impact Gate failed · 1 policy violation

01Causal dependency paths

Trace a changed transitive back to the direct package responsible for it.

02Blast radius

Measure how many resolved changes one direct dependency introduced.

03Source trust

Gate source changes, SHA-512 content drift, allowlists, mapping, and unknown provenance.

04Reproducible restore

Require committed lock files and locked mode where repository policy demands it.

Explore the Impact Gate
Dependency Time Machine

See the resolved graph before editing the package.

Test one exact direct dependency candidate against restore, diagnostics, risk evidence, and the Impact Gate in two independent snapshots of the same commit.

verified simulation

› package-medic simulate Example.Package --to 2.0.0 . --verify test

Baseline HEAD restored in snapshot A

Candidate 2.0.0 restored in snapshot B

Resolved candidate: 2.0.0

Added transitives: 2 · Removed transitives: 1

PASS · restore + build + 214 tests

Runtime compatibility and package safety are not claimed

01Two independent snapshots

Baseline and candidate start from the same immutable clean commit with separate caches.

02Byte-preserving edit

Only the validated version value changes; encoding, comments, whitespace, and quotes stay intact.

03Fail-closed verdicts

Distinguish a complete rejection from an incomplete operational result.

04Honest evidence boundary

Each verdict states whether restore, build, or structured tests ran; runtime and package safety are never claimed.

Explore Dependency Time Machine Explore verified experiments
Adopt it without CI shock

Repository policy, with every exception accounted for.

Versioned configuration keeps the same rules on every machine. Baselines let established repositories block only regressions while known findings remain visible.

team adoption

› package-medic init

Created .packagemedic.json

› package-medic baseline create . --output .packagemedic-baseline.json

Accepted findings now have portable fingerprints

› package-medic doctor . --fail-on none --fail-on-new warning

1 new · 18 existing · 2 resolved

01Config as code

Enable rules, tune severity, bound parallelism, set timeouts, and exclude portable paths.

02Justified suppressions

Every exception requires a reason and stays visible in reports.

03New-only gates

Keep existing debt visible while stopping fresh warnings in pull requests.

04Read-only cleanup

clean --dry-run previews high-confidence candidates; 0.6 has no apply path.

Built for pull requests

Diagnostics where the dependency changes happen.

Generate JSON and SARIF from one analysis or run the official GitHub Action to place isolated findings beside the affected project files.

one scan · two reports

› package-medic doctor . --format json --output reports/medic.json --sarif-output reports/medic.sarif

Wrote json report to reports/medic.json

Wrote sarif report to reports/medic.sarif

PM001–PM008 mapped

Inventory · risk deltas · semantic PR graph changes

01New-only annotations

Annotate new findings by default, or opt into all/none.

02Code Scanning upload

SARIF 2.1.0 integrates with GitHub without changing project files.

03Official NuGet evidence

Opt into vulnerability and deprecation data without a custom HTTP client.

04PR-aware diffs

Classify upgrades, downgrades, dependency-kind and PM007/PM008 risk changes without switching branches.

Safe by design

Diagnosis without surprise edits.

PackageMedic leaves your checkout untouched. It does not apply fixes, rewrite dependency files in place, or collect telemetry. Time Machine changes only an owned disposable snapshot.

01No checkout mutations
02No telemetry collection
03No private feed credentials printed
04Restore can be explicitly skipped
05Inputs, parallelism, output, time, and Git snapshots are bounded
Ready for a checkup?

Give your dependency graph a second opinion.

Install the current stable release and run your first read-only scan.

package-medic doctor