Documentation — PackageMedic

Inspect rules from the terminal

Terminal

package-medic rules
package-medic explain PM001
package-medic explain PM008

Rule severity can be overridden or a rule can be disabled in.packagemedic.json. Suppressions require a reason and remain visible in policy metadata.

Diagnostic catalog

PM001

UnusedCentralPackageVersion

warning

An effective PackageVersion is not referenced directly by any affected project.

Detection detail: When CentralPackageTransitivePinningEnabled is true, a package in the resolved graph counts as used. The rule runs only after successful evaluation and assets loading.
Suggested action: Review target-framework conditions and affected projects, then remove the central entry only when it is genuinely stale.

PM002

PackageVersionDrift

warning

The same direct package has non-equivalent explicit versions in overlapping TFM scopes across affected non-CPM projects.

Detection detail: Equivalent exact versions such as 1.0 and 1.0.0 and versions in disjoint TFM scopes are ignored. VersionOverride is treated as the effective explicit version.
Suggested action: Align explicit versions or migrate the shared package to Central Package Management.

PM003

CentralPackageManagementBypass

warning

CPM is active but a PackageReference supplies Version directly.

Detection detail: An explicit VersionOverride is considered intentional and is not reported as a bypass.
Suggested action: Move the shared version to Directory.Packages.props and reserve VersionOverride for deliberate project-level exceptions.

PM004

DuplicateCentralPackageVersion

error

More than one effective PackageVersion defines the same package in a project scope.

Detection detail: The conflict can originate in the main props file or an imported props file.
Suggested action: Consolidate the entries into one unambiguous central version for that scope.

PM005

NuGetRestoreProblem

NuGet level

Restore output or project.assets.json contains an important NU warning or error.

Detection detail: The original code, such as NU1605, NU1107, or NU1109, is preserved. A failed restore is also operational exit code 2.
Suggested action: Use the original NuGet code and PackageMedic evidence to resolve the dependency or restore conflict.

PM006

FloatingPackageVersion

warning

PackageVersion, PackageReference Version, or VersionOverride uses a NuGet floating pattern.

Detection detail: Examples include *, 1.*, 1.2.*, 1.2.3-*, and 1.2.3-rc.*. Fixed ranges are allowed; unresolved MSBuild expressions are not guessed.
Suggested action: Pin an exact version or deliberate fixed range when reproducible restores are required.

PM007

VulnerablePackage

warning / error

Official NuGet audit output reports an advisory for a resolved package.

Detection detail: Low, moderate, and unknown map to warning; high and critical map to error. Evidence includes version, advisory URL, project, framework, and dependency kind.
Suggested action: Review the advisory and validate a compatible non-vulnerable update or replacement.

PM008

DeprecatedPackage

warning / error

Official NuGet deprecation output reports a resolved package as deprecated.

Detection detail: Critical bugs map to error; legacy, other, and unknown reasons map to warning. Replacement package and range are preserved when the source supplies them.
Suggested action: Review the reason and compatibility, then remove or migrate the package deliberately.