dotnet list package doesn't restore

[richlander]

This behavior is incorrect, inconsistent, and inconvenient.

We have had implicit restore for dotnet build for many years. dotnet list package would benefit from this same behavior.

You first need to build the project in order to have the assets needed for this command to process.

Per docs. That's unfortunate.

Observed behavior follows.

$ dotnet new console -o nugettest
$ cd nugettest
$ rm -r obj
$ dotnet list package
No assets file was found for `/Users/rich/nuget-test/nuget-test.csproj`. Please run restore before running this command.
$ dotnet restore
  Determining projects to restore...
  Restored /Users/rich/nuget-test/nuget-test.csproj (in 52 ms)
$ dotnet list package
Project 'nugettest' has the following package references
   [net8.0]: No packages were found for this framework.
$ dotnet add package System.Text.Json --version 8.0.3
$ dotnet list package                                
Project 'nuget-test' has the following package references
   [net8.0]: 
   Top-level Package       Requested   Resolved
   > System.Text.Json      8.0.3       8.0.3   
$ echo manually add package
manually add package
$ grep PackageRef nuget-test.csproj  

    <PackageReference Include="System.Text.Json" Version="8.0.3" />
    <PackageReference Include="System.Text.RegularExpressions" Version="4.3.0" />
dotnet list package              
Project 'nuget-test' has the following package references
   [net8.0]: 
   Top-level Package       Requested   Resolved
   > System.Text.Json      8.0.3       8.0.3
$ dotnet list package --vulnerable --include-transitive

The following sources were used:
   https://api.nuget.org/v3/index.json

The given project `nuget-test` has no vulnerable packages given the current sources.

[dotnet-policy-service]

@richlander Issue is missing Type label, remember to add a Type label

[nkolev92]

The original design was to make it offline, similar to other list commands, which is why it doesn't call restore implicitly.

[richlander]

That doesn't make sense to me. The feature requires a restore to function and cannot detect when it will produce bad results (as I demonstrates).

Sounds like a broken design to me.

[aortiz-msft]

Assigning to @Nigusu-Allehu since this is related to other work happening.