How to Launch a Scan on a .NET Project

.NET projects often rely on NuGet packages. By generating a packages.lock.json file, you create a stable snapshot of all dependencies—critical for accurate CybeDefend SCA scanning.

​

Recommended Steps

1. Enable Lockfiles in .csproj

   You can enable lockfiles in any of these ways:

   Option A: Add to your .csproj file:

   Copy

   <Project Sdk="Microsoft.NET.Sdk">
     <PropertyGroup>
       <RestorePackagesWithLockFile>true</RestorePackagesWithLockFile>
       <RestoreLockedMode Condition="'$(ContinuousIntegrationBuild)' == 'true'">true</RestoreLockedMode>
     </PropertyGroup>
   </Project>
   

   Option B: For all projects, create a Directory.Build.props file in your solution root:

   Copy

   <Project>
     <PropertyGroup>
       <RestorePackagesWithLockFile>true</RestorePackagesWithLockFile>
     </PropertyGroup>
   </Project>
   

2. Run dotnet restore
   This generates a packages.lock.json file for each project.

   Copy

   dotnet restore --use-lock-file
   

3. Commit packages.lock.json
   Never edit this file manually. Let dotnet restore handle updates.

​

Why You Should Use Lockfiles

Using a lockfile is critical for secure and predictable builds. A lockfile contains a fixed version and a hash for each dependency and sub-dependency in your project.

1. Supply Chain Protection
   Lockfiles prevent malicious package injections. This is crucial as supply chain attacks are rising.
2. Predictable Builds
   Everyone uses the exact same package versions, avoiding “it works on my machine” inconsistencies.
3. Performance Gains
   With dependency versions locked, build tools skip the usual resolution step, making builds faster.

​

Lockfile Commands

• Generate: dotnet restore --use-lock-file
• Locked Restore: dotnet restore --locked-mode
• Update: Change versions in .csproj or Directory.Packages.props, then run dotnet restore --force to update the lockfile.

​

Using Central Package Management

For larger solutions with many projects, use NuGet’s Central Package Management:

1. Create a Directory.Packages.props file in your solution root:

   Copy

   <Project>
     <PropertyGroup>
       <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
     </PropertyGroup>
     <ItemGroup>
       <!-- Define all package versions centrally -->
       <PackageVersion Include="Newtonsoft.Json" Version="13.0.1" />
     </ItemGroup>
   </Project>
   

2. In your project files, reference packages without versions:

   Copy

   <ItemGroup>
     <PackageReference Include="Newtonsoft.Json" />
   </ItemGroup>
   

​

Supported Files for .NET