`aspire update --channel daily` fails because nuget.config is modified before packages are updated

[davidfowl]

aspire update --channel daily fails because nuget.config is modified before packages are updated

Description

aspire update --channel daily fails with NU1103 errors when updating a project with multiple Aspire package references. The CLI modifies the nuget.config (adding a feed with packageSourceMapping for Aspire*) before updating the package references, then updates packages one at a time. This causes NuGet restore to fail because the not-yet-updated packages (still at their old stable version) can't be resolved from the newly configured feed.

Steps to Reproduce

1. Create an Aspire project with multiple Aspire package references (e.g., Aspire.Hosting.JavaScript, Aspire.Hosting.Python, Aspire.Hosting.Redis) at a stable version like 13.2.1
2. Run aspire update --channel daily
3. Confirm the updates when prompted

Expected Behavior

All packages are updated to the daily preview version successfully.

Actual Behavior

The CLI:

1. Finds 3 packages to update (e.g., 13.2.1 → 13.3.0-preview.1.26203.21)
2. Prompts for a NuGet.config directory and writes/modifies the nuget.config with a packageSourceMapping that restricts Aspire* packages to the dotnet9 feed
3. Attempts to update packages one at a time via dotnet package add
4. The first dotnet package add triggers a full NuGet restore, which fails because the other packages are still at 13.2.1 — a stable version that doesn't exist on the dotnet9 feed

error NU1103:
  Unable to find a stable package Aspire.Hosting.Python with version (>= 13.2.1)
    - Found 2552 version(s) in https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet9/nuget/v3/index.json
      [ Nearest version: 13.3.0-preview.1.26111.5 ]
    - Versions from https://api.nuget.org/v3/index.json were not considered

error NU1103:
  Unable to find a stable package Aspire.Hosting.Redis with version (>= 13.2.1)
    - Found 2573 version(s) in https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet9/nuget/v3/index.json
      [ Nearest version: 13.3.0-preview.1.26111.5 ]
    - Versions from https://api.nuget.org/v3/index.json were not considered

The packageSourceMapping prevents nuget.org from being used as a fallback for the old stable versions.

Root Cause

The nuget.config is modified before any package references are updated. Since packages are updated one at a time (each triggering a full restore), the remaining packages at their old stable versions can't be resolved from the new feed configuration. Reordering the individual package updates doesn't help — whichever package is updated first, the others will still fail to restore.

Possible Fixes

• Update all package references in the project file first, then modify the nuget.config, then restore once
• Defer the nuget.config change until after all package references have been updated
• Update all packages atomically in a single operation rather than one at a time

Additional Notes

• The CLI log (--debug) does not capture the stdout/stderr from the failing dotnet package add process, making this harder to diagnose. The log says "See debug logs for more details" but the debug logs don't contain the actual NuGet error output.
• CLI version: 13.3.0-preview.1.26203.21
• Exit code: 13

[davidfowl]

Repro Details

Project setup

apphost.cs

#:sdk Aspire.AppHost.Sdk@13.3.0-preview.1.26203.21
#:package Aspire.Hosting.JavaScript@13.2.1
#:package Aspire.Hosting.Python@13.2.1
#:package Aspire.Hosting.Redis@13.2.1

var builder = DistributedApplication.CreateBuilder(args);

var cache = builder.AddRedis("cache");

var app = builder.AddUvicornApp("app", "./app", "main:app")
    .WithUv()
    .WithExternalHttpEndpoints()
    .WithReference(cache)
    .WaitFor(cache)
    .WithHttpHealthCheck("/health");

var frontend = builder.AddViteApp("frontend", "./frontend")
    .WithReference(app)
    .WaitFor(app);

app.PublishWithContainerFiles(frontend, "./static");

builder.Build().Run();

aspire.config.json

{
  "appHost": {
    "path": "apphost.cs"
  }
}

nuget.config (before update — this was working fine)

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <clear />
    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
  </packageSources>
</configuration>

Repro steps

1. Run aspire update --channel daily
2. Confirm the updates when prompted
3. The CLI modifies nuget.config to:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <clear />
    <add key="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet9/nuget/v3/index.json" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet9/nuget/v3/index.json" />
    <add key="https://api.nuget.org/v3/index.json" value="https://api.nuget.org/v3/index.json" />
  </packageSources>
  <packageSourceMapping>
    <packageSource key="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet9/nuget/v3/index.json">
      <package pattern="Aspire*" />
    </packageSource>
    <packageSource key="https://api.nuget.org/v3/index.json">
      <package pattern="*" />
    </packageSource>
  </packageSourceMapping>
</configuration>

4. Then it runs dotnet package add --file apphost.cs Aspire.Hosting.JavaScript@13.3.0-preview.1.26203.21
5. This triggers a full restore. The other packages (Python, Redis) are still at 13.2.1 which is a stable version not available on the dotnet9 feed. The packageSourceMapping prevents fallback to nuget.org.

Failure output

error NU1103:
  Unable to find a stable package Aspire.Hosting.Python with version (>= 13.2.1)
    - Found 2552 version(s) in dotnet9 feed [ Nearest version: 13.3.0-preview.1.26111.5 ]
    - Versions from https://api.nuget.org/v3/index.json were not considered

error NU1103:
  Unable to find a stable package Aspire.Hosting.Redis with version (>= 13.2.1)
    - Found 2573 version(s) in dotnet9 feed [ Nearest version: 13.3.0-preview.1.26111.5 ]
    - Versions from https://api.nuget.org/v3/index.json were not considered

Test hint

A test could set up a project with 2+ Aspire package references at a stable version, run the update command targeting a channel whose feed does not carry the old stable versions, and assert that all packages are updated successfully (i.e., the nuget.config modification does not happen until after all package references are updated, or all references are updated atomically before restore).