Allow me to pin/lock package reference to the certain version/version range, so it's impossible to update the version via CLI or UI

[voroninp]

NuGet Product(s) Involved

dotnet.exe, Visual Studio Package Management UI, Visual Studio Package Manager Console, NuGet.exe

The Elevator Pitch

After FluentAssertions library changed their license in v8, I want to have a lock feature, so package of v7 is not upgraded to v8 accidentally.

Anyone who attempts to update the version should get the error with some message I provide to explain the reason for locking the version.

Not being able to lock the version has legal and financial implications.

Additional Context and Details

No response

[jebriede]

There are a few mechanisms that already exist that can help with this scenario.

1. Set a version range for the package reference to constrain the version using interval notation: https://learn.microsoft.com/en-us/nuget/concepts/package-versioning?tabs=semver20sort#version-ranges
2. Alternatively, or in addition, you can use MSBuild targets that will error if someone changes the version of the package without also manually updating the target file. Here's an example of how that can be implemented: https://github.com/NuGet/NuGet.Client/blob/313eecd3af442ee2eeed2e6decf310858934ab21/build/common.targets#L366-L370

Note that neither of these are a guarantee that the version number can't be incremented, so you'll want to rely on source control and pull request reviews to help prevent changes to the referenced package version, but they should add an additional element of protection against accidental changes. You can also consider a source control policy or action to prevent changes to a particular file unless extra approvals are provided.

Would these solutions solve the issue? If not, what other requirements would a lock mechanism in NuGet fulfill and what would be the proposed functionality?

[voroninp]

@jebriede , hm... versions range seem to work, thanks. Yet I had an impression that till recently UI will still show me the possibility of update.

Just an off-topic question:

How do I find out that new, major version update is available, if I specified a range?

I mean, when I am authoring NuGet packages I prefer to use version ranges: [x, y+1) to be explicit about what is supported. I do not like the default for fixed vrsion Version="x" which is any version >=x.

When the new version of the dependency is released, I'd like to see it and run tests to ensure my library supports it, so I can increase y further.